1a962760c608e9f45399200ebd6b17d3bb188c5882fda8c5264ce466253eeb71

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Size 1.2MB
Sample260804-ma22hsxfjb
SHA256 1a962760c608e9f45399200ebd6b17d3bb188c5882fda8c5264ce466253eeb71
MD5 ad06d1d7bb84a207bd2e26a985f5cea4
SHA1 5063ce2289c70590b2c0d50a8587adbab585f6ed
SHA512 dc6e2e03441e77c5b6e0e642c4391410351119319dcaf6d379d732d15f0425266d6521e936d8c54d334d9353b25f84aef3828fab23692acf6520569e7f3a9a6c
SSDEEP 24576:rmL3ErH69PeIvHwIFYqByf5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:oEz69THwIdB+5SW6H8DS52tdDpbRZy
TLSH
T10845CF11F3E040B5E5B7263089759A66EB7EBC611E30C64F2764522E6F33B50ED39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5408	elevation_service.exe
3328	elevation_service.exe
5384	maintenanceservice.exe
3332	OSE.EXE
5500	PerceptionSimulationService.exe
4792	perfhost.exe
5576	ReFsDedupSvc.exe
5156	SensorDataService.exe
1372	ssh-agent.exe
4124	AgentService.exe
4224	SearchIndexer.exe
2616	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\739f975b5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\java.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000049065b5efa23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9d5e0a1fa23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1aca55dfa23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fcf675dfa23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063aa155ffa23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.RMP	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\RAMMap.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe\" -o \"%1\""	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\RAMMap.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe\",0"	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\.RMP\ = "RAMMap.Logfile.1"	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\RAMMap.Logfile.1	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\RAMMap.Logfile.1\ = "RAMMap Log File"	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\RAMMap.Logfile.1\shell\open\command	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\RAMMap.Logfile.1\shell	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\RAMMap.Logfile.1\shell\open	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\RAMMap.Logfile.1\DefaultIcon	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
5408	elevation_service.exe
5408	elevation_service.exe
5408	elevation_service.exe
5408	elevation_service.exe
5408	elevation_service.exe
5408	elevation_service.exe
5408	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Token: SeBackupPrivilege	5576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5576	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5576	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5576	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5576	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4124	AgentService.exe
Token: SeBackupPrivilege	5576	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5576	ReFsDedupSvc.exe
Token: 33	4224	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeProfSingleProcessPrivilege	2616	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar64.exe
Token: SeDebugPrivilege	2616	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar64.exe
Token: SeIncreaseQuotaPrivilege	2616	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar64.exe
Token: SeDebugPrivilege	4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Token: SeDebugPrivilege	4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Token: SeDebugPrivilege	4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Token: SeDebugPrivilege	4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
Token: SeDebugPrivilege	5408	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4456	4224	SearchIndexer.exe	101
PID 4632 wrote to memory of 2616	4632	2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe	102
PID 4224 wrote to memory of 2844	4224	SearchIndexer.exe	103
PID 4224 wrote to memory of 988	4224	SearchIndexer.exe	104
PID 4224 wrote to memory of 3372	4224	SearchIndexer.exe	105
PID 4224 wrote to memory of 3544	4224	SearchIndexer.exe	107
PID 4224 wrote to memory of 3896	4224	SearchIndexer.exe	108
PID 4224 wrote to memory of 2428	4224	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar64.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3328

