Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe
- Size 1.1MB
- Sample260707-bdc11sez2x
- SHA256 678b72794213c58279ed885f729b404048d354cf57016b9caf22102d5372605a
- MD5 c78d2e543bf049059dce9ace6c81b20e
- SHA1 3184ea17267a736c9c1e5e64f8ab5ae8007613c2
- SHA512 0a50d35f9bc51dd02c2b836aa12bfdee1852e77eedbff94505a0e692ff592c2f6a75f4fee2dd896aa8cb2c86478877ad5d1012dca1a210d3c64a5d4021e7df73
- SSDEEP 24576:3CTldpCj/xsUe3LFrjhcYTtsfaKDWGxS3Ewddc:GdpCDxstLhjh2Zqo5wd
- TLSH T175458DF16240F55FF2C09A336FD88B721939F92DC9CA915767802EAA59310F26736633
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 11 IoCs
pid Process 1976 elevation_service.exe 1056 elevation_service.exe 3700 maintenanceservice.exe 4624 OSE.EXE 5796 PerceptionSimulationService.exe 2608 perfhost.exe 2704 ReFsDedupSvc.exe 4112 SensorDataService.exe 6088 ssh-agent.exe 2020 AgentService.exe 5852 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\94a21b50d8ede1e.bin elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d849d52eac0ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000758c7f2fac0ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000530d8930ac0ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b63c8878ac0ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe - Modifies registry class 35 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{2FC48609-DBC1-4056-B9C9-D50A9889A9A6} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{73645271-68EA-4B4D-BAEB-34F781A742CF} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1976 elevation_service.exe 1976 elevation_service.exe 1976 elevation_service.exe 1976 elevation_service.exe 1976 elevation_service.exe 1976 elevation_service.exe 1976 elevation_service.exe 1084 explorer.exe 1084 explorer.exe 1056 elevation_service.exe 1056 elevation_service.exe 1056 elevation_service.exe 1056 elevation_service.exe 1056 elevation_service.exe 1056 elevation_service.exe 1056 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3028 2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe Token: SeBackupPrivilege 2704 ReFsDedupSvc.exe Token: SeRestorePrivilege 2704 ReFsDedupSvc.exe Token: SeBackupPrivilege 2704 ReFsDedupSvc.exe Token: SeRestorePrivilege 2704 ReFsDedupSvc.exe Token: SeBackupPrivilege 2704 ReFsDedupSvc.exe Token: SeRestorePrivilege 2704 ReFsDedupSvc.exe Token: SeBackupPrivilege 2704 ReFsDedupSvc.exe Token: SeRestorePrivilege 2704 ReFsDedupSvc.exe Token: SeBackupPrivilege 2704 ReFsDedupSvc.exe Token: SeRestorePrivilege 2704 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 2020 AgentService.exe Token: 33 5852 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5852 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5852 SearchIndexer.exe Token: SeDebugPrivilege 1976 elevation_service.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeCreatePagefilePrivilege 1084 explorer.exe Token: SeDebugPrivilege 1056 elevation_service.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 3320 sihost.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe - Suspicious use of SendNotifyMessage 41 IoCs
pid Process 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5300 StartMenuExperienceHost.exe 5220 SearchHost.exe 1084 explorer.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5852 wrote to memory of 672 5852 SearchIndexer.exe 98 PID 5852 wrote to memory of 4092 5852 SearchIndexer.exe 99 PID 5852 wrote to memory of 3172 5852 SearchIndexer.exe 100 PID 5852 wrote to memory of 2944 5852 SearchIndexer.exe 101 PID 3320 wrote to memory of 1084 3320 sihost.exe 108 PID 5852 wrote to memory of 5092 5852 SearchIndexer.exe 115 PID 5852 wrote to memory of 5144 5852 SearchIndexer.exe 116 PID 5852 wrote to memory of 4268 5852 SearchIndexer.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_c78d2e543bf049059dce9ace6c81b20e_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3700
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4624
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5796
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2608
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4112
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:6088
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2532687178-1633831978-1202193935-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2532687178-1633831978-1202193935-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:672
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4092
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:3172
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3012 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:2944
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5092
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3012 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5144
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4268
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1084
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5220
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5300
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 10a2ca77515921d3a5d99922519333d08c40efe27a7f07704bbd92fcaed8cabe
- MD5 a47046ac32d192a4d298cda08d6e361a
- SHA1 ea0c1d88107c7dc327d96681a7309c1e8ebcbf93
- SHA512 3eb6c7bdec01cd28b504113c48b2f545f8bdbe978d0956ec6184a3ec3a91d1b2a0ceddc97186b230ec66d9bcdc2ea3b8a2e99cdb61c03c083b985679ee7f7431
- SSDEEP 49152:Ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxnMhjh2Zqo5wd:Q3q6mjB7D8Od
- TLSH T191D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 a85af101ebbd2ae6e3761a88a2997d05faec32345bcc4b4576e57005bd88bde2
- MD5 904f1b7515c5f1a6b91f9c1183e02a41
- SHA1 4d21432dbb1551b1b1e6d4ce701db4982920c30a
- SHA512 1ec74f90a36045bb50b571b873f4bc9b63fd910e17d3d45ceeffea76ca16cfae9df09513e6d2b5b99cd5b14f4ccf05ba0b3eb13b9466c79cc49d255e40a5d1a0
- SSDEEP 24576:tXYfDtczAXFrjhcYTtsfaKDWGxS3Ewddc:4tc6hjh2Zqo5wd
- TLSH T17085F12863D409F9EDA78239CDA18502EA7378954760EBDB03E4996A0F333D45E3DB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 c89f59620f7acfe5744a97521fe7347b88209a585001d00c87f32a7d293ec651
- MD5 9093d20215f9df610d130d360c6f9ea6
- SHA1 b482c31d25be57d166ce705468da12d49c06e3aa
- SHA512 1bece4028f09f39ce15893204aa0b5663605de5d91a4dfa044b30446daae6452e5290bcef90ebf6bbd167a2262c5b4fc2c9ff28fda0387072eb1308dd83a0451
- SSDEEP 24576:f0Le5ji0hmxhrMEFrjhcYTtsfaKDWGxS3Ewddc:fPji0Azphjh2Zqo5wd
- TLSH T11C959E26F6748735D073C0B9C5D2A68EE972308617308ACB4296D77C2F677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 8a27ae4778046bb05bd80169c8d95718197be3e02852b1fcecba391d8fdae0ab
- MD5 54966794f97f8708b48bb8ad1c0682b7
- SHA1 879d900a581cbbd9aeec8333af100443dda124b5
- SHA512 c5baab0ce29bad8d9bc676609e102ab5bb6d3db3c85a1175fd251796c743579b82a3cfba57be1e52ff9bfbcc573d6a447d8214a5516f28bddf57a8d79ff07c37
- SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWj6q8wyuKFrjhcYTtsfaKDWGxS3Ewddc:Z/ezSC6vUzPv+Hjylhjh2Zqo5wd
- TLSH T1A9756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68535739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 d3a489d2bb17eb48c22d8ea999d5a8965aa19ae25da7e0fd3c1e60a7fc093863
- MD5 616464b6da758d96ea9f128c1fc0a604
- SHA1 ac625e23cc337aa6f3320e130c829818de6225f7
- SHA512 3914a07994f531fb0fab52adcc980bab5f3c7f14f70864db97e2f1419b500f904a937d388650a779d13ac2dfe442f248691d34a3f1af4d3414e06880a30091a0
- SSDEEP 24576:SVbqPb88hv/l+BLFrjhcYTtsfaKDWGxS3Ewddc:SVO88hXl+Jhjh2Zqo5wd
- TLSH T13B559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB1246D76C2E677D6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 3ff2590afeee3c200e328e25c4356d0e57924cd33aa635c2bf60c532c3e55671
- MD5 37b363c598cdff0d4c82c0d4f255cf57
- SHA1 00bf4f27c82ecad10512b09055a4daddb4b341c4
- SHA512 0e8f43edf395c258160f502a74c79c423a73ccb9e4ee61096bf5cd4d6854cd1cf7c96731c935d5d632181a6ef2ce9df797dddc4baacd8f1809a6be9af65f4739
- SSDEEP 12288:jGSflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:jG4FrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1AB6523769244FFA7E3F14375AE44814BA7A32E950514EFBE07F2F8BB0A753008868567
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 8af610f683e5169623bd9efb5e4d236fe3b6ad9a0da8ffa2a60b9904fdd76a5f
- MD5 66fc788dc3a69a802f77a1b2b77541f2
- SHA1 ef0e39a4cd0708a5055ab976cb51e7d70de990eb
- SHA512 6098ac4fcf9b836b91392efb9653a8dbd80680a71d21915603eeba97ac948ae6ab5ae1e21028b331108c13a7185c4b82e69b225a2ae67524cf01a0eeea5d6bc1
- SSDEEP 12288:ueBNUbTVO86Uzflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:uJIUDFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1C685CF3BEE28FCE2C27A8DB95B918640E77278704B61A3CBD175C20E9E235D05D79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 7d0ce5cbab037e76f99f32139ed944e9ef642f2137f48793b6efc72917adea96
- MD5 120d73bd1d91e3d9210281ae21efe9e8
- SHA1 563c11b4efb1732acc1322c77905f6b13bed43fe
- SHA512 3ff81fcc6d29125d64e9e7b72861fd7d226913f7764952d142a9448c8ffe90aa590e1bf37a3f56b1545596dbd9f5d0d1d8408303d1e0439db94c3c2392b5d81e
- SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH5:dQvGAdlCEL8c/WRNw5CaD8Od
- TLSH T1AF266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 fc2d5f2a495d69cdea0c61b851817650b8d4327728589ca7840805f3a75e8a79
- MD5 dc7964f98bc98397aeba00eb3fcbabfa
- SHA1 9b6df9601925d6bfb7d8b2c57bf91380afc43106
- SHA512 829cd4de1519b8eca48937b3da4f76f196dfe1799c806e9950f67a6457cbac4c0d98ab651b88d5160dab16472e6d14d4b4d15f435f9fed2626385396b3b67900
- SSDEEP 12288:6AwSfxL/2Dc3mDLLmt0LDQewsAjNflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6jE:PfewsAj5FrjhcYTtsfaKDWGxS3Ewddc
- TLSH T16185E031FA74E436C3BB0DB21B25C706547D7A604B612AC7E3F89D9E49302D22776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 2520d76d32f42c144a84846f240d836d6644f706926e56872ed2a90bd98f68cd
- MD5 7ba30bc0469526815de24ec9707476bd
- SHA1 e1c445725b3094441cee465351017c725301e612
- SHA512 5e527d96da537d7b6dbf051deb66da1020a50c4b0e7e6be63c4e54b07fda304392d0d3220b97c9fa7c5fc6a62a8ca18a57a86524e85840831c6c431ad323080f
- SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHh4Od:JUEtQevvqc2W1cpV20I32aOd
- TLSH T1E5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 52017c3bdf0f77917324f0c516db327e99fe203cf5d88af892b2af0d6ea04f8f
- MD5 e08940df749d132de9e06f07de7a31a2
- SHA1 4afb51fb44aa43e37150c6e23d25a61299849027
- SHA512 3e61af3d7a8e24e1c0deb9b65a6b9619f9c9caa26918d7f10b4a60087f0d489d2f23f88c191aa3cf111ae5b4868525e10be13b6dd4226aea692f40266126f7bf
- SSDEEP 49152:9CbRquA/m2yL5zifFiV+XenmE3/zZhjh2Zqo5wd:6oqHVjnmWD8Od
- TLSH T1E1D58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 b9086732eca328eb385fcbb070472697a66bbeb2ad38f12a80bf01545ddcdcb6
- MD5 160c65df3c510cc08f06c4b46073f85a
- SHA1 f18ce7800191ee30d4bc3803f26ff1597f79fe9e
- SHA512 84eb83c560626bc73968c1041d9d32e7c30b674f45e31e79da9669f878a3b3c132ef2d0f82cb2567a2f3150aa51382422b5544d78fac5c48752b866f0db9387d
- SSDEEP 24576:+AhGL6IFoiwtA5l7S532FrjhcYTtsfaKDWGxS3Ewddc:+AM5Foiq5mhjh2Zqo5wd
- TLSH T17E359D91E7F955D4F5B39A789DB68171EA72BCAA5E31C20F2260D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 814961b28616e98ca3f56d9bee5059c6874767c932e45b54af9b8825e95c4801
- MD5 87af7b7910a8e7a033fa3ae37f038413
- SHA1 0f794887c73b596d50100219093a0b55c180f8dc
- SHA512 b6b9ad9990d4304f8ba7b2323a25ccbe727b2308075a4cfeb291e0ba6b225470e8347e9a4b518435267e1d03eb321a100d88bd1bcbaff581444176cdc592faf2
- SSDEEP 12288:Xmw5HEjsChNEBFgl0WDm+CYflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKc:2wuROWFFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T18975F15672A45CF9E5A682398A47C136F7F2BC112A21DB2F17B0C65B5F33311AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 eacb3f5df63462337fd2f71200e2426c7228cc80ab96f5577d98583ea1ba541d
- MD5 241bcaa919cadfe1f14a0369238d7964
- SHA1 6b3b2914f93cd9703be1cb4911467e52085265f8
- SHA512 5c66b22d5a32793c29ecf9f769600b5bab549958f6ab126e8b10338bb126b81ed88c1fdeda8f8b764859d33f95a51a440792272746f0ac8df16f184af14d9f63
- SSDEEP 12288:gyZ1Iydflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:lZucFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1D665126A22D475FAE1A28339DDD08606E7B23896173193DF16B195AB0F33BC15D38732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 3a73b49e857cac87320f3ed060e138c5921fac583ecea3fec49d309f5dd72198
- MD5 9148e36071fbb06ba6ae4e5c1a2f614f
- SHA1 b9b3c2e633393e52a01a57c4b1bd026a22df92db
- SHA512 3faf149579de93a1fed3eda3e7a72d48c0d4d4848a7b4b79042118964ede042f42a4014206d44ed4946474da43d88480b422918e2f4a703174093b70fc296254
- SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UV:KQRQyi36YOcPDLvw2gAf+PN3PD8Od
- TLSH T144667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 b75a85a13e7c458d1c485eeeb93318011a867a036f318e7a142aede6841dbe3b
- MD5 49a2ea82bbab120ef2b3a1e95535073b
- SHA1 76f1aa62fd99132aab41d90a131ca2b02fe7465a
- SHA512 bb3acef595eee5a4ac00197288a118b743f11c9f8251421666cc3023126f44e06793891fb035fa523640df08d0e1631069cdbe38c5f926507add23215e5385e9
- SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UV:CQRQyi36YOcPDLvw2gAf+PN3PD8Od
- TLSH T1DE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 c123d9b96cbdcae4a2759acc413fa33db29f8f94127cedc50a6d3aacfb78d70b
- MD5 a6cb6e344930f464d5b951f0ffc9f2e2
- SHA1 bbc10fd405b1cd0474145e4f2763ffb1490eab21
- SHA512 87fcf34c5a67754a4094649721c85dde6ecccd399d6b9a528d6585e9e7b65df556a8634db63313b97a52688177eb081b5f3d097422817f5deb18f0247b401bb9
- SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0MFrjhcYTtsfaKDN:+68Qg55nhkeWu7PNU3/phjh2Zqo5wd
- TLSH T127B55933B2F200A9C44DD1769F4A872196D27C758FE0E3DB8551721A1FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 3b915415a1b287b7810e12a28b5e2353dd38ad45eac9f1f7da12d4f07aa7d148
- MD5 7f84c7ff35579026c991d2391dc9fa85
- SHA1 27d1b56a67871e046404c885f26c48917ffa401f
- SHA512 8e3b8ab9078e4059a28982c4b312d922cae6bfb76189f1dafbd32ffdd1bbde8766de35c818ebb2873a6a0ea70887b4c23a556b995336de5620423a1c2176dead
- SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk997:Fy5112gYy5azzVvU69nLKnhZ4D8Od
- TLSH T1F9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 3fcd0c4a8427735cae6f92dac408bcc990bde45b2e09f19200a9daf0e7da203a
- MD5 d2fd4d7a156447e57459b5a1a388e126
- SHA1 2f145b6ac8e39c6c15f0c884f35761b8b5b6fa5c
- SHA512 bfd9bd1eff5e65afed2efc7c41156327f4e206cb7b0c6c37c23ea111259e9cf9cfea4c8cc4b82ce59a816b1c7b3b53f6a0b68d248310429bd98f1ea5d566492b
- SSDEEP 49152:pB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glHhjh2Zqo5wd:/u6JmIxd2dHD8Od
- TLSH T16AD59D13F1D901E8D06ED178974A9233FA62BC490B35B6EF0A9072562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 8bd241d9aa0cd2aa25846dda5cde61753432705d5c7e220703006a3c83d562c4
- MD5 15c5ccc796feecdf006ed816445620ab
- SHA1 0ab509f9a01b1341fca30fd593c02298df56868b
- SHA512 258b289ed781bf9a9270b27ce479dee25c9bec68895401989048185c05e081988f637cf43a1f5282c4968b5675b5b4bfc71aa7eba4b20845fd42214d50de4f5e
- SSDEEP 49152:B1hpsNoJpF1A67U44CwH7R4xjhjh2Zqo5wd:BmifPqRWD8Od
- TLSH T144B5BE13F2D901E8D06EC17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 15e4c512f254904031be5bc2041f8a1a77b9c6b018de2698f0618663d7a2180b
- MD5 9c70e7803bc59bf1d356c405954ddf1f
- SHA1 fd313b197dcc128817d7372f11ee6b42e03dfea4
- SHA512 a261d2de484fc01aa1dd57cc99a72c43d731a0ecc9e2b450d6fb7da754346a5c488cff2bf2e5abf40d158856f127cb20afffb35c680d9cdfeb18bd92f2f15c5a
- SSDEEP 49152:USuZQIY0Be2KkRVtOnks6NMHqchjh2Zqo5wd:G5dKqi61cD8Od
- TLSH T1F2C5BE13F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 763ec29ec10d7d6fd9f9cdd13911f489ea6f0542849895e10658f767f3241b7f
- MD5 019f4f48c7a91f6369a0886e72945443
- SHA1 d7818355fd347582967dc0f9972e4c475575727f
- SHA512 8715edef194332c0c52d75d383ff16122ffb0d566c814a14a9349fcb0e5089299233af33ad69873b6dfdb8c73f4d3d0dbaf09f48d18cc6f3c2a4d3844b3692ff
- SSDEEP 49152:DhtSn8EApI0figjgiDn0AP5wXhjh2Zqo5wd:iX2iWphCD8Od
- TLSH T1CB95BE13F2D901E8D05EC178C7468632EA62BC160B35BAEF0A90B6561F7BBE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 c0d5402d759e3e4a09db45b0dca0eae104394a7482b5f60c67a468aeaa617083
- MD5 f6eb6b2715276d24ea9241e01f44cd58
- SHA1 ae5beddcfd6616f9145522882d2684e424fdd28d
- SHA512 09f209f5f9730d209736e25fe975b6faf7dd20f6c641df2fb18c6bbe0bc24c2a0e4ffe8d4ec56b71c1ced9c24e2436c2a6936771b52d97fbe588e511c4201a83
- SSDEEP 12288:kaflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:kwFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1AC6523359584EFBBE1E08372DE40814BE6923E9A6515EBFE17F6F477077130008689BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 3422193dc344809e739211e4291b9c4359fccd50f94ba61c8f9c9bb5d4674ca7
- MD5 9da3c3a0f98660f6d313876024f00c35
- SHA1 60086571e9eeaaaf4ca63a5771b68d0388dd1ddb
- SHA512 9113c6134de50cc950611cd950d899d4bbd60c5d62a5138a502931369f8bc0454df6427027b67fa6f426f43958a31676cff9c5b2e1f7b6b039e1b23bb17e267a
- SSDEEP 12288:SJflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:SNFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1B96523359584EFABE1E08372DF40814BE6A23E9A5515EBFE17F6F477077131008688BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 0c95841d3c995e2f12d8c283d4728aa1a312c48c36d63c5967e565ae9d85e3db
- MD5 78abf897beb14b11e1f6fa8e11b20059
- SHA1 f59adb98afa9f131b17d6815bd3ecb7afeeabd44
- SHA512 aa0ae5493f64d5368fc26ed778ab26a1ec3438dcdf76d67634b976b5669cca42ea5990fc5e1a886d9ae897e498e0c12c24c3a84575d84dcdb171065a4aa13cb6
- SSDEEP 12288:4bflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:47FrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1F46523359184EFABE1E08372DF40814BE6A22E9A6515FBFE17F6F477077130009688B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.4MB
- SHA256 fd540a0618e3acf40b992be58e44a646c5bb322aff8247495143b34bb5ff6400
- MD5 20080b081bf7114f3f7eeee228f39d39
- SHA1 d933fa7135672278806e05ea06adb7a31d10a794
- SHA512 1e99bcc6512635cf8a4a0562b72d8ed2a7e058434fa3131f6486839f24bc4f745dc6bb0ff84b6f40a3bbd19bcf8c70355e7037417675203489cb5c330280a8d0
- SSDEEP 12288:kV8flf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:/FrjhcYTtsfaKDWGxS3Ewddc
- TLSH T11C6523356288AAE7E1F1C375CE408146E7F23D995731ABFF17B1A86B0F713405838A66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 2bcdd8f29128ce90e234858772b90a4249df47f1d4ddbbb6083003b377cf0d0b
- MD5 53a9bb638a86d99a5ed8256c53856b64
- SHA1 d8e09b0e7878af65b581b824fe912e81c5fef76a
- SHA512 dfc73fd2a336f8b707e36b898dde0b4b3150b10300bf0af1325dcc97675b9ec1dba49d2f5a0c135d19c676df767810e84747e6dd5e1c509c8a377926c57d66ea
- SSDEEP 12288:CUflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:C+FrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1016523359144EFABE1E08376DE40818BE6A23E9A6515FBFE17F6F477077130009688B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 bc8d884a94e85a9df2ae976e9213ebdd567efdb382d58be74a2e3e2f7ad4454f
- MD5 aa565e045a70de7767d521d942d755d4
- SHA1 934b4a779314e3fddad0470717952ca6628696bb
- SHA512 20e78a558bb6536dd05a7526a4f9e56b87a6afaabb8cee3d6ae10fb898679992afeefe0ad6488d13bbb498818106c86347920974fdc2b056916ec05388a71fc4
- SSDEEP 12288:tVflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:txFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T17B6523359184EFABE1E08372DF40814BE6A23E9A5515EBFE17F6F477077131009688BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 bf1e3a712470867ff494f810838e216154cfddb15297e81737066c0f35971989
- MD5 12fad6bb7d3547620eb87ac80a09acc2
- SHA1 9aee1019f323762a5e5a660aa466117db03d1f3b
- SHA512 63e509e19553f9114557509fb43dfcc73f30a73e9a7cbb74fe159215c14ef8c5def1c331f256369639588517265a5e6843016521d4613415ddef3c423fd84702
- SSDEEP 12288:ehflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:e1FrjhcYTtsfaKDWGxS3Ewddc
- TLSH T15E6523359584EFABE1E08372DF40814AE6A23EDA6515EBFE17F6F477077131008688B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.6MB
- SHA256 e51be4f06ba112e439d9b595af27d49cec868e9d70456ecf84f815927dfb1dd4
- MD5 5c7fdc5561e1c6252a898aed4d22e7aa
- SHA1 711c09842b6657a711a4c8b4786d29ca211b45b3
- SHA512 e10da19bd322b8183ea49ff303f0d92729fc6088010cd6e7fcde46304b6f40546af2696b503d51ea5138556918cfafb5a4fe39143a721570c362569c595e65f5
- SSDEEP 24576:bZM3zFVSOtFrjhcYTtsfaKDWGxS3Ewddc:bZM3zfBhjh2Zqo5wd
- TLSH T16F85F1A5B3905CF9ECA3823ECD558906D6B27C5A0660CA5F03B4366B1F733911C3DBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 efa099248ca374f9aaa94a9c8c1557b38d20e9f92bba42f20cb21aeb20f3866a
- MD5 9cfc82ea5c944759f89908015115293a
- SHA1 b9dd69624e3abc1e9dada4cd7d6f5603a224b6ed
- SHA512 cd58a2ca9b18979255f7f43ee3efa934af06418e23a9bcc1dcf58e24691b361c4230c5e25f1fd62b6b5774a0c4523a39b6bccac75945fd9f3ceab84cceadd901
- SSDEEP 12288:x+flf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:xsFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1D66523359184EFABE1E04376DF40814BE6A22E9A6515FBFE17F6F47B077130009688B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 1bffb41da55b0699beeacba3a466ba726b0935d35dcb948d8edd71459f252481
- MD5 f64dfc0a6aa9b936fa6000ed2aaf7a6c
- SHA1 1a817b19f38ab40a3650c122e77276aa3e862e78
- SHA512 a9c0ceb309bbbb2a780d097f5b3c7526076b4fb85cd3e6f5d37bbee7a35904cc7f364d9afda50373e60586ea3850a0fc17523c58ad2c8baccb067223f6188cb1
- SSDEEP 12288:ciflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:cIFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1726523359184EFABE1E08376DF40814BE6A23E9A6515FBFE17B6F477077131008688B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.5MB
- SHA256 3785ffc20a098938ef058089edf82e5d29f9dd05ee6580817e2eabe57bc6112e
- MD5 86af9ecf319bf04581aa406a5fb7bcae
- SHA1 4f5a619f1a96c4db6515bc65a907e9b513501e4e
- SHA512 f806f99abe65331e6f7b965bade1a7b450c3cd290bd9dde33f41281e749ba2c5930478fe41a800f167953cea2b7ab71f89b2f91c795a5775493003585357fa89
- SSDEEP 12288:IyPz5L8dflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:JzyJFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T11375012772A171FAD1B28239CD914A06F7B2787607209BAF17A0567B1F333905E39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 d1662a76d8a8a22fcd5261827e85ea239593928893495b7d8079dea446696871
- MD5 2145c9ffb5cf09a5f04774b0fd8d122c
- SHA1 fa30a481c3a16cb1c932d63355ef116e812796ec
- SHA512 b6762c4050184321d29c019666bef0d0d403592cc55ea03a5f7418bf73d21f6241890fabb7323abe5180ad8b88ba0608906069a71ea5c62533a19fecc05aeb7f
- SSDEEP 12288:e+flf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:esFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T11F6523359144EFABE1E04376DF40818AE6A23E9A6515FBFE17F6F47B077130009688B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 88accffd1fdd577260c04b0fbcd79f3f9d8c93e957eb98040b5215fab3820881
- MD5 f0aa12f2ac06bb2a8c24c88a7d31686c
- SHA1 3b1a7ca5aeb59d969bd9207eb5fd000ad4bcd97a
- SHA512 5f7810e269f84c58a4235e9712acfaf339263b39fab23b247c3fe08644602830084abaed50387ebcf53a7bb05ffe76a1a0d91e7efd5b0a122e152882226b70a1
- SSDEEP 12288:0+flf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:0sFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1DD6523359144EFABE1E04376DF40814AE6A23E9A6515FBFE17F6F47B077130009688BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.5MB
- SHA256 29c73eb861db2455f7cf7d2cd0182527306ed599e07d1a9dd1b8f0296b2e84f8
- MD5 3485ba02c2a9fd08a98206fa7b674609
- SHA1 2090c1ac4b61e2c7ccb469841b95dc0c7344470d
- SHA512 799b471b924b3366fa73e392f01a9e01c4991e204e2d31344ca9a878ccea87807e098c636b13e038ef288721ef451a4c59868e95e5fcac97d8be2dbaad91af5a
- SSDEEP 12288:hyPz5L8dflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:wzyJFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1ED75012772A171FAD1B28339CD914A06F7B2787607209BAF17A0567B1F333905E39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.6MB
- SHA256 b3efb32b1f101155d07714ee5a3762a78b0f9730792084e6d21d25538b1ac34b
- MD5 662c8a7a59c0e16e7658e69708a299b9
- SHA1 ad7a2c8bc0748d1dead0d69b425d4dc773442d53
- SHA512 7e02aafa09698b210e286544ad8c3c11ec3081558a7d088fdab2b2101aff533f5d7ff757ef731f782f6bcdf119d1142878c32d5d7dfa03b57b651df1a7e2b095
- SSDEEP 24576:ET8aLl3z0zDrFrjhcYTtsfaKDWGxS3Ewddc:ET7LljKhjh2Zqo5wd
- TLSH T1D185F1A5B3905CF9ECA3823ECD558906D6B27C5A0760CA5F03B4366B5F333511C2DBAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.8MB
- SHA256 d2827e523ee7e1d2c56609345611ec43e36a4005cea56f98581d00dfbc3d967c
- MD5 a557de7bf3da7cd6b9e28468c1f046a5
- SHA1 ac1836160f8840a7855ede5cb9f8b5f181377428
- SHA512 c8a2270fb6fb5d50b15c896c3e198e3e9a891dbe393ae36b03f04deae63f0422bbed3eb3351a41f979b0faff9963cfd4c19bedb6f33bf0e3a2aed148b4d10b6d
- SSDEEP 24576:s3rd9CHKy7GZvFrjhcYTtsfaKDWGxS3Ewddc:Wrd9CHKyaBhjh2Zqo5wd
- TLSH T1DF95CF90F3E415E9F0B38A358D668512DAB67C9A1B31DE8F03A4655A1F337D18D38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.4MB
- SHA256 a3d93dfd05c0fb8e4eaeba08fb5ccd137d18326b36c4e38ef3308bd78e646a47
- MD5 404439ed3073420f87ea7ca93b931448
- SHA1 31eb7b70d58de9c4ff5a54c745be986cc734b5f4
- SHA512 2dfe37d1c75765b3ca49c1e401c9e6881326dde6bfd21761fbe081dfd6d1c552e96a56b3ea01439ff87f731a1ed4fcc9580d94d265c35ccc7a32dbf791c3d9db
- SSDEEP 12288:+7flf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:+bFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T14A6523359544EFABE1E08372DE40814BE6A22EDA6515FBFE17F6F47B077130009688B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.4MB
- SHA256 18110a07902301e50037bb50757d528bb9c2cce3c1d9c150551ea21cba3034b1
- MD5 a0d541f52c76b7807c5bfd5aad3ca4eb
- SHA1 68686c3d6a9f9536fa08752653dcae3441c6a07f
- SHA512 23bbb97a9f30de7f07a190cfb35aa4bbd9cf3f6e4821f0088373a630d2388e0c9d5f71c7a4040c7044142460a4876dd506fb8098dd0dd1b01bf51912ee69d578
- SSDEEP 12288:Q9flf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:QpFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1D76523359584EFBBE1E08372DE40814BE6A23E9A5525EBFE17F6F4770775300086887A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.4MB
- SHA256 30c740f74e4d115cd46969e425e0119f121a66736ea2d7076799085d03278a52
- MD5 1812c372584984015755723a1e4d3137
- SHA1 5431b8c48fc580b7209e0e6f61a05cd365565f52
- SHA512 e75081a0b0c919fe166479f67de632006fa5002b950ab9c6d0cc7ba9c4cf49fa00548c845e19b42108397320b26416c11580d26270ce1ee8935c56d3931eb3ca
- SSDEEP 12288:jwflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:jSFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1286523759144EFABE1E08376DF40814AE6A23E9A6515FBFE17F6F47B0771300086847A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.4MB
- SHA256 1c1742f603cb518cfab2807f72f2efcc0a735a388e4ec1812a145aa3ff1b1ce5
- MD5 325e13d3e9d5a7b2fe0e09b691ca9018
- SHA1 5f455a693d3434a13a6ba6a53cb2d2d2a00859b7
- SHA512 621f8c5da94d5a49773aa5814d85d9cd87e2ed31b0f0eb4f1a184e05c47c1acf9e9ba1d9bb1846ad2509da79c8a5184f7a7c013076379716098c4db95dd31ae4
- SSDEEP 12288:G+flf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:GsFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1046523359144EFABE1E04376DF40814AE6A23E9A6515FBFE17F6F47B077130009688BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.4MB
- SHA256 389318bc1c92cd081eebac27bea6be2ca827725a155519df549454e91a06f6cc
- MD5 bce41f7bb0e3c129a2766ca46ae5d62a
- SHA1 6eb7297d0c4f31f747525273f089de1f554e8553
- SHA512 4ebe0c14669db5d2bb63f03fd15e93d6e5e5775171f8836b1bb13aa185284ae0b2fe0157ddfd98bc017a16248877ac7bdf7d756100325ab533a68ce97dc54b9c
- SSDEEP 12288:R7flf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:RbFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1DC6523359144EFABE1E08372DE40818BE6A22E9A6515FBFE17F6F477077130009688B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 4cc69bd615e200dca018ecc884d899dab42ffaacc94d98198ebaf53f75f305cb
- MD5 5962ab40e584713d12f98dd054090c88
- SHA1 87d6f8d1b07354549a94c81db5928e28871c2540
- SHA512 62a3697e48f4106407a39f786fb6b3a89067845e467831a9c0427252a5c4478a3403b1081d7cd1ab38113c2576a17ecced9e1ad6a7c600a475f3ff46c5564cc3
- SSDEEP 12288:42flf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:40FrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1556523359544EFABE1E08376DF40814BEA923E9A6515EBFE17F6F47B0771300086887A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.4MB
- SHA256 f586a232c1f69edfacdb7d02c2847c88b6ee52b5f66fd2203eba2f4280c45df3
- MD5 f3e21040f2f8a9894486266189673f97
- SHA1 a6f24c3ba780218e7d53be9cb9c1a767274eefba
- SHA512 d5e8096f47f22381191f420b6a9f295271f38af5d2b61702ee009fe580366f39c0a9ba10d793a2e973a638f8e76f9da5bc1644dd2e95e5824150ef98fd7881cf
- SSDEEP 12288:IUflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:I+FrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1D66523359544EFABE1E08372DF40818BE6A22E9A6515FBFE17F6F477077130009688B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 1.4MB
- SHA256 d0ebaffc680e80fd2046c4fef59ca2bab6c9647170a26e8e039fced2e26ae1ed
- MD5 2558be3e1672b500949e2badd430c763
- SHA1 ee3a66c2b986d14cdfad52a09018934d276fc871
- SHA512 f2aca1a66c3172c5745270d55b066ec9078b063fcce1e63d54d0001bb4b717dad6a50d83051bfe6d764170057a6549e8665fca3ba30aee4954a75b4cd504b2d9
- SSDEEP 12288:wDflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:wTFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T18B6523359544EFABE1E08376DF40814BE6A22E9A6515FBFE17F6F47B0771300086887A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 1.4MB
- SHA256 156e6549a33d3bf8daa71262f6d60798f6cc60243b925457e2e5255453eae6a9
- MD5 671c4a13533e7e56caf6542aa937e419
- SHA1 e2ab71ecd2cac84774d5bc08f2efdc7aae2a1e25
- SHA512 9d3d9699fb273fb28676543d908c4e6dcbb7bdcf4f850af0fb916ee25b8c0633f301504864669be9e88e3ae16a5615971ebb0ee87e18c3123421f5ac9d61762a
- SSDEEP 12288:6Uflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:6+FrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1E76523359144EFABE1E08372DE40818BE6A22E9A5515FBFE17F6F477077130009688BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.8MB
- SHA256 b68339305dd316827db2c9c2b879d078e73fb0230ab11b1b53465fa4fd8e5adf
- MD5 a061b73ae1a7861c1a08ab192d136a4b
- SHA1 e9c73dac329baa7dc767882e473b71e72fe91047
- SHA512 cf47855ea0915f5b51950bd3db1bb60ed7b7e9a7eced9b4d49d5b8cd0ebfdb69cb2403ed65dc77feb713bb74a650ea05ea673599bfb298d699216751ed2d00d6
- SSDEEP 24576:Jfwvzk9RX6wkyAIYFrjhcYTtsfaKDWGxS3Ewddc:oMnYIYhjh2Zqo5wd
- TLSH T18495D029EBDC48E5E1B7823C9DA3460AF6B178591B31C6CF029A536E0E37ED05D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 b10e9880c9187b30828275fbebd91b996cdda9a135b50734007b67b8da9d98b4
- MD5 43cb3489bf05f5c72a87ac4a4f7ce847
- SHA1 9eb45b618ca37e46c7f77ed386ad03ed48ecb340
- SHA512 312379cfccce5eb61762220060d02b4f13692873afd1c98946f5747f473407ff379611c160de3699fafb8ef76a4e381cc7f91c2ac2d1b94f0a4cd708b234e2e2
- SSDEEP 49152:LYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03hjh2Zqo5wd:WySzPvD8Od
- TLSH T13D066C56A1A841D5C1B9C1B98F0BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 bebe38f5c1d59dbe513a0a6a152aba428814927fdc05f72f69e18e2aa892981a
- MD5 57a49da971af32d83b389f59836247ca
- SHA1 73157648cda2336e2701a84bf0f6c751f73d57ae
- SHA512 a84c99b2b2d5276079d8ebf389d0b42166ac5b6c51d937021a9e049447c47aaa396a1ccd1a288024381f00163403750ec14675e80f9190139bace92c4396f58c
- SSDEEP 24576:747Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY9FrjhcYTtsfaKDWGxS3Ewddc:747JUQjqirIhCnDHUPfF/Hhjh2Zqo5wd
- TLSH T12B65AE1DA3EC01E5E1BA827889154A5AEA71742E1F31DACF1270837D6F23ED45F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.5MB
- SHA256 c2bf2310194b2d961bed4e5f6c4365b9ee7f0eb097c17ace34b90eeb00e74916
- MD5 f6bc03c3187320ced6eb4a4382c7de2f
- SHA1 b758cb063af024da26c4c1de9432324c9701e230
- SHA512 0d179cc826ad57a63f8316f40c6edca6c8503ac3b2e8340764c96ab3ea509e3a7b650cef5d168354e45b12269e1734f7b7401c26d5dc587cc0599fea83a0b614
- SSDEEP 12288:tpsfuflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:ecFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T13B75F02AD28852E9D0AE8279CB418641F3633C6587E1E3DF17E0F43E0F766905DE9A53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.3MB
- SHA256 aaa3d163375ec82115a8da3e7beb59642ad81db33e65826afcaaf5963accbc3f
- MD5 ad32999588976c6dffb87087dace552b
- SHA1 ca66c3d54a4a6649683e5cd3965af398409eba3e
- SHA512 8d0d4c27b5b4e57e18e667771e0752389b2b3d1be0240a53fd27591a251c4adbbf677f25b5741ee181930fe0c84410c8f0b3332be4ffd04582bd8422d1c86f6d
- SSDEEP 12288:8uUMDcqBFuvTBTLjkRO5nPKi9602gh3omtoSlBWh0i:8upcqsJ3kRKnPKi960Xh3omtof
- TLSH T1DD5507017626C68FC6AD40725E36D6CCA7707D42EE05AF0773CC9B3F9476658BAE2281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 8KB
- SHA256 fe7c94bc95a8a9a48930fec5859f463eb7ca6105bdcfa6837708491262ccf73b
- MD5 9dcf0fded9e7c3b2fddef88552bacd2f
- SHA1 88b614c77a1d57f1d2bb03baebb6f071468ec55a
- SHA512 147e8a6990731ac742feefd3b8003d454ed2c5ee843253bc53651323fd8c9ddc11913d41e825e4a87ac365e3bf2a48eb24ba49618763a90c5e411569cf52f9c1
- SSDEEP 12:KRW3lWEEEEEEE/i9EzBRUtPuEEEC3Uy7En8955Rv4kvsMlE3UvPKh/U3:KRPwi5tP4l88HRfs0skPC/
- TLSH T16502E5F4D790AA53CBF78830D082AB854B30D4181C0643D71196232A3E122E84D3EE29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 800KB
- SHA256 28b3c80ac84620a58274725929c5e729074b13d34b5c69044a9f4b70d02b735d
- MD5 952303a9929713c01a2db45ed8e16bda
- SHA1 a5401c7db2e6ef37fa2d2c2ea51b802aea56d873
- SHA512 0e3232f11878b2fd0b52ca052e61d41a97ea74f706bd586eb2d9dd3614b24c5eb8d84047051bce98b9836777311042821e165e19ae35394ba336540fb44e382e
- SSDEEP 6144:qUBUAUrUHUa0xUxQAwydnm4cvJkfPU5VCB1EA9Y0UBr7FuijxLnl:qUBUAUrUHUJUHdnnUv0cVrl
- TLSH T164053A056173E70FC5BA90B31331CA8EBB64EC06F6493F05738C4C3AD85AA59A5E57E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 603B
- SHA256 76051c7134ef5b2b172ae67cc7317ea11daedcc3d11f55c52922e505f501568b
- MD5 c4e03b2110e8235d6398eba4c822e6d7
- SHA1 679b959d6b0facd129ac0638cb30447d1f74be83
- SHA512 7a37b1dae67bc4c67c04175903beffeadc45668a301ba22c70f94c0050de9c87f65d5d8a31c80a8109a231fe28f8886da919b6c1555645507e14a693ca20f08b
- TLSH T18EF0D44BD3A16766E427133C859615D17531E9506F43113340509F5C3D27B219E034FC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\log.txt
- Size 1KB
- SHA256 a265940c59e776673e1c82f068a5fc444a223d4c6343cb734292f3d99e7b291f
- MD5 106658ec126c7113735e3d62837bacf9
- SHA1 c9729dca2766a6c61d5369fabfe6bacfc271fe73
- SHA512 1024586d2a6d83b9dd49291fe6858a502ea9e18f3bd0abbdfe9503cd088a00cf14ef6737420fde014c0f5e7d4067c82e9a0e33a0e92c87bea2b1d4a6684892d1
- TLSH T15841C87F0F8F7FB64B123078A34C2152158632E99D870D182EAEB41DE6949BCFB519C6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\log.txt
- Size 6KB
- SHA256 1d20dadfde2b63bce30bcede04598a6be1450fbf14f08cd7e39d4ff62c527407
- MD5 4c27f2215054af36229e2522ec9dc1cd
- SHA1 1a88ba29fc7e97a88806743a3fcf2d79c259c0fe
- SHA512 a9609a985b5e9ea4bba78d0ea5b6d93c0f0a16be88b0beb5f0d361dbb28341303b984eac07f6ecf7588563c68513558f036da6da05e53fe24dcb649a85ab4dcb
- SSDEEP 96:omHr7yzIgUnndddddddddCCCCCsssssssssssfffffffffff5555555555P:vg8
- TLSH T195D12D7F0F4F7FB60B523078A34C2162154632E99D8B0D182E9EB41CA6949B8FB52DC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 b97c4ae9692dc7ad8b905713895997926dd632298ba6c09bd87ab8c276202282
- MD5 ab95b7a13e9430c0f68d91ba40555f36
- SHA1 fa2a955a3483681b056d3a5a60779471dec26eb8
- SHA512 0390e66c9914dbad0a56951fd6aa83ee1e3409be3d83a44c013f422428b4b2e6045d4f29494e1bc524d42abef1807b62a03684834bdb9b1640e4a8f12b337a48
- SSDEEP 12288:Pz7mflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:fkFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T1F26523319288EF67F1F043719E44C106B6673AA95B10EBFF27B2B4AB06717804D7496B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 79e9d18c3602b4344d88dafc5c1d81a8303375d78ef9b07aaac6ca9ddaa417a7
- MD5 79777e75a34b26421751d4e2b47abd48
- SHA1 a2f98edbc9ab7677f4bcb08a1198690aba6bb29a
- SHA512 d823b3010cd28cac3a97c22a84b84740e185d253876ee971940fb79f8d6c4d82eb3b61e8d9e3fe07f3d3c797992c32c15a289095da3977f881521c930368e0d3
- SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYKFrjhcYTtsfaKDWGxS3Ewddc:Ygb4mBIBhGF9hjh2Zqo5wd
- TLSH T1E5659E1E22E802F5E0F6D2B8DDAA4417D6B278160731D2DF1251427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.9MB
- SHA256 9190be327220416588386ca1d7b7cf7a71175f9dec1378ab49d616f42f744d62
- MD5 72ee426f86bb7d299877cc4c4b7fc2df
- SHA1 07da0ff82b2d3078aaced389797ac1135a653e10
- SHA512 fe5804676400b595164d36acd501002aad1f16fb354037edfacfb59ff43177f8aed46036de4620441efbfa28a2b0dd8bcb9ad24b370a4b0ac45e7f796d1d5762
- SSDEEP 24576:LG88u8FpJqH1vzria7/mtFrjhcYTtsfaKDWGxS3Ewddc:K7ZFPqVya7/yhjh2Zqo5wd
- TLSH T18595F16577E002F1D477D1388A824667F6B2B8250364EFDF07A88A561F23BD14B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.6MB
- SHA256 4fd6b18790a37e2d5a6aa770669071092eb842ca78aed2043d1444d645640888
- MD5 6c8fb4d8341d9edca7819745c7336264
- SHA1 bb1ff9d0915af37a1f4d728c845b1a952df9c2bd
- SHA512 a54c1a37bc286c27c443c317b5de8993a649ee90d4dcb5f0e8574174e542fd0d897830515fe0e8309d00f1b315e72c2546ba933f4ddf74aa0333698db4ceb37c
- SSDEEP 12288:DHvUrBFrEjwaQlflf2kXJGurNjhaA+1YTMnwsfOjQ7zDWGx6j3ElPKMSdMflzUW:DPUr+NQBFrjhcYTtsfaKDWGxS3Ewddc
- TLSH T12675E12F629C1CE5E676D17D89828609F77278621712E6DF02E1817F0F63AD4AC3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 12bd4375b5124ecb5fe8a4d40c2ac0c1de4e7d183b9d87aee5ca0630098f6d77
- MD5 aff593b877be9df733075416dba75082
- SHA1 276353b817536ef775bc52efba2d671793678f0a
- SHA512 52d2cd25b93aa3f3dbe263f2615c87e53c1466507323d9c616b48069abb940b22ec935c8e4acb00cebf55268b8876ec5491c1e55c5e85b94868d8c34d15c5193
- SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxhjh2Zqo5wd:6G05lO43bAD8Od
- TLSH T15BD5BF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 6933fc181ee7332a9deea596e1b9cba1669c7ce9a70ce299cdecd15f0481283d
- MD5 8b632b805462f633837b79c64ca1d1c3
- SHA1 cbb9b1eb873e8a51dcb6383f56ef08d69f256e29
- SHA512 32b74c66cf5678399d9749990bc14994ec58368c0cce849ea4a25784bb1aad92cdc75c608d0b2c8727749f87da1c462d136898b372749883efb6489835ec96bc
- SSDEEP 24576:Ufa5POZ3dpyWVM50JicR2hG0lasx2+47eidn3FrjhcYTtsfaKDWGxS3Ewddc:Ma5POZ3lJt2pasx2+mphjh2Zqo5wd
- TLSH T17865AF5EA6EC01D5D1B9D17DC583861AF5B1342653319BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 cf26053c894f489e31c33adcbf22d8aee414b8fdc485f2e12c264915699bb87f
- MD5 d1e9409ef4a26e9d957308841e523000
- SHA1 e172fb375f183db1d8f13ae1d08a1a862e470e3d
- SHA512 c04288f7254750fa8646f4bb0192b1f5f7b17584999eb0386a50f971671a9df5920a88d2714cb4e95f9fcf8fc7673dc6de201bd47762679acd82ec413ce5c283
- SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FklFrjhcYTtsfaKDWGxS3Ewddc:iNc/zEOVHFShjh2Zqo5wd
- TLSH T129857C2623E901E4F1B7E1BE89679546FAB1786513309ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 f8b22cd67f21b390b8403892d59f7eaaa8da6416fa5a11c240f02706a26a1fd2
- MD5 75df27fcd5f3846037ec624a3603b0cc
- SHA1 518d102a1062f52a5e9db7c8d0fc955c6a9661fc
- SHA512 d70eb792a2cc77ef9aca762fcb4a9b596a1b0fc0cf7251592ead99cc3fa519ef4b5fb226857a1f9cbce2061388fb70258415deb9cad343ef90ca0223fa1e3315
- SSDEEP 24576:bzkNvNnaFeYhJNtmZBmTFrjhcYTtsfaKDWGxS3Ewddc:bzMwBtOmThjh2Zqo5wd
- TLSH T18E55AF2EB6A846E4D1FAC6B5CE238512EA727461073293CF5390C13F0E679D89D79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.8MB
- SHA256 a1f8f55ab1d607fc8bc1f17830b3e05e711f5bef101e43cff3d6d164ba6edae8
- MD5 9d4e4c30fdaae1ba8c237f35b0d6c4ab
- SHA1 de55a225356045e3f4aa188719bd6b7776c36f84
- SHA512 90897e6ebc80bf46fd6564028aa13aa8c5a58c7b8b9b903263530c170822182201025fcff8ae74d28d6e2a9486a9fb0fb9b392b8063116edfa9e5dc5b82aa73c
- SSDEEP 24576:dD3FHshBIYQgAQFrjhcYTtsfaKDWGxS3Ewddc:dDVHeBIAAQhjh2Zqo5wd
- TLSH T18D85E13DE69C04E5E57AC2BCDA538606E77138A9032166DB02D4C1BA1F6BFE46D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH