Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 20:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
- Size 3.9MB
- Sample260706-zbd3asdv4v
- SHA256 cd7bfc449c2534aeca5a3dc20a3180b714083d202d4d85455627befcb5448975
- MD5 a168bf0c5d17609173946e474001c472
- SHA1 8b20d39531b9ca1c8d4eaed62a9c4a666f7f4549
- SHA512 6afa0ec5700d2ba70c482859f7ab584d8976e6e2a9c56507e37e85b12b9c5487c5447c41a6c5fc666c36ae5fa92cb069e1b68053af213c50aebcc1d6d89ff93b
- SSDEEP 24576:E9jMltl/1TswUPxhWKLYiLk2GFPut8UrRhHt8m800dAu6W2qTxi9trwUl7eFsj:Hyn7GFP+/HL800dAub2tkrFs
- TLSH T1E816CF2171468435D950407297B9DF7E423DAB260B3B86CBA7D02F7F9A704C23B36A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 11 IoCs
pid Process 4320 elevation_service.exe 2948 elevation_service.exe 6064 maintenanceservice.exe 3068 OSE.EXE 4912 PerceptionSimulationService.exe 1568 perfhost.exe 1588 ReFsDedupSvc.exe 5924 SensorDataService.exe 3700 ssh-agent.exe 4336 AgentService.exe 5140 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5fe5523d635dbbe1.bin elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000feb64096860ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012734698860ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8593b97860ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004653a896860ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000870139d7860ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1bb1e96860ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a1861d7860ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe - Modifies registry class 36 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2699128254-3633964024-152949075-1000\{92D02AB6-A33B-458F-868A-308714F4C487} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0200000000000002 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2699128254-3633964024-152949075-1000\{855CE396-0B84-4DD7-A0CE-707CBA378871} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe - Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1912 explorer.exe 1912 explorer.exe 4320 elevation_service.exe 4320 elevation_service.exe 4320 elevation_service.exe 4320 elevation_service.exe 4320 elevation_service.exe 4320 elevation_service.exe 4320 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeBackupPrivilege 1588 ReFsDedupSvc.exe Token: SeRestorePrivilege 1588 ReFsDedupSvc.exe Token: SeBackupPrivilege 1588 ReFsDedupSvc.exe Token: SeRestorePrivilege 1588 ReFsDedupSvc.exe Token: SeBackupPrivilege 1588 ReFsDedupSvc.exe Token: SeRestorePrivilege 1588 ReFsDedupSvc.exe Token: SeBackupPrivilege 1588 ReFsDedupSvc.exe Token: SeRestorePrivilege 1588 ReFsDedupSvc.exe Token: SeBackupPrivilege 1588 ReFsDedupSvc.exe Token: SeRestorePrivilege 1588 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 4336 AgentService.exe Token: 33 5140 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5140 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5140 SearchIndexer.exe Token: SeDebugPrivilege 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 916 2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeShutdownPrivilege 1912 explorer.exe Token: SeCreatePagefilePrivilege 1912 explorer.exe Token: SeDebugPrivilege 4320 elevation_service.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 5884 sihost.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe 1912 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5452 StartMenuExperienceHost.exe 2248 SearchHost.exe 1912 explorer.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5140 wrote to memory of 1920 5140 SearchIndexer.exe 98 PID 5140 wrote to memory of 3964 5140 SearchIndexer.exe 99 PID 5140 wrote to memory of 1976 5140 SearchIndexer.exe 100 PID 5140 wrote to memory of 2916 5140 SearchIndexer.exe 101 PID 5884 wrote to memory of 1912 5884 sihost.exe 106 PID 5140 wrote to memory of 5128 5140 SearchIndexer.exe 112 PID 5140 wrote to memory of 5504 5140 SearchIndexer.exe 113 PID 5140 wrote to memory of 3512 5140 SearchIndexer.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_a168bf0c5d17609173946e474001c472_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:916
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2948
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:6064
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3068
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4912
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1568
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5924