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5384

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3332

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5500

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4792

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5576

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5156

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1372

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9ced7633c26b607b9ff6529d9ff3ce6d9cbaf24b6939489174788908ea5fcc30
MD5 447e2c5daaad90944343c93cc9f9a1cc
SHA1 be8f72b9bb8e3e81795e5e53d14cf32c705e4b2a
SHA512 a7b44b2ffe5b5c1aa55764afa4170f8348cbcc5f8c7d62f9a03abb5910385b09c54a597310fff251b2947706e35801bf03ab54e3f3a5e9021f76ad1c41324ee8
SSDEEP 49152:Xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnw5SW6H8DS52tdDpbRZy:F3q6HjBp5SSDntdDpbRZy
TLSH
T188D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 f773f7c5cc80ef91ebcfecf332cb51671af61b2d15e9efbd860df96de1aa5e88
MD5 e3955a6f704735b8c7ff0461866bc63f
SHA1 b309f030193c736f135fe85ba6739fb83cfc346e
SHA512 eb4409a0446409229832a9b95b04f0a79e72de261f39b0149cfbc4f1937446beb64d5b562689a48f937f8e8d79592d2520d3533c9dd5631f5b3e43ed0f11e58e
SSDEEP 24576:IXYfDtczAV5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:ftc65SW6H8DS52tdDpbRZy
TLSH
T19805022873D008FAED6B8279C8B28511EA33B8954760E79B03F495664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 4f9cfc7e2c8b8e9d5d02bb6d6bd41ef165903de2f044b4019b75ff0e9555a6d4
MD5 d8dd11699d3451a6347f11a85efb0083
SHA1 61e260a0b8c0b2af3587d6d3c952fd6e4c11619e
SHA512 7c7ba217b0a9589e8f081da76186ae08c3d8ba589fba34de8fbb3923b2000f90df5cc1f0fb7338cb1ae9c6521a4d2d1c1225065ddc4b1cd9f1f2b04242cfb7bb
SSDEEP 24576:50Le5ji0hmxirMY5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:5Pji0Acr5SW6H8DS52tdDpbRZy
TLSH
T119359E15F6748332D073C0B9C5D2A69EE97130865B308ACB4296D77C7F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3af3cee506dfdf7c31c37273ab99c5661c3d4372e2e0a828e5c4b2627466d769
MD5 37e4c56993991a40e261468cf701cc14
SHA1 99ffa001a41dc4530ee8f92e68b2aedbf4b54509
SHA512 3aef892bb6b4e951be0aad1007735dca28babf5762456a0be7596355c634c22bfa02423c5ec4e266723a5ec3ff9c5a2a200df1ef28547e86ebd6c470842cb096
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWE6q8wyuq5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:u/ezSC6vUzPvxHjyn5SW6H8DS52tdDpO
TLSH
T188755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4c458b3fd39074e564179211a29fd49db933424e4e3da82922ac8e1ad8371a4e
MD5 dd81482af6d7ba3690bc9f4f72729b57
SHA1 013bfab7b3615ec19b8b9c08537379251c0d6715
SHA512 2834576df9b5463a7ff7efe97663daf13aaa67bd3e2425f7c4fa9d147475fa69fe8cffd42aac8a2e43992236802865aae290c4be8bec57cc74143cab79e918eb
SSDEEP 24576:eVbqPb88hv/l+6Z5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:eVO88hXl+05SW6H8DS52tdDpbRZy
TLSH
T190559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 08f0abbb8e4062b296923562005ba68754531e5e1cdc7d61c0f21ecb797c1b46
MD5 c7f0aa4597b4922be38bf2d79bfa9c92
SHA1 0976348191a95bda481853a3db58f6f356b36bdd
SHA512 56b685274520f1d9eef0f7f70bd7fbce42c501a9e6d4b4cb7b40cea58ae9a50f48965989acca3ed55c88eed503cf56fc9ff0ec7ff07edec5ba7c74e0bc091fc4
SSDEEP 12288:dRs5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6N:dRs5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T128C423C4479030E7E31F0AF3F1FA96D4DA18EDAD8408663B4E717687CA3998BC576426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 fa4ab1b1cbe1dae3ccd55de06178d672baa09c7a79a8010506123367a100b6a0
MD5 f8ee25e9787f7a63c471b6186b5edbec
SHA1 42aafc087990286909fc09609aaad2f92750a810
SHA512 57ff679714d6f4c358cafdafae8d7f5d73f89a4c9513698387cdfaaa8d9f1e84d0759f94d1dc67f89471f1ea9d96d4ed3c035104e250a5fb6be683a5ea571a67
SSDEEP 24576:eJIUB5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:eJIUB5SW6H8DS52tdDpbRZy
TLSH
T1BC05DF7BEE28FCE2C27E4DB956918640D77278704B21A3CBD175820ECE235E54E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7b26a0f5e54848271225f61a142f99fdb90746068460b667a0a46f4f537f8127
MD5 ecdc1b642bb1b2fdf6c55987445c82eb
SHA1 4dce6f443dd0c8d64bec2e1401e05d748b6d2eff
SHA512 4cba3cc334d33604f847502839fa77d8b585ed1cd2601aba01808804e7153543a3e1d405e4374071bbc81c1099ea526dca03bf38820acf8806edb4ad9ae6696a
SSDEEP 98304:XQvGAdlCEL8c/yRNw5Ca5SSDntdDpbRZy:AvyEYc/y3w8gSintdDFRo
TLSH
T1B6267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 78af211745a62fa7c823bc791b9938bdf2dfd328bc20e03d94cb960a44a6167d
MD5 341c05adead1954b3afe06c060de77f4
SHA1 bcc5624bc52e05009f7929c0818a24eb4a0fd19e
SHA512 b886e0b2833501d1444c3a240109bf78842d09458fadbea459716de22379c6568aa2fc98a94462fa74ff5e810b0e5f440a8630cd3a106ad553f5d170ac9dfc6f
SSDEEP 24576:NdewsAjb5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:jljb5SW6H8DS52tdDpbRZy
TLSH
T11D15E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E99342D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 864eb07b5b6d40311ffcd6b51f7fe097513fa2683c42d741a4240552c7c05aed
