Analysis
- max time kernel
110s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 00:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
- Size 2.0MB
- Sample260708-bcb3bsgz2v
- SHA256 5586e43089f03a635a3656f5ac8da537f65cc0cd9d9598721e7feceedb8e0388
- MD5 52bf1de2815e87874e9e4fc8fcb24763
- SHA1 49d96c1dcaeb75426f313082d667c47310d5d550
- SHA512 33718a36fd936e845d9f460acfbdb557fe4d2b7806ffe829a857398823fc3bc2b940870dbd6b008c70bdc7ebce8e8110a375c0c3b8199163bed0d837b0e6c56e
- SSDEEP 49152:MVxeyk+tWoS/0PUa6xDv40bk+BiTwXFw0W0i/+K6bxW:SxFx4oSMu40bkOy/+K6b
- TLSH T137A5AE033283C031DCA211B08969DFAB86ADA4345B7148DB67D46E6ED8F22D15E35B7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 16 IoCs
pid Process 4984 elevation_service.exe 1216 elevation_service.exe 1400 maintenanceservice.exe 1988 OSE.EXE 5388 PerceptionSimulationService.exe 3748 perfhost.exe 5992 ReFsDedupSvc.exe 3588 SensorDataService.exe 1812 ssh-agent.exe 4200 AgentService.exe 1576 SearchIndexer.exe 2852 installer.exe 1732 installer.exe 2280 servicehost.exe 3256 ServiceHost.exe 5868 UIHost.exe - Loads dropped DLL 8 IoCs
pid Process 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 1732 installer.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 5868 UIHost.exe 5868 UIHost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4df417a8c50b3491.bin elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-tr-TR.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-it-IT.js installer.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File created C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\wssanalyticsraw.luc installer.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-it-IT.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-it-IT.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-nl-NL.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-pl-PL.js installer.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\core\init.luc installer.exe File created C:\Program Files\McAfee\WebAdvisor\logic\smart_toasting\smart_toast_config_selector.luc installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-zh-CN.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-es-ES.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-hu-HU.js installer.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-fr-CA.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wsssetting.luc installer.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132250\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_toast_light_mode_step1.png installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-sv-SE.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-fr-CA.js installer.exe File created C:\Program Files\McAfee\Temp2739746088\jslang\eula-nb-NO.txt installer.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\auto_restart\wa-ss-toast-auto-install-v2.css installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pt-PT.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-fr-CA.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-nl-NL.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-el-GR.js installer.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File created C:\Program Files\McAfee\Temp2739746088\jslang\wa-res-shared-pt-PT.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fr-FR.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-sv-SE.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-de-DE.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-pt-BR.js installer.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\tooltip_img_1_3.png installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-hu-HU.js installer.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-utils.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-ko-KR.js installer.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File created C:\Program Files\McAfee\Temp2739746088\jslang\wa-res-shared-tr-TR.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\logic\logic_loader.luc installer.exe File created C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_utils_wps.luc installer.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-de-DE.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fi-FI.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-es-MX.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-malicious-webpage-toast-de-DE.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-cs-CZ.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_onboarding\edge_onboarding_telemetry.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-da-DK.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_2.png installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-cs-CZ.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-el-GR.js installer.