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3700
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4336
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1920
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2699128254-3633964024-152949075-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2699128254-3633964024-152949075-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3964
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1976
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3000 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:2916
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5128
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5504
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3000 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:3512
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1912
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5452
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2248
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 2b7147d1675a21d2df5f8f3f5fc1c791d335839415401de2257b86b0da45f965
- MD5 ec51eb37a89be7f41b3ccfbf5d219f9c
- SHA1 0ffcf29fd7f38a359cf5e03b25441ccd9eb72d13
- SHA512 4490c8e12a7ab78b28ece42f870d7c50ffd37afba48ba559bad31f89bbeb80d72d9464ecbc81470914dada49cb740f53462f31363ecac4cc6d5c7dbfe49cf1bf
- SSDEEP 49152:vb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnxub2tkrFs:t3q6tjBGub0kr
- TLSH T109D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 fbfcbccba6f0cbd392ee5b40a9f2657c48a200c1e46857a361d5561b48d023a6
- MD5 0dd5fed134c7744ccb981b2fc93c8e34
- SHA1 e6d3ff493598b74856f20d7f8a87a26bbe1a019c
- SHA512 cacee8145b3ff1a36433da91ee5108e6ee86c17abbd8e70e92fbce7a7000a8a29cc5d9d82f2ae935b698db81187ef76b50e76baeec90ec9062eb8309fe134b97
- SSDEEP 12288:M1XLsswWkxy2lRq2czAWfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZJ:6XYfDtczA6u6W2qTxi9trwUl7eFsj
- TLSH T1FE650229B3E408F8ED678278CCA18515EA737C4147A0E78B03E499661F377D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 043926a68496b32780f7ce38e31d3e96281c75bd88939e3da9649fd02068829b
- MD5 621a452153158df3babdd508be72e2b6
- SHA1 af7f922a88235f4ee008602b24019a06eb1e545e
- SHA512 74642437e9641bf2d4158f1db83e65e10d9778250df72635bce5564ce00173e5b823b1766dfe13cca7af319c492f0d4d4b9cce0a026d3644c267e9919340eb7b
- SSDEEP 24576:I0Le5ji0hmxnrMZu6W2qTxi9trwUl7eFsj:IPji0AxEub2tkrFs
- TLSH T1C6859E16F5748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E6BAE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 f186ac4cf91558942cdf92d168108ec8d2ee5a84b5a1d04da42c8afc7ad1a38e
- MD5 a4066f6799ace90a3e12f49f5b0f4d93
- SHA1 e37bb0148a2ad7109f005d20af526a4659d8f084
- SHA512 b379ca2b8269204499d2a7b5b97412e623fd603fc8d78abdc980f8e4b7f3d9119b43a14d38a379c7bec503c06ce8a4b56c66f3d55f1991cc7e0bc6c1df28a46b
- SSDEEP 24576:1a7/ezSC6vUyDZaqgrvWx6q8wyuHu6W2qTxi9trwUl7eFsj:8/ezSC6vURPvMHjy4ub2tkrFs
- TLSH T124755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 b3f59d659852763fad2bc1957a9ad111c8155cfdba490ebb7a0fb88ae0e356e7
- MD5 4ace3f5a42ea60f37b1534475affca13
- SHA1 6ff5efb4284367645fe1154a98fbeccce343f3ef
- SHA512 2fc02381dfdc076bdb353c7e66a69ad2ace37b8ab17efcb22e49fe1a45546f07c3991dadc097830b82dfdcd43c2725fd1a1be5c084e563f29b752c1f6bbaf0aa
- SSDEEP 24576:wVbqPb88hv/lV72u6W2qTxi9trwUl7eFsj:wVO88hXlVyub2tkrFs
- TLSH T100559E66F5748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C2E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 2b2351e6f91ff3cd6dad314da3fee372706ee721b03417b6b2ae2dfc4602b541
- MD5 e14ef75c1c573d3fd5c2721a4c38ed82
- SHA1 b61ade6e4907e8b37142ffd1718dd4374c8e918a
- SHA512 204950f4ac3e823db795b79df0a88b173839dc79620c322718e5f26d35f4b17d87df1dd0d95618acbd738295e4b4ed75923d2295140acbc9a7415232a6deafb4
- SSDEEP 12288:vGNfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:vGFu6W2qTxi9trwUl7eFsj
- TLSH T1D945231BD0A94460E7BE12F13DB8609D485EBC4589C8C80763C3BDA7487DDE2DDE6297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 4a60908914dc23a9f56d1073b06d176550a0674b6e368abbbf6b80552938ed7e
- MD5 fec74fcdd7804cb8ddb63b8597ef869b
- SHA1 02bd9cb40dcfd0a5622b79a8bace057f455232aa
- SHA512 2ec0eae648f5b020114066fb2b33345926b56a712871cd9ce32ad7f45dcb28a53cd3a274f03543c19085b00055d1cfa25c050459b4d6c56cf700b1a0a03976b9
- SSDEEP 12288:NeBNUbTVO86U6fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:NJIU+u6W2qTxi9trwUl7eFsj