MD5 faa584660183dc14f6ee9a2e64399e68
SHA1 7b7fd36946fc7a57d608071dd4b057b62c5beb68
SHA512 a4cdf828e6cbad3c00b7dfee0ca9f9e1ba1d3dc3d27b393dbfc0cce44a54b56e58b4170589232b0bdee5c127a6e5e5038f629309f041ff1b6b8e549d452c6387
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHlSintdDFRo:9UEtQevvqc2W1cpV2EI328edDFRo
TLSH
T1D4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 69a61cf652a2b9495e31fbf79bc4fc1e7d9410d00737a79e0a5b4e1985357a86
MD5 1ef61bb5b2d6dfb0cf2fa3b41a4c2e10
SHA1 577bb5e5cf51c4bce723ef0424d98d68db35a015
SHA512 9f7bcec004bae77d7601a3ef64e4db692748b4afced0246546d709a689df17c6dc4b635add7bfe5d707c9e27934881cfe2bcb5069f257535fb06917044650036
SSDEEP 49152:xCbRquA/m2yL5zLfFiV+XenmE3/z75SW6H8DS52tdDpbRZy:+oq2VjnmG5SSDntdDpbRZy
TLSH
T143D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7e55bbea836ba639ca7e66018629e3ec4934467549c549433945809628121d72
MD5 277a9cb57b44e8c3edf3dc81568a0947
SHA1 a14c57612d8f074aef9813cd4152823e6d460085
SHA512 6217fe1582da75af61a6a4bc6bd6bec16ad14c9f271d6e7d32c4f2676824230133cbf7787c62509c4ad4a29a43fbe9aad7563a87fc51a39b2344b961912cb63b
SSDEEP 24576:JAhGLJIFoiwtA5l7S53m5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:JAMyFoiq525SW6H8DS52tdDpbRZy
TLSH
T17835AE80E7F955D4F5B7AAB899B68570EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 663916cd3dc3b469e5224583f7df56ba4a2212b2398ae57ddf26c975f7586aa1
MD5 0d0a960f8990d2eb07d91df862ebf456
SHA1 9fdcb11f7c4a8807558b63466ffadcb1f0f8113f
SHA512 03c7fd5aa813c9fcb122e06b382c9b6e0b8c99fec25f99065f75726646ba243c7d33dd72462d2c4dc9737e905fd83a5ed104e0da2bb38b88a8b089a7a02edae9
SSDEEP 24576:0wuoOWH5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:0wDOS5SW6H8DS52tdDpbRZy
TLSH
T1B105F14533A41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 42a1ee9541f76106e7db6c759b819ee0849ad823e60193086521da0135ea7604
MD5 56ff0344cc08c8ff787998c6d73e39ab
SHA1 05384fd8e470c72b4544c9734a46fe880771e5a0
SHA512 08446613d602a9b6203e6a1361af7aecd0f45994195f2bab6149e0d53a9fa25799cb655bae380c2ea07d4f5d5585622e00090bd0e53deb6e9a8e8cd6625a3a51
SSDEEP 12288:vBZ1IyL5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6U:5Zug5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T10DE4128923E030FBE25B42BAD9F54685D771B4A6533443DF0A60429B5F33AC75E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5cfbe9b874ec3e1a7a1e8a9e49d41bb40fc7f4c0480b2a5d412486d6ba864055
MD5 cc75feed8647dc1bed5f1495e34abc2b
SHA1 77bacaa7d5b6373613ce9168313b9ca784ee3c28
SHA512 f1a9fe8deb91b58c62a2cfc373525ca185560872dd31ed7347e2f13c7f466591158207525ac7dc0a8565470079bea0f6d0c91e021bb6ceaddbf963dc87b0e4da
SSDEEP 98304:dQRQyi36YOcPQLvw2gAf+PN395SSDntdDpbRZy:UQyiKayX+PNfSintdDFRo
TLSH
T1EB667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 84da1cf99b9f4501c22e0e64c122f8bf9624ada7bf8da31738d783343eac0d41
MD5 e73f1ed0bf3026ce726865c1c3bf9a92
SHA1 637968a6137c262b25189beb9f09b88dc3ecf119
SHA512 d552a7940063c9d070fd9b9d03fb26b7406ed58c95398956197cd2c53b6cab6978b573700b656c9ed835c90031caa6f22407e66690e52f9c4ef701c405bad984
SSDEEP 98304:+QRQyi36YOcPQLvw2gAf+PN395SSDntdDpbRZy:lQyiKayX+PNfSintdDFRo
TLSH
T191667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2b274b3fc7eaedfaf132c7e3708fd30682f696a5ae7352fb60e3b1fd303f1ffa
MD5 2f341659ed250bfb75b94a9725193c97
SHA1 bd610643c4d7acd6bcdb28b41ad14de11c0b12b5
SHA512 a0638decc4b8d324fad5b9573d3a9d89cac59c2bb0ece290a2b53a4e85cb8dffbcbc7cfe8f32293533297286ab075529d5f3047c6eb29e8ad793675c481401e6
SSDEEP 49152:p68Qg55nhheWu7PNU3/r5SW6H8DS52tdDpbRZy:3thWRc/r5SSDntdDpbRZy
TLSH
T14CB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 04ea898451722e96847eebaa7e500bb8e11c9786725b9fb8cfa482b45d56e52e
MD5 98e4d5420a829ca10d5b9aa06cba05b7
SHA1 10b048f68bf62023b7ad31bc935511dfe009a898
SHA512 2dc6bbc55ae1108c44202d61da7a95b8cdf152286e82c5d2e32b27c4cfd606fa863850527df9887ba8ae1327b01eaed9836522942c2086aa0f6386cfb9fc5422
SSDEEP 98304:Zy5112gYy5azzVvL69nLKnhZs5SSDntdDpbRZy:0LIHmWhUSintdDFRo
TLSH
T115167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ca867362afda77249e0a6807d5d8378adefb3d6b0f62c0dad48106079981901c
MD5 efe8447370b3a51b494162b084a49c83
SHA1 12954bd6619f80c8cf1b14f82b3d63d7cc65dfd1
SHA512 6049bda0a0dcdc7eb57f18a24b2311cf1ccbca882461e7dc72fa857d69d66ad73d07d1ba6ac676bb12b52ff0ad782374d65fc6f288d23115b0f0636dcecb0ada
SSDEEP 49152:YB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gll5SW6H8DS52tdDpbRZy:yu6JmVxd2dl5SSDntdDpbRZy
TLSH
T112D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f5aad5af2f0546a87bd430b29257f909d38d24135ec552b30886d57d579024d4
MD5 e96090993300743387e3c0c26cc8b2f4
SHA1 5d38cfb94d3e63e2544c41b05c74c37833a22e7c
SHA512 448f61d39075051846e88a8ee9b2a9d6f0a0333d57ca176155e19ebbe07cf6f7b21c6b386d2d2b685b55acbcd4c501db6689f50ad0c8a286e4481c98d0189144
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xh5SW6H8DS52tdDpbRZy:0mifPbRG5SSDntdDpbRZy