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs ServiceHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8db8c15750edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030d84612750edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs ServiceHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates ServiceHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc8fdf11750edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000660fa113750edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust ServiceHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd76f812750edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 SearchProtocolHost.exe - Modifies registry class 49 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA} installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA} installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\win32\\WSSDep.dll" installer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-200172840-2662118501-695741713-1000\{DCF2E038-39D1-4C31-A415-6F7A59508FE6} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0200000000000002 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\WSSDep.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration" installer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-200172840-2662118501-695741713-1000\{65BC536E-BB84-4EF3-BAFB-2B4037F15DD9} explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe 3256 ServiceHost.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 824 Process not Found 824 Process not Found - Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe Token: SeAssignPrimaryTokenPrivilege 4200 AgentService.exe Token: 33 1576 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1576 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1576 SearchIndexer.exe Token: SeBackupPrivilege 5992 ReFsDedupSvc.exe Token: SeRestorePrivilege 5992 ReFsDedupSvc.exe Token: SeBackupPrivilege 5992 ReFsDedupSvc.exe Token: SeRestorePrivilege 5992 ReFsDedupSvc.exe Token: SeBackupPrivilege 5992 ReFsDedupSvc.exe Token: SeRestorePrivilege 5992 ReFsDedupSvc.exe Token: SeBackupPrivilege 5992 ReFsDedupSvc.exe Token: SeRestorePrivilege 5992 ReFsDedupSvc.exe Token: SeBackupPrivilege 5992 ReFsDedupSvc.exe Token: SeRestorePrivilege 5992 ReFsDedupSvc.exe Token: SeDebugPrivilege 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeDebugPrivilege 4984 elevation_service.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe Token: SeShutdownPrivilege 1956 explorer.exe Token: SeCreatePagefilePrivilege 1956 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 2100 sihost.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe 1956 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1528 SearchHost.exe 6056 StartMenuExperienceHost.exe 1956 explorer.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1576 wrote to memory of 1608 1576 SearchIndexer.exe 99 PID 1576 wrote to memory of 5928 1576 SearchIndexer.exe 100 PID 1576 wrote to memory of 1112 1576 SearchIndexer.exe 101 PID 1576 wrote to memory of 2336 1576 SearchIndexer.exe 102 PID 2476 wrote to memory of 2852 2476 2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe 104 PID 2852 wrote to memory of 1732 2852 installer.exe 105 PID 3256 wrote to memory of 5868 3256 ServiceHost.exe 112 PID 2100 wrote to memory of 1956 2100 sihost.exe 115 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_52bf1de2815e87874e9e4fc8fcb24763_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\\installer.exe" /s /upgrade2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Program Files\McAfee\Temp2739746088\installer.exe"C:\Program Files\McAfee\Temp2739746088\installer.exe" /s /upgrade3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
PID:1732
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1216
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1400
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1988
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5388
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3748
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5992
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3588
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1812
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1608
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-200172840-2662118501-695741713-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-200172840-2662118501-695741713-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5928
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1112
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2892 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:2336
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:4356
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4952
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2892 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:1656
-
-
C:\Program Files\McAfee\WebAdvisor\servicehost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
PID:2280
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Program Files\McAfee\WebAdvisor\UIHost.exe"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5868
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1956
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1528
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6056
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 12856cefb520ab25f5d72f49ee09e1b0e7fad4b7e37ac169c8ed8f63711850a9
- MD5 98e49b8a16698edd4b4d18afe5fa0623
- SHA1 522bd59715ed95916b0fcef942af2a5d621a06fb
- SHA512 fc84cef52847bb31441f8472de163fd7b09e3250da80c53adbd2dc4d8175cb8fe9fbc5b0ab18b4bcdc8c04b44c1cb99e95de0a944d7c04a72a62463ceaf157dc
- SSDEEP 49152:ab+632BuPkFKRrdE6ohQstBhuXjfS4LWxnv0i/+K6bxW:M3q6tjBm/+K6b