- TLSH T1FB65CF3BEE28FCE2C27E4DB95A918240D77278304F5193CBD265820EDE275E15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 a56895c1df769232728d865a0d2e0e5afc2c8e5b1e058a724b37101b6200bd66
- MD5 ed1060ab5f9c190e9833dddff4f29932
- SHA1 1c75ce11ff1260f5b562b6e43e74de29f5ce850b
- SHA512 4dc6c932eb21eb56f546401775e036ad601e9bc78cb85c15e131b131a010ac56a99953136d806e065e59c6136cdf8d5d7ec95a3aa00fc3bd4462685bbad7e1ba
- SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THO:hQvGAdlCEL8c/pRNw5C3ub0kr
- TLSH T12D266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 6f3b943b7c6788add504323e592620c409da9c25d2aa8e0673221325e38f872a
- MD5 f98953bc907653713df55af0daecfe44
- SHA1 c1b1c6f88ab97ffd88943d48cd6b76bfba762522
- SHA512 974ed6769606d5138aa384c8d3b16ce638eb87518369c5b398ba23a20929d3e6a689ecae810ee05b3dbfbdde2c79129391d5000245629b26d29918c223592a2e
- SSDEEP 12288:zAwSfxL/2Dc3xDLLmt0LDQewsAjQfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZaf:swewsAj0u6W2qTxi9trwUl7eFsj
- TLSH T18175E031FA74E036C3BF0DB22B35C71A186DB9204B9119C3E3E89D9E59742D22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 6309ac31b8a9474211a091a64c45389c6106a927756741b4a068a7d4d612c30c
- MD5 cd4c9e81245b24cabbea693055654e68
- SHA1 af544d55ebb37abee0cca61e4a7a8a9c92c0a726
- SHA512 0871428efbc497f1f1fe32f60c92759e15a1c706cbff8c43631903e679870c26200818275118880c7f167d2f9304ce5079ead6079cced0c5d5e148dd3cc5cad4
- SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHMub9:uUEtQevvqc2W1cpV29I32M6
- TLSH T130474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 ca1f872cb2709199d7e5619e0c3c4ec52576f59607f64d4b147fcef04925307f
- MD5 b769ed8d4f698cee91efc8223c2807a0
- SHA1 c9555473c76306b218b612effa44f04ea93baa64
- SHA512 eeda452cefefc7abed8830a544ea9117cb2971a1dbd99fbb1ef29455a6f16b43d59c14605b05152d6aa8dfff0448db11c076412f8c89c9819decaa61d11af68e
- SSDEEP 49152:XCbRquA/m2yL5zTfFiV+XenmE3/zUub2tkrFs:AoquVjnmrub0kr
- TLSH T178D58D0976B8C1E4D1F6C37896A2C647F37178154B349BEF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 25b376168798a0b09f41da887a4d2677b4fc1e6dff93722cc15cc4b3ba8474f2
- MD5 c97de5cc25912f86b3994b556ce08c08
- SHA1 647dd150f99621b01b31cd885001112d56ad69ea
- SHA512 01a352a4113eed84b099cf4e9c2703def49223300ebce1910ee086e40010486698b4a48e88ae8022879267ef4b2766df22e2de13fb88e75061bfc220a54708b3
- SSDEEP 24576:xAhGLmIFoiwtA5l7S53Lu6W2qTxi9trwUl7eFsj:xAM1Foiq5bub2tkrFs
- TLSH T1C635AE81E7F945D4F5B3AAB899B69170EA76BCA65E30C20F2250D11F0E37E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 a5a2288cf31062b3ac044062df18f9e304ea5e7ec9fbd19345c883b116d48521
- MD5 62ddb1b34bb9141f0048923a0876e3af
- SHA1 2730f7585a781565c18d61b8088cfe314d2123e8
- SHA512 14174cae89ec1f27886b56be518bcd5e244e2f49991a28525aa517a5588d5ae2b0b2ded70d8c88075d7ae318583903e98a9a7df993780fe3a04b6762b3b96418
- SSDEEP 12288:6mw5HEjsChNOBFgl0WDm+CvfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFf:TwuXOWYu6W2qTxi9trwUl7eFsj
- TLSH T1CF65F14AB2E40CF9E96752398557C136E7F2BC022A25CB1F13A0C65B5F37361AD2E760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 9a722c68af76240046017ef8cf21ba450b81a1e5756115cf0f2d04f7d66fda48
- MD5 7fc155b46a00ac775c723867a4bb1b1a
- SHA1 3bd95b8c78fcfe66868703c473c19d75595bb5a5
- SHA512 c8f55d091b49ac337adc42c65099d729899dc37fcd0da70e5d32f5d51ef503d6e2489bf360175bf9ae544f7f73c12294f22a6d05f15f517cabfa2b8e73d0c1f7
- SSDEEP 12288:pbZ1IyAfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:1Zuhu6W2qTxi9trwUl7eFsj
- TLSH T19255125BB2E820F4E2AB12789CE05149D7727C42577583CF139166AB1E3BED25D3A323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 449b8da4da68603751d18df1e2302ae1becae5256b905f7aa56f47799446e124
- MD5 f36f74ca23394a7c0cedf3c042f211fc
- SHA1 5d48de485072958994ff2e93f060e4372535daf8
- SHA512 9123603c31b36560dc8b7db25737c6a746b206df35222f1c86e38ad09b00d2b0a6403eb4f9a0eca1b3abbd32abe93756c274cef11f515dc43777c427a344bd61
- SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uq:iQRQyi36YOcPuLvw2gAf+PN3Cub0kr
- TLSH T168667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 9d7c563305a4198a073a4662827a728008df6807e8ce91c5a9d53f893aff0d98
- MD5 463683f9350b638526541a41c207d816
- SHA1 412c42abf2b780cca0dd74dcfdea0ade95b46126
- SHA512 685be9d34e366dc4d436de273cd290c03fb79f08d2973b64f8f46c594539a0430a55f97512d746880fa72228b8454b554a00d3ec57ed7c607e4ba03c8a79fa43
- SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uq:3QRQyi36YOcPuLvw2gAf+PN3Cub0kr
- TLSH T162667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 306cfad8fb28abb0ab768c582cf5318cbaea320b1bc621f59c605ce9a5eddbf3