TLSH
T140B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5516faca0a600f8586f900f55862fcb79a2365025edc957110c2681d740e9954
MD5 3a07ebe11f19d10ac6c02bd3f08c17f5
SHA1 5d32dfe45ffdc4a75d0b8e1c00ecb07f989a588c
SHA512 94eed462bb301753bfe86656a81a99a579a321da2547cd55e11d0a41eef2d90525365bdc948a19e9236c17d7a6f6303310dd47b3f91c835934a372a3f678245b
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqg5SW6H8DS52tdDpbRZy:S5dKTi61g5SSDntdDpbRZy
TLSH
T184C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 13d8a0d624756f3ded608dde4d4c9b94bd0b06ac0489ae4c093e75525ab8d01c
MD5 0466fabda673f73d651b1faa86e62bf7
SHA1 e8891d301b8f36938068250ff79dc9345e77ab73
SHA512 bab511681ee55a0cf22a39744924c949952e862c00deab1f594f81420c69c0cccdc70e0c76a3778b0c1f9bd4d32a26e4fc330e819d57ce802b8a86ebdf2e889c
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wV5SW6H8DS52tdDpbRZy:3X2iyphy5SSDntdDpbRZy
TLSH
T11B95BE13F2D900E8D05ED175C7568632EA62BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ddc9318127e699e8c5be42fd0b65edffb7092aeca1cee8cd0bb6ea6be01e1975
MD5 82ac5104fef9043605e74728d130d2e9
SHA1 119a05fd858d5f50194b2394471067b1a95e9f34
SHA512 40054fe984749ac6d26a8119123e3daffd05cf5863f608029031ed7a6be86397b2983f4c6121971a42b61b7d3419dea02e5be0e1a64b082aba4d054fc6da46e1
SSDEEP 12288:O05OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow60:O05SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1CEC423C457A121EBE30E0AF3E2F686D4DA0CA5EFD408623B5E716147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 23c8f29efcae854bd88e159d4a84a6a3cf6014da63d2b685af65f6dc62c06890
MD5 388ab3f720010681e9d187709761127b
SHA1 04185bd29b575d672ca1c42b41f91ef42cf90991
SHA512 7371e234e1ef1dd1fd0ed49929f0f467de80be06e2d2468b8ed242c56ee1cd80c0b45fd81d63b18c073a75279c79bed725fd3e8bac3f85ac437e89cde063c18d
SSDEEP 12288:Kf5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow60:Kf5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T122C423C457A121EBE30E0AF3E2F686D4D90CE6EF9408623B5E716147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6499580fa04adfd3224e8110ffebceb73a02a6ce48f1faa69876f52f7cad1f2e
MD5 ab41bba931f0cbdffd1cb0bbad665e77
SHA1 769357b0550f2084b0cafb9dfca1730be7f912d0
SHA512 a77d50950d3959871f6d6f6337752bcb89cff83976a8be24450e5b3b8d906097dcdbb8d989fa9b649f52029f7821a85344af48eaf300854e555dd14d32ac5cbd
SSDEEP 12288:5p5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6G:5p5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T189C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E716147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d008b8dfb55971d4384e622ec45c28baad352b419096dfd180b10631735c51f0
MD5 2aa7c9e8abab4d1fc8e98d6ddcff0e06
SHA1 642e86d607896c1172c12b9145a92ce3fd113805
SHA512 65af188eeff2c7aaf48aa9c105116002d32813627588dbedf24b3273dfa0b69e9dc9eee74c22ccadad33910a76aa651408f5b19a7e39dd9b1b630f6ba0745c9f
SSDEEP 12288:SVG5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6g:n5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T10FD4238017A121E7E61F86F3D1F686D4E628F8EED524637F4F20054B8F31B8B9935A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ea8cb42217a639d9d39e5b1452dbd0c2bb9b964df525a546b3b2f93fc94c5d89
MD5 70815e50f82fa8903145512db728b5c9
SHA1 2433b976a6210c22cc53985ff99fe75a29cc72bc
SHA512 a3288e3286180983da866c3c057ae6f06cb99e982304396d3b4ea5aa9aae47cf3b2fe2070ba11b8da71b27edfa1802e9919fd1ff3f1892925ad9b8b7a3fd8bea
SSDEEP 12288:Z+5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6d:Z+5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T11AC423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 075d35dc190028121d8f98fd884a3a02b4545ccf51931a7a35836f813c12c5d0
MD5 34f886905fc0224a1501ebed273ac563
SHA1 88a6b2d21032285b6adbbbd45f29cadfa7ab3347
SHA512 1c8349dc3dcbc50acb805c4db0caa7b8732d0baf5ade823d1557ac8e1e6e0a77f8d253ad786872cb946ce9dbbd0cbb5411bbc5c1ccd6d5362e6a4916ba93b489
SSDEEP 12288:FD5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6j:FD5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T180C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E715147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 35322a91772b0a6d4e910d605d0a58d40597a517c2bc37403b5915f1d9838966
MD5 928a967f5d61bc5277df7402187424fa
SHA1 660c5a74fa0f06727b37c7323e62e3c66b7b6990
SHA512 3d05348f86ce92e0fb403c03a7d306849b3e809ff3f24625d8d8e1b58dd5a8f2020c951db2d5e431a347786d7944a9dad5921ed31d19d5973b7e5adca59c04c5
SSDEEP 12288:UX5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6L:UX5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1D6C423C457A121EBE30E0AF3E2F686E4D90CA6EFD408623B5E719147DB35D8F4276429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1b34a391d72fde8f28a0f5705bcade654f4652077efe9fa72b876560af2cddd0
MD5 bbdfdaf61974e72beee364a116d6d569
SHA1 b2935ce9f7a37d5d2c654cce53bff00f2bcfd559
SHA512 2f7a0aa9b1c4e49cbb1517ac5daec3c5e7bec994295cc790b6dc8c9a1a06e2d5b2e82d58037e57f00ea0826fdb4155718b9a37acd976b4d0783ad465add67300
SSDEEP 24576:wZMSzFVSO/5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:wZMSzfz5SW6H8DS52tdDpbRZy
TLSH
T10B050294B39018F9EC67823EC9658945D6B2BC5A0760C62F07F436675F333A20D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f1f7190cf56659e4578b1872bb70b513cd43e14bcda172760fa533e5dde6997f
MD5 5447545b7c7a5c8ef7b955384e2c2cea
SHA1 e9c7e689f84cd900ec7fa0a9c6d3a905ffb986ca
SHA512 cfdee33f4e0da87270e765b9c83e0f528cf7ce0388b52663cae3ddd8bef0f0ba50dea6a46ac67048370cca1c3e52b7c0ad2a9fd798d9fa9b91b4183e2176e3c3
SSDEEP 12288:cQ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6b:cQ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15AC423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E715147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 1853d8653519d6dac82cfbfcb7c713acec6f1ea2f46c7b6c537e26b761db47f6
MD5 da442163bbf402cdc460e4b27dc6a5b8
SHA1 025dab81a394f10a61668d9ee5afadc5106aa812
SHA512 68c7c8d81bc2dd41ba9e907e78a76f6cebb984e5c63bbb722c4a16f81aa84d214803cc201408155e6fc2bdb02fb1983e8775e9a6e833547fae58c55cd4c266ae
SSDEEP 12288:ac5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6X:ac5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T105C423C457A121EBE30E0AF3E2F686D4DA0CA6EFD408623B5E715147CB35D8F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 d9eba982ebfb792ece63180601c66b655a4b3b0a8ed281d28e5fa8899b50e23a
MD5 2681a6b185dbcb1abe58981967980fb6
SHA1 711b02d24479a17bfbfbe4c75a13d79502bf46cc
SHA512 3623f68800a4c0fd8758ed39fb4b0e17b9bd3791078cbcaaba5a1da570c053551ef21a7a1879c8670c968ba482c9b5bfd51762d067d58013cc2ed07ad3714510
SSDEEP 12288:gyPz5L8L5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow61:RzyL5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T186F4024773A130FAD12B4276C8A20A41F775B87647249ABF1BA007775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0adec7025f971f831606b1d1529cad1253487cbae05e89460cdf713d02a433de
MD5 3df7d7a84f1c816e466f9767c4e26353
SHA1 52046754c9c5aea456fe28530fb568575368edb8
SHA512 04db6009a5259cd41e782169c827525684a80e619370282fecf97f8b992efe36753f929c9ceb54b2aa0b03b52cad258c7b6beeaa6b3400f32a72f5262e9f2c2e
SSDEEP 12288:aQ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6h:aQ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1F5C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E715147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 b4c0ac4ae7d2d0254ecac152f5396d53aa945fd2d8a2522336e7414ca5371ed3
MD5 a2405973788bb81b312b4b9e716aeba1
SHA1 4da4b29d036060a086d541beaefa740cd46c1a38
SHA512 2ad4c2bfaefec5f3c432f08fd77854ff04ea4f2c49ce0d0f02ca46c037b88c83f300e859f0ea3037fb51a114bf6b1df4bfb63647d5295f80f596a67dedc5082c
SSDEEP 12288:aQ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6h:aQ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T19AC423C457A121EBE30E0AF3E2F686D4D90CA6EF9408623B5E715147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 970ae058b416aebc2098906c391608ea4e533bf5e2bb6fb9b9c29c1535bea636
MD5 7e85e98bffb67380c6f917173d4edc80
SHA1 b17e0395c3d72b3b0e66cd76b86a33887e7fac90
SHA512 88639eba18b262664001ed7ace7d7f0205cced6859ad959e0f7d2225efcc848439b91edcceda98c0a45ad7885049e68299fb87bed2a2bc8f809b28ce64411fa0
SSDEEP 12288:cyPz5L8L5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6R:FzyL5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T142F4024773A130FAD12B4276C8A20A41F775B87647249ABF1BA007775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 eb3a011a28b1ed39d9e2743fe38a3796ae81794d262285aae99ee25f94659aa4
MD5 2cdd1b50ade254a8f7aa93ec2d594236
SHA1 c3c264f23e07511df8d68dc2701e64b55dae7488
SHA512 049509c5ecc7e5bd7b6ac3e9fb0effc3f3ee93d96196a4f2429bd30fc98ab21dd1bea8fd551fa02194be61569938a5fcc3661079ff5ba2cfd1f5a416e43c7206
SSDEEP 24576:RTHaLl3z0zD55SSiVw6uAX8DS52tpz9ZRzbPmSZyo:RT6Lljq5SW6H8DS52tdDpbRZy
TLSH
T181050294B39018F9EC6B827FC9658946D6B2BC5A0760C62F07B436675F333910C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 461f1cc7167b40400e43f502103a6454e37773db4572c7701d3cdb05716cb8d7
MD5 89c0f04726c79c582136a71c0489c907
SHA1 c4db2ea7d925549327451e7aa5f545f84cb0b1b7
SHA512 11358cf0311117af234aac6272ca304c99f7fdbaa8c51e494f7553c0035e2897926ee7047a3836ba287dba43528d0a5b488558a6cec177df479af606a80f46b2
SSDEEP 24576:a37d9CHKy7GZd5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:87d9CHKyaz5SW6H8DS52tdDpbRZy
TLSH
T16725CF90F3E410E9F1B78A75C9768511DA767C9A1B30DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 64276bef7ffa3a9aaff74201826b93075dc58068dca2c99d79b6d50f261a25de
MD5 23f056a93a97d66e2370e375d667a97f
SHA1 26c3c3c0886a14b81a05829463c5ef13c7d997b8
SHA512 767b399963283eedc427b1b57816a83eee4107a48b15c53980a660f89507ffbb2fbbdf72c3dfd7d7fd489a632a7d515d81b16367f04a50c60bcc76764e6720ec
SSDEEP 12288:rJ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6j:rJ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T109C423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 5e55d1f934f7bdeeacfe62e7d80da70a5b0016eebe2b1ae6064e3e5a40aff16b
MD5 68294f21a1ebe75716830afa98453996
SHA1 1afffdb4300ad32f210ddbf2e187212c26a16d12
SHA512 559ebc461666addc8efce2cfb313041ecd2070ce1e6196da7ef5e2940ef7a04e3053a2e613c6a5cc84d33777014be6bc336c78187b8eeebea4a342bcbb13c8d0
SSDEEP 12288:8r5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6b:8r5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T181C423C457A121EBE20E0AF3E1F686D4DA0CA6EFD408623B5E715147CB39D8B8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 eb5b6cc75c22ac86625f27071a146256fc8510a99f75c37f4fb5d9cba16a5902
MD5 93f07340031abd9ebb8fc8ae424deff0
SHA1 32d6b1eb972483cb781872ffa82b94233a466811
SHA512 909eabd47792fc14e213958b2faa91a5d75cfc23ca1caf871eb10faaf317300c1184935fdeadb2aace1f14ae964900122346477fbcd30881d7fbc26d4232626e
SSDEEP 12288:+i5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6f:+i5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T140C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E715147CB39D8F467A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 759c1c9e798ef92a4dc909bbc36eac5d404b3d9ba0a343e3984fd7ae39e218d9
MD5 5edf8f6c18f504b0eb4116e8d19e911c
SHA1 47aa594063ce753ecaa311dbb80d251fa2bf265b
SHA512 be7be4d922273be143addaa7f3a1b17d291d3eab8207b2c56c75622aabbc66166156c14296c60792a8b513cb541c7edcfc96267fc68d9520fc2cdd77e6c54f44
SSDEEP 12288:/Q5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6f:/Q5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T11AC423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E715147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 84bc49f0ae0fbc2010b1de9f9d35da97ac70fb90f056833b603ba9420643d737
MD5 c58022f8f4b89ed6dbf396df2371650e
SHA1 5bd6d58c7ea48cb7299da9437ba74eb8d4190687
SHA512 cfdebaa44b2076cd5632afe5c341cfc35ed530474e85272f4568c21276f2781b72a60ef5adda73e01e13ee5a41e3d9c32de4443bb0524758be4307aebd8e9e1f
SSDEEP 12288:uJ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6r:uJ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1E2C423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E716147CB35D8F867A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 a4b48fbd39e82fa112cbf32c086fb44ad69474aa5e4289cecf6d7967f7539347
MD5 9ca13c9983fbc2d29a81c6e28ca4b612
SHA1 58f2e4ec2498657eb7eb0d04929ea7054fa86129
SHA512 ee8262aae39149652ca5e562e8b8b39fe649087f7794a04d169f362a3ca388aca12541207ab399aab60923a2709f00e269a83dde092166d0a0607ad6c10d480e
SSDEEP 12288:mo5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6U:mo5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T156C423C457A121EBE30E0AF3E2F686E4D90CA6EFD408623B5E715147CB35D8F8676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 484341499d8f923505f44e5b53a335628d2d3a06175630fd863acda5cb2c94ec
MD5 55618a3b460fc09a18681735ab43167e
SHA1 7e0387bf5580994f75132176ec1890909c4e776b
SHA512 1fd6b70348db6a9b286007f4e9e16540b268e3bd7833b0b15b3762ea870e34a073fd46f2031bb21fe1bb33195c3a91bf7b000cf693be8e3ffe6beacdb64fec76
SSDEEP 24576:mfwvok9RX6wkyAIM5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:qMnYIM5SW6H8DS52tdDpbRZy
TLSH
T1CE35D029EBD804E6E177923C99F7460AF6B178691B31C2CF025A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 04537c14513daeaef77f11b47a927f6d186636a99c820741b5903121b8462508
MD5 87fe580cf53cf53061c894b20e768581
SHA1 7e6f4bab1779dab8d6c0b95e7f40b4013d555496
SHA512 d3c1d70696f876e30aaaff6e8ee61f765d85bd608d75b679a6775116a7466d369543125a31e8687cb5caae6649561af6377c6381fda65d448a5b49c16e58a673
SSDEEP 49152:CYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK015SW6H8DS52tK:8ySzPd5SSDntdDpbRZy
TLSH
T135066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a2e16cbe5f3d31a9f1e1e706d7176a7260924069c9c914230a6ca169e3a3749f
MD5 31443745644060dd2824182842f071dc
SHA1 9a90a2bce8796a3c21559ff64547a9141d4cf458
SHA512 ae4ddd1e16dc82e08b366eaa6f4fd24091fea0fa20aa6e7fdfc9ed9dcacc37adf78deac4739991fa20d8a82464bc3ad687b659fc9b6469228eab791623eb7152
SSDEEP 24576:047Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYv5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:047JUQj1irIhCnDHUPfF/l5SW6H8DS5X
TLSH
T1A865AE1DA3EC01E6E1BA927885554A5AEA71742E1F31CACF1270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 06a6e992609e56ab1d0673865ddce5c90fc204267946c03917cd4f9fc2ad5261
MD5 61975828dadad733fada43f44b33b26f
SHA1 2f75db4422bb19bc629e133f8024968b6fbb6c63
SHA512 090921a6da1be7e8b2c61b88c3fbf028d7dfa2372c8fbb17a717333688db11aa03bf98fe5c77fe0a5674bd7996cfe832a2d5058542645ab68a84aca0a6ec5a33
SSDEEP 12288:/Nsfg5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6i:cg5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T10AE4F149D29412EAC02E5276C7A64680F3277C6983E0D3DB5BD0F53E0F366859DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 ce32661189604fc97811ba0ea6ee7a65c7c7540c81760a1ea8903125d52ad16c