- TLSH T1EAD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 cd610d5781f3a76efa552964f3faa9a591b9dbda363a8474a798df028947f76d
- MD5 c7209daf3b547eca47fd9134ba7a90d5
- SHA1 14b4b88b762eb883d3d2a3d54bb32f4814b8976d
- SHA512 25930c7017dd580fb1a658dd0e56cafed67a81572698138c22c7d8240d7fc32bdaa7d2f8216df8c75f93a33c3fe94955ebe7baf64404aa202183a80c4d9d3e02
- SSDEEP 24576:yXYfDtczAw051dckw+1MCO6Wm/zLPFGn8W:ZtcR0i/+K6bxW
- TLSH T12505012877D008F9DDA78239CCA18501E672B8A54770E79F03E49A6A5F333D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 41c9b672a02f8dde3894d282144f2c4a476113847b5f92538aa5874449928c9b
- MD5 9d8e5e83eef45cb5fd3bb77faa3053e4
- SHA1 f290b1e73f9500419e5a612cfccbb414bfe6b519
- SHA512 41b2414a2938fd4b0e0f9bdb0d19062b577d652d1e95653cea4d21c71d99b4b054b40d7ef64ffe62691260b090eb72fb254bf44b610fd3a3d45bd361aabd5e83
- SSDEEP 12288:gmw5HEjsChNOBFgl0WDm+ChTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNo:9wuXOWK051dckw+1MCO6Wm/zLPFGn8W
- TLSH T19C05F10A77A40CF9E9A782398957C532F7F2BC152A35D71F0760C65B6F37221AD29B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 c4123da9c853a30b375550e9ac2f7062a821a459cdbfbea352a3707eeb514197
- MD5 5876b2813c1d8fdcbdcd58ec6ca0e925
- SHA1 4e1bacacbeb5573164c55dc0e278ebd7f998612f
- SHA512 12b76059eacf1520a7fe16b13b165a0b565cad565ab180959b4395d815652796bca7f2eccbcfa252fc64fb8f9375b536657550a2a6f7fdc427912e9f2757431a
- SSDEEP 49152:iB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glA0i/+K6bxW:Qu6JmQxd2dK/+K6b
- TLSH T1AFD59D13F1DA01E8D05ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\analyticsmanager.cab
- Size 2.8MB
- SHA256 d082eca9dc14a19e851eeb4b27344cfb86a10af4ae369f95c316954e1ec1f4c7
- MD5 51b832b42a516d64b91cc8a89b852393
- SHA1 d20760bef99cd11a755e8c1ad5296d0f1899e3d1
- SHA512 5c894742313f6cbde64e8142a2d735405a2710441ef613be46ac7972806572fbb40dbeeefddd55a7162aef4a22741ead45eab992ae0c0b7cd1ac3c505b7b3625
- SSDEEP 49152:As9JB+R/Fi7JbvwNISAlUaITzDoGWkylmm2DxJSIZw9JVX5WuXslgg+kX:AsjB+RdObYNzAD/XmmOxfuJVX5n8L7
- TLSH T1FFD533812D85C3E0F401557140D5F146A3EBEC9A68E5BCBA3C3D88A16ECBF193D63AD9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\analyticstelemetry.cab
- Size 66KB
- SHA256 d13d1720a8953a8a7491f2995b078ccb6aebdf26a9cf4af54eeee7bd5d32e941
- MD5 ac3bf9c276ca7261e640efc3585cc167
- SHA1 979280fb743df42c33b6e0dc1aaae9332c6ecbe2
- SHA512 41952d6399ba871ef1d46b2feb4ac8b6b181b23d9d1e6c9fd24136044af9f71ee12891c29af7c238f59c90ba1f5f14488cb79d2c55b2ce7f2f04be6dfb6ece0a
- SSDEEP 1536:2tiickTsWIuJ826OEzXNcy0CbTRRnGOZzwxsTGyP+Wz0G7ez:2tdlPpJ8zqCbd17d9TRPeGCz
- TLSH T1E063F1214E6465CC9B0AFE6830F2D727D534F794A88090D6A85E496F1FD97027CCEBE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\browserhost.cab
- Size 2.0MB
- SHA256 17f2dfd6e153e3211ef01fa10f794be97afc82810ee2fe33b783c7897a92b81d
- MD5 5a6d1dc09ffb4bcb80bd7c8b31117235
- SHA1 8e386ce74057b11e46be225cce5461f041e42ced
- SHA512 937beec4373415eeca9d81d98361f7c9eaa5182070c13720cfbc42b7675514833ba1594b3ecc0513bd4393ccbbf96846a3d3ff72c21794d9ae22cb485b9c7c09
- SSDEEP 49152:3iLU/yt+OwcLHhs5KceSXFfX1Gax98O4YcjEtEYR:p/7a6l1fXzA4/
- TLSH T19AA533E0AB5285C1C533D9070F7286A7A913F5BBD9F374BA50C0CF5723911A226E197D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\browserplugin.cab
- Size 4.8MB
- SHA256 fb4b6403fab3cd7ba5901ad2c56a61d0ba009c8fc9c253b3a85fd41f128eb393
- MD5 ab01f64710bfb8890a62d7f1bba1d829
- SHA1 52548995768215725a48be28dae3b597c49a4bad
- SHA512 4e5db1cd9f1535218a30466f213dfb88823ff038f23af6403374d94ae2fc91a1a651f42a4e980640370535c9743d8faf75281391fc5719f6fe28accd0776db97
- SSDEEP 98304:UkPZOaex9pjkl1F1JxJmNASEkYQZrctPk7bkAvAcRKEpR:nBOaj1F1rsN0kYQKs7bVvFwEpR
- TLSH T1223633FB80435156FA01EAF3BFE4FE2F4140232FA48119D162EDB727A39F6120699D59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\ds_invoker.cab
- Size 3.7MB
- SHA256 2aa1cad2a353b4b50e57c18d049a274d61205461537a275bbef7454393afa4d3
- MD5 570c711a53eaf7045a1e98f95c3c3a62
- SHA1 d49eb7bd589e21acae4b77918e46f1f01208f19c
- SHA512 01888863b82df31da477b2199ec7b147c707395cbb1785d0e7620661b46d8e66cfc2c60ad880a93ea4675ca810426142127d814b4bdaeff5a56bfc4a5a081126
- SSDEEP 98304:fhV5PYdZoREMu6x0su5rWP0OtoupNeJE1l:5V0ZoRJ0btmQJq
- TLSH T1580633D9517750E6F6B3F133C84919275A0617C0179B72AA46FFA2B2B74A0B40BB389C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\installer.exe
- Size 3.1MB
- SHA256 8ab97e61de7f76f8a44a3759263600a4c89833586b6917aeffbd02e06bc891cc
- MD5 20914330ba7beaffefd4ef1b68de4a2f
- SHA1 c31a5cc2c759ff5d93815918975225b6343482d1
- SHA512 ff49ab4853bb9696ceef26b7da5d28a3bcf38925b7fe3ce2e7d9baa83daca9c049e76c081ca4239ca975c957104fa0c0c4d49adb0671bdf39fd27bd3f0578120
- SSDEEP 49152:M4NpCMzxdocZfbIOI5LjPBOFE+rc1yc6GxGtYGAuZbL:z4cBIOI5LjkF3w1y+JuZv
- TLSH T137E58E1BB1FA40F6D876C078C903861AF7F3B41443214ADB1694566E6FBBAE44E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\l10n.cab
- Size 226KB
- SHA256 c059763a1416365f31cce2e15a1b047fdb26dea50723db752f18e0356655ebca
- MD5 a2722f67891303ddb4185e600ce96940
- SHA1 215e07f592f5f1ecd55bf2ec144c0c4b5cf83941
- SHA512 a814cd707364282903397e062ac342ed83eb2cacb3f2c9756d6ce5d514502b4398f7720c7e524851ed6a91d163038ab33230d9ca2ea350dfc569b9a8e612caf9
- SSDEEP 6144:MoCFYjur5hHWpFzMtUEARQ3pGaJMqjOhuJ/AXm7Mde:aFYjfFzMDAqGGMqjMumqMU