- MD5 57fdaef9d30dbd16a85bb0dd370e0994
- SHA1 1cf74c5b6293337f311ce0b11e6e6eae2adf3bbb
- SHA512 68ad805377a320650d698dd176e5a31658fda0864d12090ae134869b11a65945a91c5501ae68ae74fce0edee457a57daa4be17e635e40db4aef0605947836bac
- SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0xu6W2qTxi9trwUt:t68Qg55nhxeWu7PNU3/Eub2tkrFs
- TLSH T16BB54933B2F600A9C44DE1769F4A872196D27C758FE0E3DB854172161BB2AD07B3A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 93f7a3ad7321b570cd7f7260be588836d02ba791e2e464ca63e92663d86034f6
- MD5 24a15a10173d15b7716b60da30ac04f1
- SHA1 c2088e8122555ac877b7d8024689972d75463e50
- SHA512 7916dd502fee978ae1c761af05884f75b921c74ed47df392bfd09f168f83035559f0800d49b93ceb1a8136e60c8378c29be52a9b652ddbf999b9448b798f8854
- SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99:/y5112gYy5azzVvD69nLKnhZFub0kr
- TLSH T1A8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 6b07febf00dc4bf4493c3a206a03dca027c4b3aeaaae157fa7bdb3615bead302
- MD5 e6053955ab78885ac4127246c8e92f37
- SHA1 610c9a9bb5f48fca8584db339b61c7505af8e63c
- SHA512 25ad1a57359191f92c59aca20d693753c9e4a981ce950eb65f2b9254a473d97d3ec693f1bb3487bc6ce9334d62ecbb2419da6f3bd9a9de0f0e32aaf2ede3ed8f
- SSDEEP 49152:VB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glKub2tkrFs:bu6JmQxd2dKub0kr
- TLSH T127D59D13F1DA01E8D06ED178974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 32fd3aa8f3ba17b8f0ee5cf9e086938366adf185bc9da70426c14ed24b4b47bb
- MD5 04916fa1921f86913510c4eb588f77a1
- SHA1 97ca42e37f653d75e563832f50b9521f995b6db0
- SHA512 24eb891f9050930f02be9dba72145df49a7ebb4232f7effc6b6aff8bd2820d0a6ad8d967e7bedcaa5019fc2a8d90a70cba646bfd192e8e6507f01e124afa5e80
- SSDEEP 49152:71hpsNoJpF1A6yU44CwH7R4xeub2tkrFs:7mifPVRrub0kr
- TLSH T190B5AE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 53cc8193780bd88abf624df57dc61879b5ee1d854b4bf07d0e1d2e99b2e20c2a
- MD5 597e02719fe1f931725d5c5e2788a00c
- SHA1 f9e18fe4e466bec96865ad28b73dc5848ad43551
- SHA512 dd74b7a6bb9e86b7ec7331442f0a058396455cd4553afac81158c43f78276a78572e040be85eb1d04708920b9eeca3a14cbac21a6156db8534c9377cf652ffa7
- SSDEEP 49152:xSuZQIY0Be2KIRVtOnks6NMHqhub2tkrFs:f5dKOi61hub0kr
- TLSH T11AC5BF03F2E940E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 834310181e83df4b8cf9fefeb9b6dc43114aff3bf2c3c825fdf5ff31dc8c342c
- MD5 d3b11cf4bcdbf2c41767957095f61465
- SHA1 8573a161958c63eb8f745d15bb3d9c3e7a71adfe
- SHA512 a61e8d5de78c22376b7602e5e7d796e318e2057bacba7ee8977232c60040e121f147189383efd4da6d182f3ab74767b74ff79dd9cf1c22d90da78a984f563d47
- SSDEEP 49152:9htSn8EApI0figGgiDn0AP5w6ub2tkrFs:sX2i/phPub0kr
- TLSH T17E95BE13F2D900E8D05ED174C7568632E962BC160B39AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 9369929738958316384eb6fa6220bf7827355fc362ead8b590a85f95410772e0
- MD5 875993d7b8c554b7adfc2734f83de8c6
- SHA1 68a7d59666f8820a1609e3b08bc892c09f5a88c1
- SHA512 d41f72aa1b69f4edf2e37dc869ec2fbc31192a6742e64ca9c4335b45f6c4398dc40d84b1c1841aab798d1a9abfa0ef9022d2553659469afb6f51ff54fc2bdb6e
- SSDEEP 12288:OVfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:Otu6W2qTxi9trwUl7eFsj
- TLSH T1E445231BE0AA48A4D76E13F139A4609D484D7C478AC8C40773C3B86798BDDE25DE62DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 83a58b57a3272efc9b66eae2921098a52e9198604099abf5fca5ed1164d5fc75
- MD5 5db2171d2dd50e9a8d5cf8aed4dd87c5
- SHA1 7396c71a14c1f8d793a9a2f11c96d79c46530605
- SHA512 d488c77bf25edb7b53c112ce01e75d330ff2aaa4ea06d8ad25fa6b56cc694c9821a279945adcf18be73ed392521228cd8367fb7ac8a636711ec1f237f6e29af6
- SSDEEP 12288:BsfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:BQu6W2qTxi9trwUl7eFsj
- TLSH T1C745231BE0AA48A4D76E12F13D64609D484D7C478AC8C40773C3B86798BDEE25DE62DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 6e4ba7a756534a138e21044837ef064e39f2068ffa80979dd7691ec9c5afcca8
- MD5 bd3a2c3626c79638fe2ecb9e244aeb12
- SHA1 4dda6a124802befc970aadb3cb9b9a773205aa1b
- SHA512 fb642a1fd4b9b5276de3d09f5307656fc9e4502d49c360b9095efcdb9dce00164a44e4f7864a0caedb171eacc5afc920c1082d980a2c4a138a0e438a0a14e46f
- SSDEEP 12288:iCfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:iGu6W2qTxi9trwUl7eFsj
- TLSH T14745231BE0BA48A4D76E12F13D64619D484D7C478AC8C40773C3B86398BDEE25DE62DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 a31a6530b16d3c81dfe0cd0fd4e23d9c873c9304fb521602f53cdd8dcb57824d
- MD5 7e03d7420e4519f82fa8f2e162a94ba3
- SHA1 94c9f6fcc3c5fc1caafdd32328d90e264f88db45