MD5 6cbe005fe4f270ba64e55e1657a8e847
SHA1 ad9ead5a49068254f45f8f52cb415704a368b96e
SHA512 ed94e322e977e69333b1069272b388998e2666f613bae4e1809718d016eaf33354dbd598e5ab4d4ffa6222ac587b489a791c9877f1b43e4ec355f4cb3fb631ef
SSDEEP 12288:leuPFU3ffvTqS5WENK6flAyMi0nuLA2rh0Bpkmba:leu9UPfxNjflAPi0nus2F0BJ
TLSH
T146350640762BD78FC6A944321E36D6CCAB70BD01EE059F0772C9473FD576668BAB1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 be603073e0f6c37f2905ca89d6c2129b6bf5ca0a3c53f736e4fb081bea4484e8
MD5 da0d082b4a9c4cd47b5fe4c57e0e9c15
SHA1 fea688c6e721fc274814cbd3aee6461e7e4a76ec
SHA512 a07d316987e4afc3268a31106b0d7e3ad34dbe30a4b64f441929ced2a64df1c51c5febccce7318add3461ee58c438b78b13e46d93b498fcf8e50a7a30dee48f5
SSDEEP 12288:5o65sPgkVUAZz2pPiy24OC+74P1E5qGvTCDkFZ:5o6anz25zVji4NEQXD+Z
TLSH
T10C452A4164A7E75FC9BE9037433686CDBB745C02B7463B0973808A3C986667EF5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar64.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-03_ad06d1d7bb84a207bd2e26a985f5cea4_amadey_avoslocker_cobalt-strike_elex_icedid_luca-stealer_lynx_njrat_vidar64.exe
Size 354KB
SHA256 f80852a5ab710dde6489760b3fba6907ba63a7d9704dd2fc58b387c472541bf0
MD5 633470671cc8035b945f7ccad2cd4024
SHA1 c3807ead9f2081d8d92bf25ec7fdb8a777c837d6
SHA512 c89807e4af79afe5331a2f7a26c178a833eecee2c8c8cc380de01baec9cd1f647e13aa294887788ad87356da3278ebeeefb3dee0bd8f37f135479dd1c022ee33
SSDEEP 6144:LWsH7fIfITRY4Nk2mBaHTnHnMshTZW/BLEKC0dUcu:LLbfIfITRYei0TrhuPu
TLSH
T1E0744C55E3E400F9F5B7A634C9669A06E776BC520B30D64F2364425E2F33B60ED39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3c05414aa1b4d014dd36b0e65ed68bb383f66b7db25d929533172bf48d8d0689
MD5 e4782246a310107bc09224a68663de15
SHA1 8fe6eee7713b122e677044443168f34bbaf1518f
SHA512 7370ae4f3e8a8bb65e6bc174a9df97758d4c87cb82275abd7e5c80200ad54dfbb67315712b940512a423a6505290fd185ac583286022cf500d3eb60a799a6d00
SSDEEP 12288:+F745OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6z:K45SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T104D4238043952597F22E06F3E1FA82B4D60CF5BE8B0491FB9D206287D735DCB8D7651A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e54f546d56bbf9533a3301e0187e6bf44c10cd2c7275d503c7c6989f62c993b0
MD5 3f6ab73f6690c8d7113ffc25a39d017b
SHA1 f2926f51d2691d5d475f585c77c0b16dd826ebca
SHA512 d384f104294b856aeb37fc711f40dee27eaf906891f2264b557db01c21b204d0c09a890fb2e2b9bc9011fad1081ac16deb45378362d8d4b4c400012e20ef1e61
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYq5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:sgb4mBIBhGFv5SW6H8DS52tdDpbRZy
TLSH
T1CF65AF1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 ce6a87abbd266d024360a37de5d87b25343571b86e6f6ea1d35878aed0f2049f
MD5 182c4bca9f125442dcb276f3fc5e5403
SHA1 5c50a8914ff5ea4ed64b403b66febf38bf89d4c9
SHA512 3effb9130a3c75504341b20cdcbe4028e818844d95f462ca560a1c3269f0fcf39d3f0779616c99669d52d9340a354489d1530e2da8943fa86d9d46a538e3396b
SSDEEP 24576:0G88u8FpJqH1bzria7/m/5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:H7ZFPqVea7/C5SW6H8DS52tdDpbRZy
TLSH
T17735F16577E101F1D47BD138899646A3F6B1B4250324EBEF0BA88B521F23AD54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a61d677304132521f5c00f1290f9c4a82ba34446086dd50e663033e6af30c3b7
MD5 f061a82fde0fa473455f121d82416be7
SHA1 8ea52a929a51aa149ac414bc562b836e5543c962
SHA512 427c7290e1ea8d7f64feaa832fa9c604ea45880124a361b43a07b22a2b8fc3945754e482a2189f1635fd877fa1301f0d3aabf217372c2d1834605032bbc690da
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjD5SW6H8DS52tdDpbK:XG05lO43bk5SSDntdDpbRZy
TLSH
T1ADD5CF6A62EC11F9D1BBD17CDAC64A0BEBB23425033456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 128033afc490c3822741cfd371de96812040071b858e853422a2c33303860c26
MD5 7cba31809a02a1e164270e208a3aad3b
SHA1 c0a91a5c7c181047522b0d1d9e3910c963ae3d5a
SHA512 4cd78b435deff38831c2e039e5830c04597a4e337e714716caab1c95b110de0193e06cf0f57196cab00d3eaf6a7c82e9245952332741f45917c4c0557f448010
SSDEEP 24576:xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn15SSiVw6uAX8DS52tpz9ZRzbPmS1:Ra5POZ3+Jt2pasx2+mr5SW6H8DS52td
TLSH
T11B65AF5EA7F801D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a0f5dcdcfe7f4c59c3ad163cc02c25d60ccca7e394793c2088b5e077ca1217bd
MD5 2ac7c372f83ae52a38e8ab829ce82a04
SHA1 9ae59440a94348f0a3d3fdd7994255c3d4116ca4
SHA512 b170346b4c4b83b5d6a4e144b2600e1df89b754db2c056fd8364e03de3b961a89ce78df58fa6ef4ba5420bc9d55f79d74dc97ff57ecdfb1fcb5c5c90d358b6fc
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7Fkn5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:hNc/zEOVHFi5SW6H8DS52tdDpbRZy
TLSH
T18B857B5623E901E4F1BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 07437057380defd8ce41d7cd8759c721c4c09ef21f206cffcd741f8c7c71aa11
MD5 b07885aa99082e43a6d7834b840d6d24
SHA1 27df2a3ab3513d8c3b1bead2f192d4722014b7d7
SHA512 aa4d3e9e386ac41a0e64e708fa8b688cc0c5184921fe678ea5e3f1e6917c17f4292d2064625d1ee36e4c99e88f8d1f4e37b9867a7ea095a9ac68aecd23a9e064
SSDEEP 24576:T8kNvNnaFeYhJNtmZBmx5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:T8MwBtOmx5SW6H8DS52tdDpbRZy
TLSH
T1A555AF6EB6B806E4D1FEC6B5CD238512E6727461073293CB5290C13F4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 fb7fc757a3cbcb7f3a6f741e92c9c408a623a4ef3838e2a4333b4bc2e8e2c5f7
MD5 97156597ecb9c28f249f7ce43e78f7d8
SHA1 b82e2bb2969fd93eeb307abdd707ab74869c4de4
SHA512 6544aa99826d54ed7b5980c8218404ff8a6ceceaaf6642dc00917f6d4caa5ead74bae7dbe88e34bf9cbf3b6c1945725019c7cf3b2e63fb7f2a723150c1f4f02b
SSDEEP 24576:nPUr+NQz5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:nJQz5SW6H8DS52tdDpbRZy
TLSH
T18405F15E22E818E6E67AA17DC5828719F771B4620311D2DF06E0817F4F27ED8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 b49277c49dc9553266ab0d914d7eb02b29b9cdaf40b1a90da1abbde1f063a253
MD5 ffcb6387dbc6645b273afe35ae3ce6ba
SHA1 d1530ef06ec7c88b2b843a584cbcff8a6cbcb703
SHA512 7419e9b2a858fb7515f4c14086dbbc1f4f829342fba74c46eea2ca6a5a0fe0cdce87a0981aa434aeaf403c2cf783521cbcf572088a85b7e50b24e89b744b2c09
SSDEEP 24576:oD3FHshBIYQgAU5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:oDVHeBIAAU5SW6H8DS52tdDpbRZy
TLSH
T1A325E17DE79800E5E57BC1BCD6A38A06E77138AD032166DB06D081B65F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1372-315-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1372-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1372-113-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1372-119-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3328-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3328-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3328-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3328-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3332-59-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3332-52-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3332-175-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3332-53-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3372-331-0x0000013F0CF90000-0x0000013F0D113000-memory.dmp

Download

memory/3372-408-0x0000013F0CF90000-0x0000013F0D113000-memory.dmp

Download

memory/3372-330-0x0000013F0CC00000-0x0000013F0CE8B000-memory.dmp

Download

memory/4124-126-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4124-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4124-135-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4124-132-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4124-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4224-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4224-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4224-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4224-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4632-85-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4632-1-0x0000000002840000-0x00000000028A7000-memory.dmp

Download

memory/4632-8-0x0000000002840000-0x00000000028A7000-memory.dmp

Download

memory/4632-0-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4792-293-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4792-81-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/4792-75-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4792-76-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/5156-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5156-106-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5156-100-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5156-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5156-317-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5156-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5384-38-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5384-44-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5384-48-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5384-37-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5384-50-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5408-19-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5408-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5408-13-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5408-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5500-63-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5500-65-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5500-275-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5500-71-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5576-93-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5576-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5576-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5576-332-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5576-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5576-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download