- TLSH T1A634BDF25E4AAEECDA04C66A50224831C2529152CBD6ADC7C71F82AC2F5174F1DE7B36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\logicmodule.cab
- Size 2.3MB
- SHA256 c2c4b18658c1efb388b3847ecd9bdcb086b82f5c3b51096b0fde27bbaac0c13a
- MD5 0c20f740f99ce97407972c55d4e31cff
- SHA1 0ef76b2414093420b272d20005902c00496e0342
- SHA512 cf35599f38cc2fdeab76aa3f9bdc449aa66c81f9215cd5f3299b45db2f9da847d3ef30810f94a6302ab0c86f6f76e4c93a4815271da94c052445e66e11238d29
- SSDEEP 49152:ZuEfbfR4/aJrJg/thhEou35aR6vp1Wj4xsJatEHbbnI8OOCSe41bxoGEa:JfbZ4/aJrknS3U6vbZGoE7bIYC341bx7
- TLSH T19EB5331D39F8D910FF1C656AA4C89377E271F56B62A7F0EA0257080645A70436E3FAEC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\logicscripts.cab
- Size 68KB
- SHA256 4a5ae098afb6d9665be5ddacaeb271f4680ac80518fabaf27016e567c9dcc0d1
- MD5 e1154acb0c282ff124edaf195a8f38de
- SHA1 b53b2f91efbef4192640e58c57c9de377c0b21fa
- SHA512 0927995e39eafd780e96e63885afe58294ed5a70762da9caeed866a36410e84df6e59032bf8110bc8b94127fd59c584e8424edf2930dd34aef25816de07ed988
- SSDEEP 1536:PQhquuGYgjt9U2ckHx9npMooQQKGhbGmG9fqsJNe78Sem:PQAuuGe2ckR9npMooPrLybezr
- TLSH T1466302A1653DBC87AE4DCDE3F0C01667F9BD918ABCF4A4D390159A0CAA443593ACF570
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\mfw-mwb.cab
- Size 20KB
- SHA256 8f89478dc6614d1020e22a7a37720851549a08ba1969c136234cc4111361fa70
- MD5 3b844d8f2248881956c17f8529e8b0e8
- SHA1 acd1dcf1d6cd48468be073e2d4bd976541f0b6b6
- SHA512 f80b605176553afd92de709c2a1bf5c8bd613a25616adbd2a29d3abef44c5b38b79e568e0865d4e7e2bf6250185b55346831b7ff6680ace1a0fba21a90bfc728
- SSDEEP 384:WnQyU4GTXsegIDz0QPB/M7oHkP++C/ytWACrGp+6ki29d1ikkqZgGy8RbmL4nNyM:WQzZg+PB/MUkfCKtbf2PssF5AL+cS
- TLSH T15692AE3649201643FF479CB6F0E09827AD38A2567AF090D3A261892C5B943C23BDD1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\mfw-nps.cab
- Size 22KB
- SHA256 d990b001e68114cf7c5d31adaebcbccb8b0210e6a5699985e27c9984e95210b3
- MD5 a3e6a96e443574cccf204c3a79b6b19c
- SHA1 3cac70b0f36c42bfcaa94802c13740d07487a696
- SHA512 99742c84b298d5c9445f9e325f92483b54959d71d8426e49e15c863dd921c661e2b7195f074a4fa97364d69afeab641e0315221487f56c11b028b669f62ba156
- SSDEEP 384:nFD7V4vuZTVdUs5pUWPfOW0kr/6ki29d1ikh2y8RbmL4nNy6mTQH:nt7V4vuBDn6WzU2PsF5AL3UH
- TLSH T144A2BFE24C940483EEC7BC31F0C0552399392395ADF4ECD39566D26A0F593D36ADA49E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\mfw-webadvisor.cab
- Size 701KB
- SHA256 6528005933dcaba451bd60c2fbeb39f3e8a280e6a17ee030bd235df317b4a56c
- MD5 5e7d4cc018806cfab14ada0a97c530df
- SHA1 fc374f5db43e45e7355a733f82a1f5c472c871f7
- SHA512 a0bd82a7fddf8724ab7e7609e39a7f710298025da31831cb7413de2c9ac89d18491e669c8d2487d2bab1a3a4b645e17823b81083d57419cd7f86ad336bcbd0b9
- SSDEEP 12288:4k3TDTeekS9Of8wqlwK2yq8P8n+NS2+UPGHUfLtHO1XG:4GTDTebfywK2yq8kn+Kh0ztHZ
- TLSH T101E42332AEA29F4BED2AE570B19C3E357B1E1ED7304109D43153A32D957368738A7934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\mfw.cab
- Size 786KB
- SHA256 1c73bc42ee0b439974a05e3c635cb6b901fbc34432d714e328f90b26cb27a984
- MD5 641b6a5c8d3947192332d2e505a64c66
- SHA1 3d1207f0745c7ab64c56da464c1a9cb91cb78f04
- SHA512 1bd2a29655ceab55dd3bd662e6c578c491edb483757216b957090fdd8c1aae537dcc5bc5df19e9178cd4f2980bc27ebe6bac3268d57c1088e8c853950480081c
- SSDEEP 12288:HFuaDc/VLpUgp6KLQsrz9FhWW6SsKbUymjI5KDqz6Cro5OJO1u8BanQd:02QV9UgpnpYN3yK+L6X5cAp
- TLSH T16D05230151F71F577E099A783E5D0E73DE8ABEBB2E962CCE2787080462434616DBE385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\resourcedll.cab
- Size 37KB
- SHA256 16cfea49ef5a6d963aa2c5289976aa0d81c7c65955ca071898d716858a03ffbc
- MD5 40e4ad57592cf3c3a7eba9c37a3ce525
- SHA1 0e1d9394977502a39ca8565579829af30b1cbc52
- SHA512 cf420784d0129a7802345351d84621f077705fec8ac802c1b26feb47d78bd642e52e4f0af0199780800ad7231d110c6e5455a2df3190f6ff6a9f5a38a2bb4bbb
- SSDEEP 768:50Yks1lE47nrP0oiZtDHZh8oOtRN1ZZTOg7pcVQbB2PsG5ALhN:2M1SirniZmTjj68pcgB7jN
- TLSH T18503E1B71A5E090BFDB75C2470D880A79E79F1592DD4B0A261AEC364CBC43C52F6D2AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\servicehost.cab
- Size 331KB
- SHA256 4eae6096e35cc1cc7d82b16d5f455e16e985794dcedf5343742dd572713926a7
- MD5 5378e2d1e038fbc0f5617c45f9e0e628
- SHA1 96c26d4c55c52a2b7d2165344941acdc55bde8e2
- SHA512 c4052207781a4fa4efd45a88c4ac8538598af0aac2c9cb0eb012bfc539742dc35291e2e9fe4026cd75c49794708459e0e446d92da67d24cb9e63a2a4639ec389
- SSDEEP 6144:6kISvQsMYKnSROSLu08N2yy7v/uMjbwkFnL9SDZV2sNjBzK1CtmV174TQK88gTss:DISv5n1Rb78e7Njb9dsNFVQVGTx88Du1
- TLSH T1377423CD64311A47FC4FB271A09A1B969AB003ECBA9D2386ADD18790DED03469FCD717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\settingmanager.cab
- Size 818KB
- SHA256 4655ea44d1e18fc75f50f61406330d6c33e43c121512cb8b909948bc6efe8705
- MD5 1b12570892673c3a50befd5aba64ea91
- SHA1 72c1fcb8aa48c536d1c9bb0dbbf76f1b303f3dcb
- SHA512 7f4432843375209d68991712e7d8c9089ce1db695fff387b5adca19d7e82859979a361b79a73c9e623feafbe533140bd3f1f726a4cbbf06ddd63d873ddc7355f
- SSDEEP 12288:S3CyazwqWFz3OhRC0Dqm+f9aFdOK5gfqcQ3/0N91wm2RZImKquCUHmGd:S3sqz+hR3EVEFbDMNQbhuCUHmy
- TLSH T1D10523F94708077DB9DB6B2C40552A864D78EFF79FB4C1771AB81800E096B98B84F91B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\taskmanager.cab
- Size 3.7MB
- SHA256 739fd841e011f54ef66186d42a4ae6e65459723d9326e24d5dcc57e3068801a9
- MD5 4ea9b48d56aff2e7cba3a8f4d2795375