- SHA512 ff1fe05e4a1e02d2598375c1cdf3c15027d497fd2db23b91f535497cd1984a1505e06dd92668b242216cddf87153fdd3a35ebc035870cf02e3d4d1645f358887
- SSDEEP 12288:TVjfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:pu6W2qTxi9trwUl7eFsj
- TLSH T1A045231BE0B900E0DA7AA3F16D70509D95AEBC42CBA0C64F638238570CBDBE15CB5797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 a81e3331138549f1b7c15703d1a5e60acf459422a13ab69ac304ce35d4374657
- MD5 c8c3c37e7b758c58bfbcbf7eea63a4d1
- SHA1 40f8dd258656e7066ddd3a64b78fcf9d350b1a95
- SHA512 b451ad63a2dade2bb75601179cb48b623a18f88f67edd91211cb618cedd775ac8ef0d70127a4bd01ad3c41c16ba05f2d8c4a2a4403a71724f53b329f7acc7b18
- SSDEEP 12288:G7fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:GDu6W2qTxi9trwUl7eFsj
- TLSH T1E845231BE0BA44A4D76E12F13D64619D484D7C478AC8C40773C3B86398BDEE25DE62DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 6d483ae423983613b4d44d9da9889ed92e4d19cd35c19f092dc462b8ef4483a6
- MD5 5adba7819a4d26b59ad0fb78f09f6b4a
- SHA1 f0fda755611c34643792c9db76bdc9efcc58d01d
- SHA512 81ebb63c2138a7492c9ca55f8188d5dab1e4d31dbaa674288756baeebc771f63b83c4d698bea7238d65868fbcb00d4fadece0a2c93f47e8dbda597e53184e661
- SSDEEP 12288:mYfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:m8u6W2qTxi9trwUl7eFsj
- TLSH T1AD45231BE0AA48A4D76E12F13D64609D484D7C478AC8C40773C3B86798BDEF25DE62DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 02b447181176fc9303551fbc901f3dbbeb1a1eb1c435540c638c17fa85cf9e4b
- MD5 dd1f649a9b282822bf7832890fab976b
- SHA1 f07e62357b33829ff643bf687027540e4c6cb7a6
- SHA512 2d1f27e6f5dc515895b5ce5a0eda67d88c6434290b51712c0151bceb50ca9eb8aaf19f43988110af348a2d54101be4619585d7788e4f5c167c91b7eec766ed50
- SSDEEP 12288:eEfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:eou6W2qTxi9trwUl7eFsj
- TLSH T18E45232BE0AA4864D76E12F13D64609D484D7C47CAC8C40773C3B86798BDDB25DE62EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 e3f84d370ee792ac83bf189038b58df1d043ed4060e1a9cc41cb4a67ac43d73b
- MD5 8d9dbea89089d51a52e895eb3c1cbaaa
- SHA1 a5f38ad295bca7e8076e02fd827923136120d2b1
- SHA512 ec183dfe357d2b6f00c8bf095918a5e1fd54e6793fe705ac28541f70833d59aa14ba7a1d719bd7eee8954148be9ab19503135534ca13b23edec2d143c7250f56
- SSDEEP 12288:+iZwbNzzFEoS2cPvyMfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZud2:hZMJzFVSOwu6W2qTxi9trwUl7eFsj
- TLSH T179650295F2A008F4ED67427ECD65890AD6B27C1A0B60C60F13E436675F377A11C3EB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 3491f28105e785b8ecb249cd7c1e8cb272bc3c46c08f7a7e8f6dc109e9ff6621
- MD5 277f9adcdd11068ecf577a4b64df6411
- SHA1 4e8921c3fdbb9e1c0972a3d8a57f1161ad576cf0
- SHA512 8230c8f3b936c9af15f7aaf4b74b94006e856e94d3dabb50118c8b9ce093c0c868333b97683a109b9c59adadab1528d98d18bd288f6657bf5b4dbaed6c6ba236
- SSDEEP 12288:IpfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:IRu6W2qTxi9trwUl7eFsj
- TLSH T14E45231BE0BA48A4D76E12F13D64609D484D7C478AC8C40773C3B86798BDDE25DEA2DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 92a8b60554bb689da0510c7538da0ef81a62647eee4a8579fc181025889979d5
- MD5 56cccd8f9ad0bc47762cf31581e4bcef
- SHA1 d2a7f3c3e19f9f7e108965f627d6fae79f58848b
- SHA512 2d09ec4b5dbbaf37f1f4efe92b1473c39d0cd799464e1aa30e96f5e54f4ec10ef24e2bb48922dbab6d9fc040500087432cb6225d495363798306c8df7b118cc1
- SSDEEP 12288:T9fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:T1u6W2qTxi9trwUl7eFsj
- TLSH T1D145231BE0AA48A4D76E12F13D64609D484D7C478AC8C40773C3B86798BDDE25DEA2DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 58d201adeae1ae5d99ceb1b78ca9769ee858518db24ead7ede1942b1ef50b8f0
- MD5 c9a9a6b40faade27e2ac5b8f2b134760
- SHA1 de8da431c10fe0cc56fa779b38b45de1139ad899
- SHA512 1205ed88b34fd083c5140c1af77602f8796e2e8847fc5fd8fe727848227d68d7b3ae242c223a75013da985bb8bd880d4c7e327a3d4da0ce5c8f91773761fce97
- SSDEEP 12288:IyPz5L8AfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:Jzyku6W2qTxi9trwUl7eFsj
- TLSH T1A8551207B2A530F8D13B52748CA11A06F776BC324B60CA9F139056771E3B6E19E7EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 18f5dddb4594370a9fd5a8ac6d4a2b1cd5c00cae0afb20eaabe9a139b31f2a79
- MD5 1f01155d0abcb07536f75c2236fb1624
- SHA1 7df58d76e7236f80e15795bc5102ab536a1174d6
- SHA512 4a7f4f8a2c4c37c0e37643e3902e3a484dce554f0b9ef3c8b1162d19288ab466d29f7f8d90b59b2a7647a94270f2e8f070f997945dd0b137ae6694bc2ef72ef6
- SSDEEP 12288:npfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:nRu6W2qTxi9trwUl7eFsj
- TLSH T15945231BE0BA48A4D76E12F13D64609D484D7C478AC8C40773C3B86798BDDE25DEA2DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 d886196f67da2b42c41191d1819d9c7834b8c556dc94e24909e67d12f608f29a
- MD5 07d7a34bcffa8ec3b90d77dfb5b4bbfa
- SHA1 8de37373dd669ed2373deb7539c3ce198021ba9f
- SHA512 4315cedf3ced14e1ee63443652fefdd9c6be4c930c91e26333e7c48ba5a2e9835ea999cdff7d988b6d2fdfd522015a4522671497ddcf6702712cef6fa0ee2732
- SSDEEP 12288:9pfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:9Ru6W2qTxi9trwUl7eFsj
- TLSH T17A45231BE0BA48A4D76E12F13D64609D484D7C478AC8C40773C3B86798BDDE25DEA2DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 4e6ee6d2e65bc85df49d6ec29964bfc339beb30cef3563e6a9dc81c64e64d0be
- MD5 ac1fd069731b8cdcd8d98dae260406b0
- SHA1 0cd0c8619562b4b48eb71850f1e8f873aff626d7
- SHA512 24d9b9af9b2fd0474d39f98ee063dfa980e6a3bf1aa55c884f902649714449632064d2cacb8c70d2449782b372ecaaa7591b913d3d92c02de50215c51765e384
- SSDEEP 12288:jyPz5L8AfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:Ozyku6W2qTxi9trwUl7eFsj
- TLSH T15D551207B2A530F8D13B52748CA11A06F776BC324B60CA9F139056771E3B6E19E7EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.4MB
- SHA256 702c3ac6b9c32d7903f2e442f84eff421195102208775f8a71aa553f761124fd
- MD5 e2c90300a0ef5431960a316f4361119a
- SHA1 7e9140af80803d24ebbc21c21798e3e001951cf8
- SHA512 dab9fa4e10485dfee8d36b67447cb603564c2b8968bc88bbd558b320185f4a66e70178a96b814b320170ddfe3c9bd146e097db3e4429172d619a84cb8f6586f4
- SSDEEP 12288:yCd9XWYoaLHF3z0z04PDvhSfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFf:TTuaLl3z0zDWu6W2qTxi9trwUl7eFsj
- TLSH T1E7650295F29018F8DD67827ECD65890AD6B27C1A0B60C60F13E436675F373A11C3EB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.6MB
- SHA256 d66f671f3934e167f33c790ea2fb315e011a5684bcbb8e45ea6e6ae19dd66eed
- MD5 459adf05d588072dee20e44227c2fd37
- SHA1 5889413030d22c740f28aee58f8917896abbb0a3
- SHA512 f70d5c466f2375184df665f5a91181da0667f7f8f71ac812f2d26316f116e9635e30d3d7bdc82332e5504179f6dd5b28efc510be700aad986a21e7c66bdb7c15
- SSDEEP 24576:C3xd9CHKy7GZiu6W2qTxi9trwUl7eFsj:kxd9CHKyasub2tkrFs
- TLSH T16675CF91F3E810E8F1B79A358D764511DAB67C5A1B61CE8F03A4261A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 5f5acfe0be7df50a55645bb632db5c4eeb5d620d77faaa26e5d7f69957c7867a
- MD5 aa532ac8dfb2d9a1b1f003aecc05fced
- SHA1 0173ac5986faa5b100e27a1d54c86f63f93d219c
- SHA512 713f86e91429f868a4546adaf054a82d2b7e93bcc81a44fa2d1ab0a71215dea9101c13d44fbaed9997d60960d929c1c0504783d14e3c73d6334752e104b1fe7a
- SSDEEP 12288:yifugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:ymu6W2qTxi9trwUl7eFsj
- TLSH T10445231BE0BA48A4D76E12F13D64619D484D7C478AC8C40773C3B86398BDDE25DE62DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 e7adda53c04c9f42be49e7e23720c03ff1e5d0e8c9d735eedac4a5938f341149
- MD5 6156a2f6f3387c1c0e878651c3f213ca
- SHA1 7f116ade25edb8a6cf605508dd09c714ae8368b4
- SHA512 72c103ea8f0c9f6cb30847a328aea76d0ca19a164ee063b7759d3056a23c34342d4a47e8b2325dbc5adb67f38823a62dd42c0b51f1e3bccfce76493ea36dea3a
- SSDEEP 12288:OgfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:OEu6W2qTxi9trwUl7eFsj
- TLSH T1D645231BE0BA48B4E76E12F239A4519D484D7C46C9C8C40773C3B86358BDDE25DE62DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 c4c96977c358238df99c5618354bf2fc89ec3efdcfac591da1ef68ac9d0e855c
- MD5 6597555a9db61e7ed94ebd1e09bbfc7b
- SHA1 f850134278bf7e8d9f635a2cc779a5ea2e653abc
- SHA512 3c6090f1c1b9e078a1807c69eb547cfae3fde962898c53d7567a57881d02f9ea0f000c69970187da9bc90fb5bdcee7887431ffc833384fbb8c233d150db3d413
- SSDEEP 12288:bHfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:b/u6W2qTxi9trwUl7eFsj
- TLSH T1E345231BE0BA48A4D76E12F13D64619D484D7C478AC8C40773C3B86798BDDE21DEA2DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 56588690ad9cd116a87e2c03be757d6f5aea50c4347e5a92ad0a2b7ec5415d63
- MD5 51463cce9150a97caf9241cebbd4b278
- SHA1 0fe5d2c9a64ad3e95192c786b106a61d0045dc40
- SHA512 1e09462be9f3521558476b17c82839f892d78a17a9cec40d6387487fe2e1f491d6a271d8a079e7ec672d28a38ece9067cc9b5280f2949d30f4e9e36bef250a21
- SSDEEP 12288:GpfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:GRu6W2qTxi9trwUl7eFsj
- TLSH T1EF45231BE0BA48A4D76E12F13D64609D484D7C478AC8C40773C3B86798BDDE25DEA2DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 97352e2658df08a2671f5b73618b2b6a54b83d8679b3c7a72d3e91f7b30e0a2f
- MD5 99ec9437f93b713810bca5ffa6694d7b
- SHA1 36f056acfe6b9fee635c7d881f3097ab5e8f180b
- SHA512 775a5e96e3f20bb992c17288328056fda12af3fcc6a45cb18447a6cec69d8b6771dea85664e3a93eeda57a2323fdafd0c7705171767a35626d89d4ab0321ba00
- SSDEEP 12288:mifugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:mmu6W2qTxi9trwUl7eFsj
- TLSH T1A045231BE0BA48A4D76E12F13D64609D484D7C478AC8C80773C3B86798BDDE25DE62DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 85db0ba990cf5fb015ab25732808ed63ecd622ecc8ea71dbfa3144805d0f08fa
- MD5 5e3462d5c7eadfd00eef7496d31c1ac7
- SHA1 4cb3967ed1496521c0d54f353b8ba46eb0fd6d77
- SHA512 b9b4f676777376d8c2eefb40817d9f71061ed92d026fcf03530e8015480c096efe11ca841b6fb1e6d4b79d224bfebb357ee5f10d4fd2e5957b525548ea88ced7
- SSDEEP 12288:rBfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:rpu6W2qTxi9trwUl7eFsj
- TLSH T1A645231BE0AA48A4D76E12F23DA4509D484D7C468AC8C40773C3B86798BDDE25DE62DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.2MB
- SHA256 25a9689aa4f211c9f8a6ad16b3a0edf75230b5326b0cfcd0aa351aafbffe9eb6
- MD5 4e8842f1ffc778836a676804482fb7c5
- SHA1 75b340f9feb1681af31bfdd60d1943b11e7ca558
- SHA512 18af22c5ea6899130e7202c071c184656028320920fa084576a2b4c85c36d9150c12c48333a71073f279b64bf9fd5d25e4f1240951b718f272b69ee01e007d4c
- SSDEEP 12288:I7fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:IDu6W2qTxi9trwUl7eFsj
- TLSH T19945231BE0AA44A4D76E12F13964619D484D7C478AC8C40773C3B86398BDDE25DEA2DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.6MB
- SHA256 8777d295d359be9e6d6c80a624012e56a5bae9c9f26b9ee8bdffb7947778ef28
- MD5 71b4a2c6deb754361b87aaacb80162df
- SHA1 560bf5cbf426c67fbe2cee54ecf5de21350963b2
- SHA512 497bcf0faa3383b968339056dc18321b393d402b08a2cc68b4ebdb94b4f2e268985e4d4053a827e7c6f29c743381c624485b7c4210c74f80afe530734618ca66
- SSDEEP 24576:2fwvOk9RX6wkyAIlu6W2qTxi9trwUl7eFsj:AMnYIlub2tkrFs
- TLSH T10185D029EBDC04E5E177923C99B3460AF6B178590B31C6CF029A53AE0E37ED45D3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 eda1f279cf3c0cd0bce6af88637b1f7a4ee80cd98c2d951e09b0e1108619680b
- MD5 9eaf2fe8e0dd1eca85ac8c3684b21ed5
- SHA1 58d774598d8eb31c6f45746c2a0a196351846df0
- SHA512 402e786fe0ee0f45c340f39e28f808ef181d27685fdad4b4fe2460f6f87b6f6a81d46e7245c8af220a96ffeb0733756094d50bae495dd300ebd9a07419c61a92
- SSDEEP 49152:6YjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aub2tkrFs:aySzPiub0kr
- TLSH T1D0066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 342f0a03bafaa00a513e8e0605f2974ff382a33fbcaa1efa6f59beea90c7c84b
- MD5 1702e96aad85b0448f2f20c342bcf926
- SHA1 872513f28a430a90f44d1e57c09f3f87c3541f3b
- SHA512 e10bb7ff6c8c4d1c5eb48261754190f28e18551d0f8d5026d07d6b5380e19ffab0e3659a27e8375192490ea9a894fdac6c4cebd81a41cb39778ca0a53e156f72
- SSDEEP 24576:i47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYgu6W2qTxi9trwUl7eFsj:i47JUQjairIhCnDHUPfF/Kub2tkrFs
- TLSH T1C565BF1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F27ED44F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 c0fe019c67ce1a9f14c347d61bd6d48afb23d4ec68c7ca50b39fd4f48da36be1
- MD5 9185a5e14ac19d21512e93244c95a4b5
- SHA1 ee16e8ee81388fe991b25946feb07d1abe53618b
- SHA512 8109ba8435b8d0aea9c2185d11798dfc78758603e77cca76bcae60f1aeb27badad2d65da41881d72a840e9752daccd8a92d6d2ed84ead81a20501e41d225cf5f
- SSDEEP 12288:Rksf5fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:Bhu6W2qTxi9trwUl7eFsj
- TLSH T1C455F11AD2A801E8C16E62B5CB554645B7277C2587E1C3CB63C1F83E0F7AAD09DEA743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 ee35b787731fa08252c0a5258c863d0f3400ff4d340a8ccc8cb8a7bf851b2193
- MD5 6251ff0e7c0eb5597ccb48be4c2933ab
- SHA1 237fae975cf438a9b546f0b199ce7018335e1957
- SHA512 7478bfb90e2b013bdb773da3063dab21de8d739e1d9b9ff1044dc09a14786bc5fc28554cec0773e4eb5e160658c9c707a368e55ef3f7f5cfca0ad8fce5becfa8
- SSDEEP 12288:fkqudqHcNyZlY6QdBPeVD8Kq0ur0xwMbb:fkqTH68Y6QdBE8KJuriw
- TLSH T189352710766AC75FC6AD40721E73C2CCAB707D02EE45AB0772CC572FC976658BAB2192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 333KB
- SHA256 307b9aa252faf2ca320145bf5204829422aa2fa4835a8a1019a05fefd87f690e
- MD5 f639f12049950bc2cddc88524142861e
- SHA1 86ec9593b5c253b930a8b14ef28ee58c01477567
- SHA512 67aaffb51a0b08d4b639f40c89faf86a5b2840a783218c8536cc7b00af6ebde69476b587b3aa0cdbdb53d035c0b852c69fe7489357461e81d962e97164794395
- SSDEEP 768:NflTESlTiElTKylTz2+EQM5P7flTESlTiElTKylTz2+EQMBflTESlTiElTKylTzU:aF4mp0GYCHckYVso8MMqtm
- TLSH T1EC747421B714B329C4B680B39871A5ABDA3DF512CF2342423BD91D96CCF22977A76B50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 868793eb85fd484c97a1cc4c3d8e9ecbdc370efbcdf7d5750f7cb58c04e0d877
- MD5 457fc732e875e2abcee84d5d82681b1f
- SHA1 45f51ce6b168ec22aee8ae95be93554806884da5
- SHA512 ed3177e8ee45aaa687989974cde32495cfb404f0680426fb2c2eca7d7e3eadaf810e74d601a431841d04b7e153dcbf72ba5034af70b5371cb0e695afbf239d26
- SSDEEP 12288:j07RfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:I5u6W2qTxi9trwUl7eFsj
- TLSH T113452327E0AD4864E67E23F03969902C180EBC458F84C4C7B3827997987DDE19DF679B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 9883e5711ac5de477457c1daf6142c231fa52933635438c6f9701331ed18565a
- MD5 ba1bd7554fea839ea4b7b742f3492488
- SHA1 ad3c94b54f51f890f71c924fc53766db96797e2d
- SHA512 b48d87a92853bda32334f1f13386f764e3cf8137158d16f65cefb1f3c59947ceda6f69340b510c485faec6457386704585241315a8dd257d5f606b00eda7da73
- SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYHu6W2qTxi9trwUl7eFsj:Ugb4mBIBhGFgub2tkrFs
- TLSH T15C65AF1E22EC02F5E0F9D2B89DAA4417D6B278160731D2DF1251427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 150639c00743f619346b1ce5034748e99cde259f347f0e128c472c7252ba6fc2
- MD5 03d4890ebe85134c5a0af0a3963c7eb9
- SHA1 4d4b0122f32596d4c5312173ee5b179caf49c927
- SHA512 0dbceff3689f8bcb09e78a123ff206bb8893236bc197d4f859aa44c7af2a31b2e9edc781ec9a1d7ea725ce9e81d7e165b8104bc66fc2a47dd29553e73d69fa1d
- SSDEEP 24576:eG88u8FpJqH1nzria7/mwu6W2qTxi9trwUl7eFsj:17ZFPqV6a7/fub2tkrFs
- TLSH T18B850266B2E101F0D47BD13889864667F6B2B8150364EFDF07D88A521F23AE54B7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 d5bc1b85a1cd4902b2bca940ae0926ea6ca1f495ee1143b8c3bdb10c6df89c69
- MD5 26721ddb2642c235b8a19c762d6a118d
- SHA1 3970ad697ef96ab23240c12fe42bb741785d110c
- SHA512 3e03ef6f6ff2a17441f305018459e087b9706351565b76d064c8679809b6e4be33eb0276d256e7243934ea0f1e77b214692f7d15286b3fafd0676692006d7721
- SSDEEP 12288:VHvUrBFrEjwaQIfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:VPUr+NQsu6W2qTxi9trwUl7eFsj
- TLSH T19D65E12F61EC18E4E67AA17D8982860DE771B8520711D2CF02D1917F4E67EE8BD3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 b452c366c72eb2ac2a1e4f0007548710ead4393903fced9b613a510cfddabbb9
- MD5 c8d40fa2af8b3e24421397b4c4be1b88
- SHA1 7f2b8153ce723a53ce0b30907362f04ca34c9cd0
- SHA512 3ca3adafae9b8effe41affbcd03983f6f95784f72b314d1c87d38e21ce416814a72794702985bf250814d65a024d66157ca4a0efaa7a9b5c712d135ea87f1e1a
- SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8ub2tkrFs:lG05lO43bdub0kr
- TLSH T108D5CF6E62EC11F8D1BBD17CDAC6460BEBB23815032556CF02A486A91F27FF4597E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 722c8968263d90e67de2a409602139bfb8b6b746f5b3a7332622d73991bf0647
- MD5 a661770ce192c47a60d05394a4fda57a
- SHA1 d29d8e5888a737634940a6f56e016330039a3f1b
- SHA512 c1f9173abe1b213dd978cbc5bb502c5653cd67ee89c1b8f856a28f48c68cd8d2fe87ead066e9cfaaa4c9c671f296b9cbf233664e526db6a74bea82d82965e619
- SSDEEP 24576:nfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnau6W2qTxi9trwUl7eFsj:fa5POZ3hJt2pasx2+mEub2tkrFs
- TLSH T19365BF5EA6FC00D5D5B9D17DC583461AE5B1342253319BCF122182BE3F2BEE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 f1046a66fc6b61bba961520a53812ff458088606748b96fc2c264c297c6c3e2e
- MD5 6c1db8e84380d6a19f39da0f06c56fb0
- SHA1 8d627533bedf9b7a9922bbf9f2097995314d7219
- SHA512 a2652066fb033df0b5a59a78baf2ad4eb067f79a5dd8d8317dda18fc9e77a82dfb4aad6e517cd5f5a82d9303ad7eaba23e6b4aa5b8d2c8ac4b27369dfc285699
- SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7Fk4u6W2qTxi9trwUl7eFsj:8Nc/zEOVHF/ub2tkrFs
- TLSH T13C858C2662E901E4F1BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 3776c96748d718a38d7c3b28f16753f3420ace7915c72eaa877f111e95487f9e
- MD5 ccc30445e2c4022e379d5a04db077ee3
- SHA1 8d93441c65b09cc6d966d183d122430caada84b7
- SHA512 4ee71bef67729773ecf0e7930e01abbb257e208a223763e286e4e3de38ad70c5a495ab386374ffb2745aa5f5015b4ff2f44be9ad3f8a36d5f9c81dde7b651b83
- SSDEEP 24576:x3kNvNnaFeYhJNtmZBmuu6W2qTxi9trwUl7eFsj:x3MwBtOmuub2tkrFs
- TLSH T12155AF2EB6B845E4D1FEC6B48D238516EA727861073293CB5390C13F0E679D89D7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 d24fe2afb89ef4ce2a77ceafbd5ee6c7f05eec2905bf3fd2f86ed626dd1c4275
- MD5 3925e37ef8f9269513e7a754d6dc9bd4
- SHA1 1f5b4d819204301571365b09d6cae9165d764704
- SHA512 be3a0e1229eb16f9ca32cc4ed31a76cfa933b3563c4afeaa77a66cb2d0f909aa7b37389a0ac9fd718611349f513e5ddd072e53966f4041b04dbadbbaf06dd6ef
- SSDEEP 24576:uD3FHshBIYQgANu6W2qTxi9trwUl7eFsj:uDVHeBIAANub2tkrFs
- TLSH T1A475E13EE6AC04E4E57BD1BC9A638606E77138A9032155CB02D0D1BA1F6BEE47D39F50
- MD5 SHA1 SHA512 SSDEEP TLSH