- SHA1 02146609d08b386a685adc534d49d8cc4091b940
- SHA512 142fad22fdc6fa26c32646e3979efd7217b403f66ed12495dfb3b9fdd5a5e449de4e7a11857c88e3bce2dbf932e75042fa3c1b17aa9e9842054316e8ef37a907
- SSDEEP 98304:Zpx08sXRzH6l7xktSyz1euCm8WnjQyW455QL8LnxeS:T4S/yzMG8AjPEqxp
- TLSH T1E00633D5319ECB9B8F4279415690339CF5339032B82542FB9A3EF26D5B8BFB32A49405
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\uihost.cab
- Size 399KB
- SHA256 735bca069ad9c98fa10787ec008402eec3bc7a17aedd011404fec76933e71dff
- MD5 cb70cf897738c9337a07a1136f25762f
- SHA1 3b895f3f69f0654e2307b75773c251abdf6ada84
- SHA512 043c00e24a2b9068cb2cd6fe67447aea2a4f5d5a9250a86fddc0a8e1cf76173910088bb0e97964462d9163eb6fbb461ae8921305f78d0a6b733cbabdb0c1d4a4
- SSDEEP 12288:R0YXwNdFWr1dMThOnxu7t3OF605QTPmiei/:R07N7WxSQS3W6AQTmil/
- TLSH T1C69423ED15607C9A4CC764382291D262ED76A3096F6C91E0B3FE0D177A863906CF21FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\uimanager.cab
- Size 4.8MB
- SHA256 6f53488adf7cbfd7e784b0170fe0c971f51918719617847a0525a6a8a49bfdd2
- MD5 1d20ac7e08d6165d9011bef3faafe9cf
- SHA1 0b7b414d3185a22d86130b68013739c0a07bd49c
- SHA512 0e06a04940e4f263499529a1f8f0e546ee6ccc47606cffa6e6f849739affcf4547e49e11d4d55cdfdd55ac33ae57e4a4d8bc224d523b9c988bc88bfb32e35da4
- SSDEEP 98304:wlqyHVsQyMHoxQ131kXftIUQbgDym4Ri0UNxCvODsqoSOWTNKC+4BTb9+mAlhphl:wJuQyaV1FU6EOiN+cTNd+L1Nb7
- TLSH T1B536332A073E0CA154272CAABC9FFDF726854982014DF599E6B2F7D4851679B1FBC083
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\uninstaller.cab
- Size 1.1MB
- SHA256 7ec55f7397ee3346b6e624f1c316889ecf65390397ce020a374b4f1cf47148bd
- MD5 d836841ff9fc0d402957673d4e348b7a
- SHA1 58a78b0a7c9a46c8fdfe4a9a2ce3364e661a19f4
- SHA512 b74866600069d6b7b133809c59b30457edb62585bfc39c292dd325976354be4a52ee4ab44617a45544c6e9ba7bbaacc8a97c1cfa6d3607ab9e34d56883c528d1
- SSDEEP 24576:DUOCepNnokLXoAWG7hAMRSg9Y5mI5gXvzigCuNaZJ1h6EALCR:DUOCepNnPXRtxYg9kmI5KziJwaZJ1YE7
- TLSH T1483533890B3574E18BBCCCD99B22AD369EAF11772ECC679109894CCF133CBD9125985B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\updater.cab
- Size 999KB
- SHA256 0d19cfcbf00a2c3c7913a77e696aff8573e9f2bdb2b9dc4a9b0e2d6441d836aa
- MD5 c5ccb5fae01172c5918dbd2f93ac17c2
- SHA1 3eda615e1fcb8e1f0933e2ad91bd059c052e872f
- SHA512 b53040f5afa6da6b880dd5caa558a512e4fde8dd0099ea38d2ad2c269afa37571ab30dc8173e96a59701d70892f5f36843272ab3876af4f411588d29b10521ee
- SSDEEP 24576:o/N3wq/6M26QCk7iyooXOMcNGDAo1orIS5u:o/hwq/8Ik7iyoo+fo1z
- TLSH T13A2533E2615988D0A7B2C2247E9F1769C72D7D811C287A515F8086FF3A81A0FD3DED63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\webadvisor.cab
- Size 11KB
- SHA256 d2377fbbb8ee38ab139b3aad9e95546a78c44a78b646b59ca2c45c2ceec03833
- MD5 361bb982014f052be428c61c08acca82
- SHA1 eb98d3e41f252d576c6dfb71c14e5086e1e7f7b0
- SHA512 7524e3e3c5b8c8d57b58161944508a4a85788b46e3e80cddb6d1e08fc394cc54214c0d81c786d5ece207f51fc97522d82cf69f85eb67cbd785212b3190ed8a8d
- SSDEEP 192:FxS5kiXK9r6kSDnicM9Lx76iiX0iqtX05TAULc8pq8RuwdmL4pUQrNymDGORU:FxS5ki69r6ki29d1ikbOfy8RbmL4nNyH
- TLSH T1FE326B6348641C03EE87ADB5F0D499139D74E3C62DE9E0D3B46A82641BC43923FDE29E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\Temp2739746088\wssdep.cab
- Size 575KB
- SHA256 adb75fe8f8f474b38e1499ef53aaad1d56f72cb48c3b78bf21897cf12e258cc6
- MD5 e6ba44a5e6f6fee1845be3d053e80846
- SHA1 7e20aabb4eb254e671bbf09989a0476591daca5c
- SHA512 4b72170ef9fe942071969c12a0eddeacc712a9c25eaa8f6bbee234e31d7eb3eb3264eed17f3b601f5fd6ccd03bf7966eeccaa333bbacab0006309d7549287a0e
- SSDEEP 12288:CxrCA8jXw7ubhWVcReV87FDd/iPMRfFk3Cpb7j5Wp/qa0DA:B7Xw7qWmMV87FRa8Npb7joAa0M
- TLSH T17BC423B1A5348B472A91415372266056F0209BD3DECD74C60914EFEFA3563E82FE1AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\WebAdvisor\AnalyticsManager.dll
- Size 9.1MB
- SHA256 ad472d4c99f5884af2fb15c7abdc78cd5305999e5d18ff98f38d68c7ba594cc4
- MD5 a99d568e16cc7f33228326b16a170249
- SHA1 3d3042092ae1835f4cecf2917734983cbc6ff0d5
- SHA512 2c3d826f289734725772dd2519d289a7ce8d94929d52e26ba4ed0449795620b8f7d3e0db02acea8cd49ea3598c49beb22738470517005f01ffa2a637f674dcce
- SSDEEP 98304:ZRnDyiX8iZt1VCMjADEXHIEg/VGCzR7fAKlNyWdQCEB3/q+i:ZRnvsipVCMjkmdCz1fAKmJS+i
- TLSH T109A66C47F6BA00E5C8FAC1388A576227FAB2BC55473097DB0694562A0F73BF0A63D714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab
- Size 79KB
- SHA256 953708c221f4508bf6dad28e4221d3dc1f0d8b5b3e23600c187acee3803a45f6
- MD5 b227f9f832673658423871ea9df95563
- SHA1 7370120147da7cb94aa66290aaf32477318b32f0
- SHA512 bf4dc351012c94012189ba16c48570915787419e7a9a0bb30b9a576d167e9ce5936cbc5dc6d7ff0c627a2d7547afa9ed16a8bcbad2b57da3c2243931819060cb
- SSDEEP 1536:KHcDqgVhiUuNjTCxHG8JQDgtgnbZk+n2OGtfgstZ9v56jMs2+g2mIGPHCqCEuFaR:KHcDqgVhBuNjTCxlm16+2OAYsJv56jM3
- TLSH T1468301439D683853CE46EC75B1C8FCA36DB0A2A718C484D35215C49D6E493E2ABEA12D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\WebAdvisor\LogicModule.dll
- Size 7.8MB
- SHA256 641581947bb0eac13c772b6de3e2c2ba7bde6e1b087f2a876ae49e30d94e72ca
- MD5 0a146a0cb0647452ab1c7e1d339b600b
- SHA1 e47686bcd49a8e291d2441b46328d2312f8465c5
- SHA512 caaa1862a175d5a88025cc840f8b9cda2a829d0a7cd5a53b8fc37eb7166fe4a9399fb88995fddaee1c07ca2cb8a8b422402a517d564625f15b584fe5c54f91da
- SSDEEP 98304:yHgYorvp3u8VC9AzLDX3wKny09l328029B3F04:kgFF15zLDXgS287TV04
- TLSH T1DD865B47F7B610E5D8BAC138CA136223FAB2B85583309BD74694566A0F33BF0963D758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\WebAdvisor\MFW\core\json.luc
- Size 562B
- SHA256 9bf0e397bb65396297cd19a2a7ca48a615b5e9cddb2f07cfe8b069e58478d741
- MD5 87a50ee156b94e9c913ecd821727dc07
- SHA1 3e95d4c30fe19711565eab796299ab0449389ed5
- SHA512 6a847ba82fe5c772387ef1c45b2e24cb5b0ed9807861b47b180f57fd5358633a24b1f4375c8a979e3a3d48a86c20a081a63a51f32511183b4349ddde2787a74c
- TLSH T195F0C08820881AB8ECAC8587843227A1969D4CF4562285677D277ED0680BC606B3329D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\McAfee\WebAdvisor\Resource.dll
- Size 26KB
- SHA256 3c26d0754662db23eb591554fefd631041e8833a5240afe67eea859f28c75012
- MD5 e2ef2c9b4d458fc14a0cb88e3c49ce82
- SHA1 259d7f4fdc9fa8f1803a49d4e5fce46d609ba52d
- SHA512 da6a0f9ce475819e634ae6e90d7a75d9df6620314d2dd5316b6d046344d83cbadaa460647113d1cfb86ffb9b2be2f4d18d90e8bc32a3648e0dc6211d532f6499
- SSDEEP 384:JBhBf/W58RrB3M65lWHqXPDLcay6ki29d1ik2My8RbmL4nNykl:/Br3M656A2Psk5ALI
- TLSH T15AC2C616E6E995A3F5B36D3462F050812F77B8867DF0815E8D408A2D7AB0740CFE5B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\WebAdvisor\SettingManager.dll
- Size 2.0MB
- SHA256 215cbf16e52edce65a5435a624bfcb1601b0df3a35f3fd7db652183322480efe
- MD5 5e2ad130d4375ef777a9f7ad7dc83da8
- SHA1 d62b8a74fe3f696b9982d3cc3edf3273d4439eeb
- SHA512 3a4a8576dfa9d28c1978d9bca2058028f7e62381bf33dabd2a0de7dd095f3df1c98a28e01cc5f8ef54c9e783fc10e31db11dc342b9656bd277bc8b1ed9fd3eec
- SSDEEP 49152:j0avIJ/fVdycecTOhrievxF5aMiaUHH/CY5r:v2/fVdCg4JKaG1r
- TLSH T1EBA57C1BA3AB80F9DCA6D1B4C9078517EBB2B446476056DB02A44A5D2FB77F04A3D33C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\WebAdvisor\TaskManager.dll
- Size 7.4MB
- SHA256 a4eb29f496c169afc7647379ff96a52c219e410ad2ab073d2e145f7c4641475c
- MD5 618198008907d6c575b0a03abbb637ca
- SHA1 a987b92a01ca09f1d5f2858f663af046b6af6574
- SHA512 a202ce0fdc385afe259b7ade66632117d6209dbc71a7b7c49e7d3313bfab6d7faa4a55975e6789309f16af0fae96cfe109b2f6bb495fc4929cc84261c9e4ed94
- SSDEEP 49152:SPiZP+xuoSOqPWFE5bM7kY1kFS+rGvf8tvFX5AKd3uPDgWMMAyvk8oNwsAuOGG2Y:3ODMxYaSU7pp4oNwb2KVCZGe5EDZPN
- TLSH T1BF765A47F6BA50E1C8BAC134CA132223FAB1B8558334A7D74694662E4F73BF0963D758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\WebAdvisor\UIHost.exe
- Size 1.1MB
- SHA256 f9afdb2e57883d54f15132ca2b403f2cff0bed95f0a99406da1bab2fa2be1e91
- MD5 225a464f031c10bc9e93c17fb6267861
- SHA1 58ea77ee84b6956eafb6e8e8a88970d4d32caf4c
- SHA512 8b111627e4cf8c04bf237499943cb659e0de4dd89ad4e42187c108c64d20e205b992b99c27d0a2a063c92e089a9ec398f124575faa3cb580c675fd9a4bfdd691
- SSDEEP 12288:YolILLuUEtWo3sy7Sd0hqX8LZDzLi4WcHBxgeT2sybWCJ+2Yl+KRv:vleuUER7S6k2ZDzLi4/0SCQ2DCv
- TLSH T197454A1BE5DF90F5CCB6C1B0C9828512E6B3B40983205ADB02A4A55D6EFB6F44E3D63D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\WebAdvisor\UIManager.dll
- Size 9.4MB
- SHA256 573a6f59d307167e5e023f4e66161bff409cc550a949d3a1379b93d7806b04d7
- MD5 2c13f0f346aaf5fd1d13b1b4b6c709c8
- SHA1 71d53f89abd796ac547cfac7f496cd79a4cfdd11
- SHA512 9d9f2e9b58854c4cdee268e1e1360ef68b2744cfaead0b4f768ccf9b19d6a8792e9bcb3fb34dfc1452c2c2d4291bdad2977782c1cff0f2fbce4b8f54b60e73e5
- SSDEEP 98304:863dNCm7rxJ7Yj1dIx6LDX9Ae0rNFHWarTtRp32h41EgqZOqZjP:D3dgmJc3y6LDXmearJrJq/gq5
- TLSH T162A65B1BF6BB00E1D4BAC174CA1B1227FAB2B895833057E70694552A4F37BF0963DB58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsEventsConfig.luc
- Size 12KB
- SHA256 5ccfafb7f2f93c07c83cfd4ed624003e53e8c8dfc482d1ef4be64e25a84db143
- MD5 ecd5c5a72af080405a5c542e14731368
- SHA1 7cb51ce209677373b02906491ca74a0320ffd777
- SHA512 81d0683211cd9df506be77da7ac339f79bb07f0b9ced210ca11c54addb33fdfe9f391acd5fc70ced4c70a5205c094de9f7c74647321e3411c8597e7a1c9e2258
- SSDEEP 192:GbCOwwmJ3rA8ygkZ0pov0gxs/wSgqucppFv3F1H3c1Ft2l+Q0l:5dZ3s8ygk2p34Sgqucppd3Ft3c1n2l+J
- TLSH T14C4294AA5FBE6A6DFEBFC2DD5AF006E409304989B0C005F687AD8D5401C35654FAA70F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsTelemetryHandler.luc
- Size 2KB
- SHA256 7b2b11fa9299cc39415859d157b8f7ff8422a7be37bb2663d9f12d412af6bda8
- MD5 c55de98acc712c329e88b21cae2ce813
- SHA1 9bdd2b5084fc528afc787a1ea03da077dc6927c1
- SHA512 01659464f81821fa16e4f12a35d97bb25007a7c2c40fcf7fc000ab2f8aad148a50450221b64f509b9350b64395155ac78e30ae8ccb17ac53d2e1633577fe4e31
- TLSH T19C416549F90C54955536528F6793DF05E3B0DFADB312C1A390827FBE4095234FAC7259
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\McAfee\WebAdvisor\logic\logic_loader.luc
- Size 2KB
- SHA256 fd7a916f709d1046ef6491f48b266172161ae36263adf6a448cd7dca55423bba
- MD5 fd0640c569fa56ff14bfdd7dc342cfeb
- SHA1 7b9e757b09613cbaaaa9cbba0a6f0e4bec3c267d
- SHA512 693c394ca1068bf4bf93737656f33ef8499b415655856caec17482c5b21021a1553c91878f5ec44044ff167522666f0bcf4665455976d4df2a835f69e3af4a16
- TLSH T10851756386EC5B222E09E4E39A716D047520A9CF28A10B27D5AD56B020515AFFF723F6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\McAfee\WebAdvisor\mfw\core\class.luc
- Size 656B
- SHA256 7151e08f52ee2f12197ef167e425ecb8f71eae3dbce1d55050474aed801f36ee
- MD5 3e855c4ef0b39f8200de2b70c0fd04d3
- SHA1 880a88291da529c147a22772ba698c34518211d8
- SHA512 b41fc32f5663b3eb7827986db4f5854a5408a636e8235e27e7d5ada5a1c352965af228f148513bf47a764788b04b997cd6c0cb751be8009fd788aced9f9466ba
- TLSH T1AAF0D3AD26DC7157B41EC111449B9D109990DD168F26432B5353C1ADDE33649171FFCD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\McAfee\WebAdvisor\mfw\core\dkjson.luc
- Size 9KB
- SHA256 891a7b9d927bc4912aca3463ef788659330d154c6cd0ac854c183845d89b05d3
- MD5 21c79b28ca14d5d083e7479af9a1c6ec
- SHA1 3f54fa48e61f326eca4a6bc22b5d4d3c66915af5
- SHA512 df4e1b3ade5d2d05f25346c5c3894920a176c18fb87f517272a77558ee5b3239c6b0489e26fbec990b58d5d408c6424787e7e74f60a8931e35657cfe92d0cde7
- SSDEEP 192:jWXBkgh/3g7O7qaNfEyc80vDGwVd4Wog1DYEZpQ7+hC+Tf8IkZ0JOWeV:ckgBGO7q8RcTvf7xNZUq/eV
- TLSH T1C022E91F92C81B57753ED03A9A72CF34A6905C1EFF124F4B612A96B1F55221C9BC638C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\WebAdvisor\mfw\core\logger.luc
- Size 699B
- SHA256 dd4624972533c5a4fe3567465c84000e0437ecc57c86296f36141924936d71a5
- MD5 990847ca884fe1db980501f51b351c7f
- SHA1 14969a692534c14ce576a7907a2813bfc75b3fc1
- SHA512 e5435ade14609e21574ec639eed5887003052ddd4800945e9061a05b73a6a761ccaa5f5a96914f8705f52af7465ab9d14b749ef9dccb9814ccbe3a229d3b6878
- TLSH T1BC01C5062AF9145FC121E74B5415B7D56D30B8867305CB1E460576A506402D1DFD73ED
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\McAfee\WebAdvisor\servicehost.exe
- Size 947KB
- SHA256 33e92f4795fe90989dc739bd645d970ed0345492e48756acef34cfe30fd1eeab
- MD5 a923219b13f4e99fbbddd946f18bd9ba
- SHA1 e61c19190442ef97b9cf0b68439f3407457b9b25
- SHA512 86028026f24095629fdd04e5e6612e4070c74c3a0b932796479e248f99a11cf82c783177b897537af89e04b355bd839cd8890274b85cd18a5e6c5abdcfd31452
- SSDEEP 12288:oJ2ypAo34+GYdD/9vJKztzrfGg/wVMRZGfoYiMUSBedpo/fnyDgN:K2ypA843YbwROkwVMRZg4SBedpuvmE
- TLSH T193257B2FDB9862FDC5B1D2B9C6425A01FA71B40A536165CF07A044A67F7B6E00E7E323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll
- Size 785KB
- SHA256 e81639145340ee162222bb469c459f2098c38844882fbe4016acf2e099e3a3dc
- MD5 28e52c6ccfc7a24269098427256c21fc
- SHA1 2a103fc470e9d8a3180f2dd0980e81c3bfa01a84
- SHA512 c87cddefd71132d56a57f701655d6f0ef25919fb929c32bc7877f679ce82a62ba8ff7159a847d9e09e7689755a83b326c2cf21de79f0ba94b323dfdbc4452b7b
- SSDEEP 12288:gSMUeSJFVwoykQGh5YHWSGBjfWeVoNEOPgdZo:gSbRJFBykQ8YHWvFWeVKEOPgk
- TLSH T1C2056C1A7BAC41B5E1B7C17AC9578A1AF7B278151B319BCF0260826E1F377E50E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
- Size 1KB
- SHA256 1e6b642e8f7fbc9ae19fa942263342ea232b7c8041dbc5582440ab54d2cf81fb
- MD5 ae25f04eb24a94e375ea8c595d8321bc
- SHA1 7e52bd74579d8dab2c318d77fe18781a490797b5
- SHA512 ecb7ddcdaa3bcfe2ce83bfe1434d52fe258def40e7bfa6903935835c9b00ec2adfd1427ea0f7932c8ba6bfca18b748bddb077761eda4613e677cd993c0b13c3b
- TLSH T1042179E53A6C853EB5D2C87896F4897DEC754710AC8BAF30A47D35C4C006DEDD528D92
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
- Size 4KB
- SHA256 89b383c1ead97b9e59e263fed3882af23810a22eb7e9438592c647a421b677b7
- MD5 a682992ea23ba5254ad6e55d5bf8b472
- SHA1 31bb78bac5129395188957913d31f3465fbd2c82
- SHA512 0a364c36de9dc009cef9eb81c10504ac4c085c6389b19550f2fc24d55f19a70ebdc791597b06fc286a74dc6be4a5df7fe926ef39dc04effa96bb1f57c98f1a50
- SSDEEP 48:s9nKgwiFeV7DTW1bjGD8CfHyBW8122zqecyPFJXjms0Bqu:8u
- TLSH T10781399A2AAC493CB5C1CD78ABE58C7ECC654311AD87AF20B8BD7580C155EDD9024EF2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
- Size 5KB
- SHA256 5810b1449f6b2ffac8a3ae224a5b30ea57185a2d58a46943b12a1510a3df55a5
- MD5 51c0ff89a6b3932dbc50a7370f881547
- SHA1 7106cd064d435831153abfa52e10ee6546df90b4
- SHA512 e1d7afe9a3566ae58c321449474fe99d38556496c770f721757052868fb90d5f350ebb4058ca528ca37c0ea4c7b13fab36937e809f55c0b8199a55685179d6d8
- SSDEEP 48:s9nKgwiFeV7DTW1bjGD8CfHyBW8122zqecyPFJXjms0BqrjoRKgwaFsSmmRAmv:8q
- TLSH T1E4C1299A2AAC493CB5C1CD78ABF58C7ED8654711AC87AF20A87D7580C145ADD9024EF2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\McAfee\WebAdvisor\servicehost.exe\log_00200057003F001D0006.txt
- Size 4KB
- SHA256 9c298af5aa81430ce3df6b58ad024e9ef7886a6573b720adacf73a51c80ba388
- MD5 cee467513da5fd74bbd04bac7ab3c503
- SHA1 dccb01c95efb0d987022f5c634e68e031c8943eb
- SHA512 1a342cf2b8f8e6c743ca9bdeac48b9c59d57c8f56edf8ae87152398be7bcb09142b5c37b3126d5cf54efa35d4c3cd5868543d9744e6b923620552bab171af803
- SSDEEP 48:sSnLKDLWifw0RkL6LWJSUhLW6SUfLWWJ7B/LWPSUALWESU0LWdtW6LWt/SUkMLWQ:FeCrEZiV09AuZcC7VxZvi+08
- TLSH T123A137F633ABA41D60538275F2F4C3BAF9B1D294574E6D70212E1929C294F7232ABDC1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 fa2d16add1513050d43527c06e5d6ed4f023524419a98b58d21f4e40b7f0514a
- MD5 99bd4d332bf2eb7f3c584c4870ca3995
- SHA1 3e225e756ee9c138950faf039fb8baa70729a587
- SHA512 b90db2c009dccc671990d87f95c5cc785fac8818062d05524a058690648440a25a27a1cfd1c9545dbfc20c8cf52a32f3ee0a98bc441023c739bccd9af55fdd19
- SSDEEP 12288:ThivdKJSTzg6iR3cv4tIBL2mQv+gcDbgx2D59gL2qWTS:Th8K6iR3cvQW6v+gcDa2D59RqES
- TLSH T17F552700762AC74FC66980325E36D5CCA7707D52EE49AF0372C8973FD576658BAF2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.5MB
- SHA256 6abb6f674a1492386ef1f296eb1c7ccfc3edf654d53692bbeb95174fab861cf6
- MD5 101ad5220259df34bccdf4b454e1ba0e
- SHA1 6a2bbabd6fa0c390aad91010860d7f912d833d5a
- SHA512 425e1b604b43b6f97cf6db1077c0e80f54f3799999a128d9e5c2aaa8a6c80f2739139e69c5039a90387e52bc91742181b2dc1f7ae1eed85cab484a80a3956e7b
- SSDEEP 6144:iotMxeK5j13P3tAooA+NDTSGTdJ4pCX38DFkgSUf3nDWH4sdO1iR9nUxltBvTDlM:dxv0pCX38+gSUfV1iRxD/7Dc9HLu
- TLSH T11375FA406136E38FD1B7607247295B4DABA4EC13B7096F22B3CC493AD86A755B0F93D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\installer.exe
- Size 33.5MB
- SHA256 000e31921a46aa4d198bb6d3ca6c695780ddd4a4aafe0a6909b072a27b056217
- MD5 46e2cd9e7a3224d3e49ff41087495453
- SHA1 a8e24f6a7c421698b80c3543ff6361bb14b9d294
- SHA512 e98046d2f33d0a6e87011f809fb0dedb0c4351053bb150ebf2228e08343da2617413fb9eb6963a567d130eb80e41f1a2edd6f02bfffb75237372197249400fd1
- SSDEEP 786432:4nk9D1uMJGqmZoZ2qiKMXr+qaO+FuUHVzzs/HSba+Eo1jsuN:JsMJ/x2PKMb/aO9UlssPY6
- TLSH T1A077339E616649FBE00648346E14231DE3753D3603855FDFBA98A2AF6EF71900EB7E40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mwa9001.tmp
- Size 135KB
- SHA256 926061fc6a92079aa227cc2e426bd5b2130501422a95e6a8984f15f05dee2e70
- MD5 32528f494643e0e05625d5a5b8e61263
- SHA1 701eb330c5f29b2178c6196404f3bc53e297987e
- SHA512 80979203400fde66bc2f5567c2cc5a60448b8336dca93b8ef7d2d77033a063a9c581b9acdb99f81c1affae5fe159f2b4bc74b842104ffbb05172cb4656ab561b
- SSDEEP 3072:ppIo/Z/nT74FOGNcO7/exDn/1ISZ3kHoh3I42H01Vqx:ppb7tpssD/1IQ332H2Vqx
- TLSH T1FFD38D01B090C072E5BE19390864DF725B7EB874DF906DCB63A50B7A9E703C19E35A7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mwaB4A0.tmp
- Size 173KB
- SHA256 6dd62d41da015e4a1486a8866fcb28ac1209a552be8313dbd63e821cb46811c8
- MD5 6e7f3a7401c7da1e60f5df4531738ab4
- SHA1 fc6305ca9ae4023d45ca8d7e67304f59a8ed2aa7
- SHA512 4f6984e41b17bfe78a8d27c6fae33b3a2f7d8db3479f73ce3a1d42782db7ee029bc44b77cdc3ebe0d046e72a613ccfe406748878d5002e947cfce266cf90af41
- SSDEEP 3072:1WKqE1/0WjsAGX5Gn39yf19led13p9tyDTQrf:1J1MWoAGJqe1neftyP4f
- TLSH T15C045C1BB7A400BBE577D27888930A06F777781107609B9F03A4477A5F27790AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 9e35e428987c61d900be77703452a77c8e47f374b24eb645de1c5d3f1e6ce7e9
- MD5 ea8a73b0ce60d427669f10b29449dc7d
- SHA1 d84a9b36f494244f682d13d08948ccd2c86acd00
- SHA512 f747ba9de2b827602c55adf1a196802a0aac6c1d8bd3492084090054878d553a1d5a978d43c35ef827379fb8050945fd0220db986bd858b35c1db5d245d20d65
- SSDEEP 12288:/07rTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Mn051dckw+1MCO6Wm/zLPFGn8W
- TLSH T176D4230A9B4A0D25C9FB8A310C68A9103348FCBD4B3851FF1D19B78FA3799F64D25B59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 4a3ce1129fb5b0c18eda5860d2e56f0cee4010e52fa477eb1504341b997d4f31
- MD5 dba7d30e7591ae3b0729a805d8f2e9c0
- SHA1 0fae39b490627b82446e7af920e4d0cbb74dc5fd
- SHA512 6e31de584f705ecbd187945a3fc2b00fc6d3820db375bc4f21d49f44e6e2211c57751f59cd104f24b73c547c2841ffaf08c42860b0349d092ecdc9895d0cf952
- SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYB051dckw+1MCO6Wm/zLPFGn8W:Zgb4mBIBhGFC0i/+K6bxW
- TLSH T1AC65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 133313f8a9a9615d59832c004639b5b7cef65b022e17462cf3c0ddb335278c52
- MD5 a227b8adc664351c76c316947511abb2
- SHA1 bde66ef2fbaa73f02c97ac6c11d64c64374fb56d
- SHA512 fe92d4f237b6e0dddd7967db906f8a57d23f72cd0f582b568abcc30a6874563da81e225d796de82e9fcaaf3117d2ce5ad74afe4158758281f3d88a8edc8ba32b
- SSDEEP 24576:zG88u8FpJqH1nzria7/mS051dckw+1MCO6Wm/zLPFGn8W:C7ZFPqV6a7/p0i/+K6bxW
- TLSH T1AD35F16577E101F0D47BD13889864663F6B1B8250374EBDF0BA88B561F23AE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 e53b1cd83ac6824a80d803fe258db0d2b4e35ac661a40d67e0731e6eb5e24ab1
- MD5 d4bfe305870f7da4e5a7d637becf272f
- SHA1 2d4890fc89f3ebda4c53a161499afc0db4c40381
- SHA512 dbfc3bbbb6cef03026e9b73c53096a31b9b3ac657d4661892efccdba4e5a7cbd6055dfff6561df1ed82c8b87d7b14873a481d313c72c4596d9cb67a357d301ef
- SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj20i/+K6bxW:kG05lO43bH/+K6b
- TLSH T197D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23825033556CF02A486A91F27FF4557E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 114e59511ec0b70c8dcbe364bb8955450f206acfc2f738430c3b09b7231ff7d8
- MD5 e39772b513b81ab6818e5c566d14a790
- SHA1 42f928cd8f25f87dac064b60fe8ddf52e4236bae
- SHA512 14aec87c867946c6e1ef107368dcf60a9f6ffcaf528dba2db36e444dedde50961d2a7c340e42d3ce5b960592732ab8489707229e7c79867b5263c9b4217a1788
- SSDEEP 24576:3fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnQ051dckw+1MCO6Wm/zLPFGn8W:Pa5POZ3hJt2pasx2+mO0i/+K6bxW
- TLSH T17A65BF5EA6F801D5D5B9D17DC583460AF5B1342653329BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 04a8be8e5002586aa98546d94ac5506f019d30f25ee70776756e7a5df54db871
- MD5 c6dd43e7f36dad6e53d4e49f9de4bcda
- SHA1 c24285ad0d8ab221cd7b198ec34845804cdca127
- SHA512 a3fd4477f2530df0bbb05f6d1d030a5849d8bdf5f7bcd79ac687ab3dfff842d3fd77ee8de88cffe8816b21d22f98c4f5d67349291e1ba3f3be61ec5bee7b6fd4
- SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7Fkq051dckw+1MCO6Wm/zLPFGn8W:nNc/zEOVHFJ0i/+K6bxW
- TLSH T19D857B1623E901E4E5BBE1BE89779546FAB17869133486CF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 f5df55055250ab245cd9a1b4061d3ae089b7553d8487ff960f0a4e6ec38b1013
- MD5 9b39b5996ea86561908256b90ae2dffc
- SHA1 988d75c930811cc2479cc21f752799aa19f27165
- SHA512 807f6c1053dbd69d616d1de65ded3a8ee4a58cd0aeb778978d6a95b22bc3879e2aa2492051151f2bbdd91cf4367bc992ff1aea1c16ef9a1ecae8934024cb0875
- SSDEEP 24576:LPUr+NQm051dckw+1MCO6Wm/zLPFGn8W:LJQm0i/+K6bxW
- TLSH T10605F11F66AD1CE5E676E13D89818609F771B866031292DF02E0817E4F67EE8BD3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH