Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
19 signatures
150 seconds
General
- Target 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 1.6MB
- Sample260415-rmlbragy5j
- SHA256 3761e17f2da52c5a732b8e0e13d0bb733a332753f00379a074cdc77d7ca22d08
- MD5 1c32d3f0e468c18b164546f101e7dee4
- SHA1 332cec5d64eae9cd46e8a7678011e3e03aec184f
- SHA512 2818f40c6d29d620ef78a7e07c2e9692133883b7a8f54c5189f6cfeeb4c09ba85b50bb10df1c57157baaafeef2a17886706f20e3bdd528249b0fce9fee4c499f
- SSDEEP 49152:Zt7Olywel0x2F6rD/sWuLNiXicJFFRGNzj3:POKl0x6iE7wRGpj3
- TLSH T118856B1267F94129F1F37BB1EEB993645A77BC61AE39C50E5280125E0DB4E80DA32733
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Executes dropped EXE 23 IoCs
pid Process 3220 alg.exe 3904 DiagnosticsHub.StandardCollector.Service.exe 4444 fxssvc.exe 4652 elevation_service.exe 4700 elevation_service.exe 4756 maintenanceservice.exe 2868 msdtc.exe 1800 OSE.EXE 3080 PerceptionSimulationService.exe 1516 perfhost.exe 2532 locator.exe 1432 SensorDataService.exe 2032 snmptrap.exe 3192 spectrum.exe 4748 ssh-agent.exe 540 TieringEngineService.exe 4512 AgentService.exe 4204 vds.exe 2984 vssvc.exe 3792 wbengine.exe 2792 WmiApSrv.exe 3608 SearchIndexer.exe 2596 Reader_sl.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\alg.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e1ead9d9c8368bef.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96484\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Reader_sl.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7e36fb3e3ccdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a2fdbb3e3ccdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4dc0ab4e3ccdc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df5a2bb5e3ccdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a76e5ab3e3ccdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a4637b5e3ccdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfc8bcb5e3ccdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3904 DiagnosticsHub.StandardCollector.Service.exe 3904 DiagnosticsHub.StandardCollector.Service.exe 3904 DiagnosticsHub.StandardCollector.Service.exe 3904 DiagnosticsHub.StandardCollector.Service.exe 3904 DiagnosticsHub.StandardCollector.Service.exe 3904 DiagnosticsHub.StandardCollector.Service.exe 3904 DiagnosticsHub.StandardCollector.Service.exe 4652 elevation_service.exe 4652 elevation_service.exe 4652 elevation_service.exe 4652 elevation_service.exe 4652 elevation_service.exe 4652 elevation_service.exe 4652 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 312 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeAuditPrivilege 4444 fxssvc.exe Token: SeRestorePrivilege 540 TieringEngineService.exe Token: SeManageVolumePrivilege 540 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4512 AgentService.exe Token: SeBackupPrivilege 2984 vssvc.exe Token: SeRestorePrivilege 2984 vssvc.exe Token: SeAuditPrivilege 2984 vssvc.exe Token: SeBackupPrivilege 3792 wbengine.exe Token: SeRestorePrivilege 3792 wbengine.exe Token: SeSecurityPrivilege 3792 wbengine.exe Token: 33 3608 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3608 SearchIndexer.exe Token: SeDebugPrivilege 3904 DiagnosticsHub.StandardCollector.Service.exe Token: SeDebugPrivilege 4652 elevation_service.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 312 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3608 wrote to memory of 4124 3608 SearchIndexer.exe 111 PID 3608 wrote to memory of 892 3608 SearchIndexer.exe 112 PID 312 wrote to memory of 2596 312 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 118 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2596
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:3220
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2960
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4652
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4700
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4756
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2868
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1800
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3080
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1516
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2532
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1432
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2032
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3192
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4748
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4868
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:540
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4204
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3792
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2792
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4124
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:892
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 1.3MB
- SHA256 2fb863f2cd663ccc0d79270ed3647066cbb42c2660fff4892681ac503a90d136
- MD5 ebccc15b9ea9b871edc3b0ba3f8c29f5
- SHA1 c418f1f7507191428395f767734536263d6cb535
- SHA512 9d268daf3d4e7dfb0dc5dbe284c437db061386e8f36fd1f737e538002ac656c1bad7239863def6a64144304f4520920c01606de4fdbec351f05582b96bc72626
- SSDEEP 24576:DQ//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s/LNiXicJFFRGNzj3
- TLSH T1F95523932A869B72E9B8003505795A78F0ADDD38DF161AE393003A1F957CBD78E3512F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 9c924a32064a02c4c2f6b97fc58510686da88501b667e9c4140dd32754c97b65
- MD5 31eba9e08d936c7f72e1411f0113972f
- SHA1 383e8a6bddaaf5430f98a2a801fdd730cdb58b23
- SHA512 485fae4f84fc11856079227c39df47df786ef83de3148fde64cf01246cc3d8900f975dd29ede23c97d72cc0ffcdc1441060368ce78249ea7e9d353df79972944
- SSDEEP 49152:Bb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnmLNiXicJFFRGNzj3:H3q6mjBp7wRGpj3
- TLSH T151D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 20740951816d2c80170fff6c41149aaac9dbfb2900bc0caa42647e5c4dc6548a
- MD5 b3f48e7a2293897003a5b231be64d7b7
- SHA1 9ce80a8d40a5de2f5f924d18c6823955899db7c8
- SHA512 260b2be3b15eea3ff26532881ed5d7aebce28758bbbd4fdfa69cad50f86aad3e93dfbfc5b97a3b72869657e4c460c4e1d0e54748f49dd0386b3b6b04448bbcfc
- SSDEEP 24576:WXYfDtczAN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VtcgLNiXicJFFRGNzj3
- TLSH T18475012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 e0b60e7da2205be6ad59774148122b7228d2c14048a1a0500952301d14ab9abc
- MD5 ff8017fa2298cfa6ecead3ef78117858
- SHA1 10173ee5c89a7d37ece80dd9b2ef0a1734c0d544
- SHA512 2953c2759ca23375975608dee4079ee9a869ac93c50050d0e15b65ef6647eea05d1a0e8a6805e8375cec3338044bd32100569131e58507737523d1d7d6ed6a12
- SSDEEP 24576:70Le5ji0hmxhrMu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7Pji0AzjLNiXicJFFRGNzj3
- TLSH T12485AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 ec85ba2a4746a069026639d62f51e3705a64268117795026641bd6ebeff29741
- MD5 a6ff13d426ddaf92f3c04d312c0445db
- SHA1 355e372e98c7ba636a3ecf8ceb4eff70996e3ede
- SHA512 fbc588e82dc0f3c8fabada4e610d001b25cc29009ffcdde8b3d2c13061edd33cdce11832bf32c2eade0ecac870a23cec45b03687e7a8e17313c6fc15f03485be
- SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWj6q8wyuw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a/ezSC6vUzPv+Hjy3LNiXicJFFRGNzj3
- TLSH T124756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 91171f2d51fb0f263ca5b2fffb58a1c495800df2555728bd646c02f6b4f6d20d
- MD5 c7fbb7aaffc19b2a9e3dac60917182f5
- SHA1 9d89a09a53b078d2f16c6dc701331c089149d603
- SHA512 34983ef7f180c44542127ba20d57f10ead0d93f00eda6cf3f9f216df06091ea9a1d9142b0d624f8fb44a5240b34568d69759da6a92beda1c8676d936851b72a2
- SSDEEP 24576:dVbqPb88hv/l+B5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dVO88hXl+DLNiXicJFFRGNzj3
- TLSH T189559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 8076d3df94ad8397d253052caa87a4b015e6b3ff14fa01edecf67a5afcf3a001
- MD5 939ffd3d8a425275e73e0197447ab286
- SHA1 1ea0650987dd2cfbf7b08155e02f07de566928e7
- SHA512 f44f890ec0f1395be6bb9b08b33b664e99de753f70d7021e2add2f89bb7a01883feecff4e22a80d3203c29ba6de710ba40b73db7f6e0510bc0525701ebe2e787
- SSDEEP 24576:4G6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GLNiXicJFFRGNzj3
- TLSH T17A5523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA13CFEBCF39123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 78d9cddbab1fef4650e20de2b231fddd4ba0d2996b812d867e42b6a886671234
- MD5 6f0e8b3f731c4b8fdfaccb1fb1cd8d7d
- SHA1 8db928629d2c4ad351f01d8d01e84e14d2e05401
- SHA512 1adaf47aede4c3552da6d5952556192279216ba06aabaaf8b397f37bf9e09a36475ab450c479158c01e602f730504d5585139dacaa9524d0b9cbf0f930e8d94a
- SSDEEP 24576:iJIUB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iJIUBLNiXicJFFRGNzj3
- TLSH T1E875CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 a74fe292bfbae4f5a699aa774b7a76994612f7a18f34d06da8891ddc8bcfdd08
- MD5 a2a6900b049880c4f062a2f5b5f2b3ae
- SHA1 de01badc050b0457f2e3fc85ed0694f61368939c
- SHA512 b6a097b3ffc2a52eb6bbe9661ef9d25b8a2ac7be5e8ff7647817714a948093fb844f8e7d1d044d313463ad1c221e25f0a2817ca4a2d3f8a7cbc456f68e2c95c7
- SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THB:6QvGAdlCEL8c/WRNw5CA7wRGpj3
- TLSH T11A266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 bf8cee5bdcb7b16d5db904189b9ec6bec703fc7b511b2a2cbaf56d3e55d42018
- MD5 fb5781df557f080351055b2544e5e78b
- SHA1 8a4a84093154322dd47468739b19cd8bf49f8ff9
- SHA512 33d45c32ac3b73198f1bbcc27ebff449f3f2b7dcad499509f91953f43b73a4791243285d6fe9be231866721c01bb288b1477ed92f58154d34606f99d78eb91b8
- SSDEEP 24576:FfewsAjz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZljzLNiXicJFFRGNzj3
- TLSH T11075E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 ac0d5313fcaeee4d887a9b9a95035e3fc596cc6941ea17e13972e8061c8c5b69
- MD5 e3f96d9fbad4bb468ac67752cff59c56
- SHA1 a7302be7834060546fc8dc6231974cbf490dab52
- SHA512 8bb1cd1a5deed2add7640dba727b537d9e23720f2c82cb4b12766a7bca0256200c3de3ef157218256a9be81358ae118f975836c4fd3e502a18d164b172518e44
- SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHPF9:cUEtQevvqc2W1cpV20I3299
- TLSH T1E9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 85fc4fc8bbaf9cf519915fa2a38560eac8b5ccf9bc211b6cfa67e449febda4fd
- MD5 090f549ef6f79c97cc112b7f8b70922a
- SHA1 0d21c21b513403d1e27a4c4a31cdabe9570c4459
- SHA512 25906eccdc54636bd039aeb20851c2a954e0a432141e4bf155d50fd4597da7ca33aecbd8090fcf03ae8a6d3a9d26a2ad93e8edc0fa283677233ccc1dccb87bc7
- SSDEEP 49152:RCbRquA/m2yL5zLfFiV+XenmE3/zTLNiXicJFFRGNzj3:eoq2Vjnmk7wRGpj3
- TLSH T167D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 aab3fc75498a6888d26ebda9ff1792823f2530b19ddfe9c5c8b964a030ef4749
- MD5 4c14a774dfd0d755443fd04606869b0d
- SHA1 9ea173192b8d10a37a0c77030577ed3a0c626af6
- SHA512 aae9e0f2bbd639639a56549e02d4158aa537bca9173880681ac2b0d11415423ef50f678db8210e4e2ccd616121899feed296faea81619237ce3e89800ed56387
- SSDEEP 24576:7AhGL6IFoiwtA5l7S53E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7AM5Foiq50LNiXicJFFRGNzj3
- TLSH T1E5359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 2da0f51e8491270142bd8e0f2601a1dd016044478aa01ab0d4c48cae5c776ab6
- MD5 6a7be3c3654c1dacd46486ab4a107dde
- SHA1 06677e3571144dc533d8837bcbad8debbe5b4d9b
- SHA512 04690f64eb1d9a47f6c1224ad5bc37fc851711296a85b06f02c789e3b3cc4962829501712b8fd1abdc4a192bb7685556e9ff0655dcdf5e6f13f285d05e5f971c
- SSDEEP 24576:LwuROWX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LwSO4LNiXicJFFRGNzj3
- TLSH T18165F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 f8603b2a1f0d159de3fe4d1e58b240924991cbf96fddfa123df9ed22839bcd39
- MD5 f107a148c359c6f04063b58d234d5e74
- SHA1 dcd28b61b8b60e2270816565f79c2ee1f7b49a30
- SHA512 49e68ee3180554e7ae6f55c8f88e727db1b86be10965d82a61b6ad853feab7de25802851396a313193301b5469e6f2d3cdca0cceeda632cd3c9d2d7bc6ecc197
- SSDEEP 24576:/Zu2/TwSfVcYG3K/cJHlnFR+IGNe8j3IzW:7LNiXicJFFRGNzj3
- TLSH T16A55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 324ed2f0a2361882aaa4bd46c7e5cd4ed47818c9cad66d380db083ce3dba962d
- MD5 7c7a93651e6f189a65c189771783c7de
- SHA1 93a7931fb4e21c252d42e55979a69540e896cbc3
- SHA512 6a7142f13cad15099e3ed83dd32cc249e9580dbcd4a93f3f5b2cdcc1ffa506880ae123b6dc2c3c88a90d87968d815e447344d840b2fdaac05b443b57488d3bf2
- SSDEEP 98304:/QRQyi36YOcPDLvw2gAf+PN317wRGpj3:OQyiKanX+PNZF9
- TLSH T190667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 a27f5360a50179b653b5ffdbbb8f84ea9bbdb091f2c8532284f536a8b3b4c68d
- MD5 ec667b37210a86457d0bd84995302d0a
- SHA1 8566b84e49168afa0493a2660f27f84315fedfca
- SHA512 453b04384f56dc5f401167e99c343bc11f5652ee64e03497c986cbebb4f5ab365fe039fc2db3f6f0e3f7321f7430b70c08255a049bfdc0d7cd7b7b12817b5122
- SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN317wRGpj3:qQyiKanX+PNZF9
- TLSH T162667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 90fdc60a32a4b995fd66acf1f77527bcd1c014ebbd4a634c7919c2f2dfed6da5
- MD5 d5cdc852514944366982eb1f70b4c087
- SHA1 1f18c8c490ab06b9638d708c4f7384a0c59b0703
- SHA512 0950d6dedd4bb1fc891f8d7798acfb9415bc53a3f34d0248a69e6f4f9690d699efb4f0bd4f41cf9c02f0c3374757b70ed10aca9378732156679504de9613877b
- SSDEEP 49152:c68Qg55nhkeWu7PNU3/jLNiXicJFFRGNzj3:WthTRc/j7wRGpj3
- TLSH T119B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 ed988625e72bc8b01887a5eba7128c042c3a5c6493d65676fcf2211edce1c7d9
- MD5 4e49fca32bad4d1d55b97cd9f474efb0
- SHA1 fefffb4ac3c811a572e0d911980b3753fbfc838a
- SHA512 11a029bfbf6913e3f9680eee07ed25393c17ec47d12c9fc0ca86b10cd4c92f3db4ea813f9ccfabbe226536351e75e5e526475a2bfec45372fb938abb1bac9b6d
- SSDEEP 98304:xy5112gYy5azzVvU69nLKnhZ67wRGpj3:MLIHRWhYF9
- TLSH T16A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 b3dc73c021798def17b492f165f67e1944a8d737b4ae8eab96eb51afca3b4179
- MD5 66a3bdcfda5ed74e6af10c12df7d06c7
- SHA1 1936d968a28f9bb169706d92b9638d894843aee1
- SHA512 6bccc4a1b0c517c4a906f54c43779dca4ca4d479c831beb9685f057440e378f1009529be6a77206bbbada349fa8ae3ecb6db0120df34a2359a20e664cf8bcf15
- SSDEEP 49152:rB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl9LNiXicJFFRGNzj3:9u6JmIxd2d97wRGpj3
- TLSH T19CD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 a887e22ee8875f145ddd635d55c95feb8f009f5c9720084c90c4ce331b1a6a90
- MD5 31656d1edb143cc6700b90c6d7cb412a
- SHA1 991983daf340f88c263a5f08cf992f713b8e9edd
- SHA512 131483b54247a86a87850e0025749b2f44980bf7422c7f48b020a4b624176c93c579408bb6c0b7055968c406e511cb699c6f785c78bb1997b102b43e7ec84c94
- SSDEEP 49152:t1hpsNoJpF1A67U44CwH7R4xhLNiXicJFFRGNzj3:tmifPqRk7wRGpj3
- TLSH T1E4B5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 140a252e6b9cf2e022b3ddc67b9843a596c56a21e0672570a1741a65dc53db5c
- MD5 0db50f115f67e4f5923b4ad35aefb133
- SHA1 78e3bd249d34345963a5efa17c9d5550283d3e9c
- SHA512 aed154862a91d5193d593c9b2575de1ab8177b286e8ed4ada92fc9af2c00729a71addf82930f9e26bd0840612d383f85e533f6e24a70a707a1c92d3f3f6f6548
- SSDEEP 49152:4SuZQIY0Be2KkRVtOnks6NMHq2LNiXicJFFRGNzj3:i5dKqi6127wRGpj3
- TLSH T111C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 9bc0e05bc13ec324113f1baaaa6e4e8ae4aea3d4d3e8a3c4e3d3f41148867da0
- MD5 b8f8163a10062bbfe0feefc971d68acf
- SHA1 9f34f07f6f4342b2cfe4ca0d33fa1c36c6a92c59
- SHA512 4d2f95779c6404280ba5c81ed6a99c5ac74f2f933978b7508eb346a9a324f6ce9bfa47cde5c95c5e7d3abf0c35caffb29c0a9a0fb0bc35a56c99d7a880922254
- SSDEEP 49152:3htSn8EApI0figjgiDn0AP5wNLNiXicJFFRGNzj3:mX2iWphY7wRGpj3
- TLSH T1F795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 6e7e2c53abeaa03b1d80f6e632c700e2edb3a2682a4a70d9f4ac12f804d27b31
- MD5 5f3c1e7e101a54fda8e63411c7eb1a28
- SHA1 e4a3792d455a14c4a477e5209947185e019c71f1
- SHA512 6070ac26e3f84178abff1021e77fc8256ec3f599d8fbd629e88e9f378a5e8b6420a235d783ebb1bc564008f61edded326feeab990640d7a33fd6781677d95497
- SSDEEP 12288:bFeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1605523D3558955B1FAFC003AC6754428F5881E2DEB5619E3E3083D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 6650dce7c6aa7e8452300ec1816ddf9e56932028af6d6074014bfd9d4a08ef43
- MD5 82087ed524d6485685fc003e686fe0e0
- SHA1 54f48c8303e9c1dcd74c2219861ccf33a91381a5
- SHA512 5ea52417c54005ca1bfed91e2cadf80816d5f502b06d898eb55e51de7c22055fa8fb70a342e95abaf89f587c18dedccb3606a89b9e31204696aab9566bdeb466
- SSDEEP 12288:OkeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1F95523D3548955B1FABC003AC6754428F5885E2DEB5619E3E3083D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 7de0d9da2e8e308b1b4a29e014a61d55c5d9efc5370085ff603c49752ba6df77
- MD5 6ad7d1b89f43ab0840bbb8f2a754dfdc
- SHA1 34e353c6d3a17a64259e908bacba1a6bce6a55c7
- SHA512 e3983cec6a75fcbc225e832ea848663e3020afda42dfa6c3bf1ad744fedf01aa12eb9a6ccdca05eedd58bd38715b963d84f61b8b9f5977c7363a0a949ba95d94
- SSDEEP 12288:zKeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T19F5523D3548955B1F6FC003AC6764428F5881E2DEB5619E3E2443D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 b8117aaee2a7aed1772e3b8ec07d88f57b52ba97c1d49db61aa541187d8d322f
- MD5 253d74f4946d55e8fdbef628a7cda033
- SHA1 1b8e063502c6afea0fe4d5d55e3727c33fd16931
- SHA512 f172bffaa4f98d6e484a1b99795b60c9135b14cd5f2061745dd4ccd5ae9ae517a35e5fcf3b6aabbb3893541fb83475caf94e995b9ae1b743ab3a5fadf43a4c56
- SSDEEP 12288:2VLeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T17F552393168901F1E9BD8039C6764424F2947D6CD7325AEBD3003D1E5A74FDADF38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 899e52d91fc9c1e81087dd109fc1d80d5f706ca6103a8089751d84f140e7eeee
- MD5 6e088b848bf1fa20691089814aac6f05
- SHA1 41e1edb06a87ab9ca9cf0d04bed9468781f98b2d
- SHA512 9291162e307a143c2301af3da6a4284021a4fef80cf5884adc4c74de92ec2dab7efe6fac7082774108189f5d1cb744fbcb600e0199d5275a71a28f4bf0137b1d
- SSDEEP 12288:6TeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1255523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 a45c01848e7fd1c7f121290e5af7746efb692e40e49d3223f7b4bea0f37a6128
- MD5 c81535620474fe78d82ea46672a9b02b
- SHA1 138d2914a75666d6198f9712a3c4ff9dd0166103
- SHA512 526de2afc8c1b8322fbab011f21bb378401f454495beadcade258b35c0e1bf1f073bff9f3aa2522bc6f361bb5809b9848788e782b174a55b974a29c82f621727
- SSDEEP 12288:MIeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1995523D3548955B1FABC003986754428F5886E2DEB5619E3E2083D1EE278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 79a8459541e2a11932c0ac6a07335176829a4a18f078ef88e7413736f0d037d4
- MD5 6680f7a10e944fd5f52a81727b69dfd9
- SHA1 34d4e506080277b07940cd511a11123bbe2b63ef
- SHA512 106f3f8554a1245f79d91a3d75080605987bed9d86f1e9d7d69f9920df1930c82bdb160f7b6e835b2622f68170ae3198751bb918820a221ff89c4932f7bc7a6b
- SSDEEP 12288:oMeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1005523D3548955B1FABC003986354428F5882E2DEB5659E3E3083D1EE278FEB9F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 6fb28e7df95d22031e8292b16eb93be44885a8bb547610c72c9cbead1bd65af7
- MD5 e85ce6055bf758828a5119bab961ebbf
- SHA1 097b553893f1148c6a8a2e7455f6e95c1800c9ad
- SHA512 3bb71f09c6690c06b327674cbe5683123563488029343c955209355789af840ac9664ab329e7f222723fff5f7f84632c36e4b32c447d6ebfd3ec763c543862d8
- SSDEEP 24576:VZM3zFVSOv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VZM3zfLLNiXicJFFRGNzj3
- TLSH T193750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 b4370e37bcff832052a6298760344cedb91aa564328c2b57b70f86d5a00e022b
- MD5 c3160db717851e1313bfb21dc96cdc66
- SHA1 d5d75e3ecce3ce9c600b6fdc974565a6cc50df6b
- SHA512 1e403eb2b9a54d77040aac4541488b01f387a9f1995538decf0ce6e6f619f03349b6245a24629d85cf104d6325e32be57242c28f70508cc0b6416ee2b674364a
- SSDEEP 12288:ExeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T18E5523D3548955B1FAFC0039C6764428F5885E2DEB5619E3E2083D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 e0c250a45b5093228b8b69b8c61d0ab1f6106fa8a1a72cc7941b430478d80776
- MD5 5c46800a5cf5dee53a900a6bfb19b551
- SHA1 e1ef0799af451bdd18cf764f3f3d17277612649e
- SHA512 7b8ed6366707fa65fa88374da112d10109813c2aed8276c10b1ca4bfd98009e5c1a220f6888a375917349d7d521ffddb0f75c299a59642429e6b87ddc6fdc229
- SSDEEP 12288:T9eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1CF5523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 f0a156e23558c3fa6bd677d91f195f36b9ba07f7c2fce51b4ef9428803374a59
- MD5 5a70eafd4f7a7427379b2dffeaa59c95
- SHA1 9191670fee45d841adf3741b5efb17336e2bac2a
- SHA512 4823656a3ee0a9b4009537c582b7746df95f2393279402848bbb31a0e52bb190807be43b77a65f574e3edbff33afa39221092d86c91b3213868b07d8fb741092
- SSDEEP 24576:0zyD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0YLNiXicJFFRGNzj3
- TLSH T13C650247729530F9E17A4139C9620915F3717C364B208AEF53641A7A2F37BE19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 3e3525fe05d6cb1af3082a37eff197ef89bf2812d55520c279b9c52289e9bc09
- MD5 910ab9aee6a4600a70bd4472079eb0b5
- SHA1 4447012bb7fc61ea772ec58fbe2f01d7f4a444fa
- SHA512 f3d178c28290ffda5b7c6dd7548d555540e989e120b5f9919bdeafd1164251ec21dbfcd81fcce561c3c3b6c87c0d5b62cc16258b946b43407ebe5ac445f76f95
- SSDEEP 24576:OcP4mcvIjkGOxhKP2l71nNKbrh/8KBe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pP4m4IpOO67W8KALNiXicJFFRGNzj3
- TLSH T19765AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 3796845b0007228f50197af5eb921922038fd5156095f3f687f1d389fd3e0d92
- MD5 d51afc074678c2f891916bcdebc45ae4
- SHA1 538c247e174a974dbe462c0d13b2e3707e58232e
- SHA512 6c4332d94618cc54ac2eee5ab2068cee5b5425d32abf10550f46fe3d81c130f985b69128bd70709ef816b2461b0c754d4c307ed8218e4dae6fe063d0216869c7
- SSDEEP 12288:jpsfheiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1F565F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\ARM\ArmReport.ini
- Size 746B
- SHA256 d33f7174ff6e717d72bfb38cf92e25135823d3d02273bf3f575f95d2afdc12dc
- MD5 5757246b0746f04f7c6c7685c433d80f
- SHA1 910a75876285c35fe0fa03c11f36257aeba8a2b3
- SHA512 8f2f3642154d4f016f7679567cc5879e8d4a794a07b62b9663905406a77aebb111b04032353588719a631d9e5223acf543499ef7f7b36e0e15ec966c638219f4
- TLSH T1530178831AE91160F1B25F45EFF9907357327CA35C2DC86C90D8420E89E1A80E5B2BBB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
- Size 251KB
- SHA256 fca76f0688d1e64392dcf74a83fedd18d402ce4faf80572d65bc2c0a3947362f
- MD5 1e2e855388fae67e8242ff4482f75b2d
- SHA1 c7cf193170e91382a8c3ef26a81389042f5bb95a
- SHA512 05674178115c2f921a3dc767afd16b0e269ed61ccf75f521ebe359fcebfbb44888344ae526f8c4ce05a6811ff959145ab6e5f96650bccf8c870732f0d440fd89
- SSDEEP 3072:wT4DJAlCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549XHmYPCjTMNro0Jnxu4Fn:xgUzH5
- TLSH T18444E44263FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\e1ead9d9c8368bef.bin
- Size 12KB
- SHA256 9bfacc36598a78983d937dbd6dd6b0957abb1bec8c6eff6597ff08ba7c53d7d8
- MD5 8fae2907f108182b3c2fb7c47d7642ca
- SHA1 a537d7594936d59295fe370877af05d7a7f90ca1
- SHA512 6dcec26d24928042b345a0f93aa08abcf5a61fd96ad86b0ae10560fb84166e06abdf29d3573fcc2f3d3f9624f23c4da84c68605ba18369b75893b8867e60738c
- SSDEEP 384:5p0tSqXFPSu/bNyc9LSv/mJJe1mtMwHPq:5uXFSoySLeFf
- TLSH T13242C0B1CA0B1511BA841FEB53EB44BE6F4B88079BCBC7D4772C5E0844C87123AE2A57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 218521866add6d2f331a86de5f71d21869dccd116a161dc0846008c82c59e854
- MD5 a8e199b2ecce9d6c2bb16c52b23237a2
- SHA1 aca42e0b44010abae9824c522443b07bc189afdc
- SHA512 30fb8df3c759685b8c9697f9cc4412947f3d9dbf872a11653885afe1c79962430f382e6d09f7c416a12fed2b27751b40befbab839edcf2272d8b7a36e815bc90
- SSDEEP 12288:ABeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T197552393968C5562FAFD103985368438B5497E3C9F5598D3E2043A1EA238FEBCF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 84ba68c1ebcd65096217d1e2fad32a474718418e7a02ebeccbf839cd0bc4993f
- MD5 6d7ec18bbcd12ed6c0f48b16dee74acf
- SHA1 052f0cd5241c218df82a71a691e7b18d9ced6e9d
- SHA512 d8220128f27aa137edb5cdd211cf6b3324ca83c093355a47f6dfd9874c470af911816dd0b68b62fa209827986497c0a7311cc66a0e68270785d164c85796fb42
- SSDEEP 49152:Ba0h2GEkuAe73q3pp46zwwQcLNiXicJFFRGNzj3:Ba0hNYG4Jwr7wRGpj3
- TLSH T1EE85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 b46e1ef144186b124ce79bce5a9a33ae1513504b4ae16bdcee31b550d81a6628
- MD5 e0054b440b7b63d69544e8c69d303351
- SHA1 f0036a1c15041fc4c5d68194e1fa05ec1a4a46ff
- SHA512 a4b2e0b4e55253682f7c323606cffb9dfd320cbb6ec863f47a3928f416ae643ace629fb5201c100107ed616d22f7a925dab64fc14cbbec09e4ae61832d0383dd
- SSDEEP 24576:YhbHjP//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YhbHjHLNiXicJFFRGNzj3
- TLSH T12D5512BE129C20E5F6B5903D86668409D370BC29172197EF6381523E4F3BFE94E38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 f95645455f2e3e89232afb6ba94091c1e1e2f407eed22acdde6321a0219c9e8f
- MD5 45f035245f6faacedc6f4b64d6afc439
- SHA1 a78d7f68448cb6e29a02d7a4d4cc6745774da08e
- SHA512 e1fa9069c7ca0a0cae1222b61a894edd831003de50446aba14039b292467408feebe3ed2bc5fdbbc44a97de1b350c2e986522f77eeb620ecd76223fd79334dc8
- SSDEEP 24576:D3YgnJcRTk4yti+R5dBR/X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DIgnaTk46pBR/XLNiXicJFFRGNzj3
- TLSH T19845B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 e81a1dc1dda2cebed44c9fb7418afc9eeb678e522e36184a7cce954a949a7dc4
- MD5 0910531e538312f7ca99eab9e37ab60f
- SHA1 357750e59220c8b391efbf7210bb289b977f238a
- SHA512 03cefe34823321bdb855cae5c0c4646ab38bf9fb1b5cd9f45df4bef657e48806023cf9642e4198b759b4c8a4ddc1f0568d9bb7eb42acf93959c122926a5a8583
- SSDEEP 12288:5NeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T18A5523D2518959B1EAFD003E86764428B5446F2C9B2619E3E1543D1EE27CFEFCF38162
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 ebec89c305ea36609500e1fc86b7a8714771cb41bf8198179098781f757207fd
- MD5 12b4d77b06732a92f02c368b3f88bfbc
- SHA1 e5d16a613c0a61180fd7c339932dfa9096826d3d
- SHA512 7fd582a0908d605d69e646d17e720e55f9513198863b75128e479dddb97aee66d23cf9cba310b6a02c939e7f5552b311fc4696101f6537128687b202767e71d3
- SSDEEP 24576:5AL3UTN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5AL3UBLNiXicJFFRGNzj3
- TLSH T16C750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 6b5785e1428ddbf43279426c6c9a4621cf2403817f0268bc7465c3087f2cb4fc
- MD5 71e311a99a9614a9a9cbd92f23b18dbe
- SHA1 ffabace102fedf9431b124d714c28301b3406367
- SHA512 2032151d40a29989d5d9ec9a8d88d3e87b8b6cf0df1a4d8defcf32e2ec7380511c585096a12ee61a1a50526dd4ca26866815ca60ce12be61e6336686f52c894d
- SSDEEP 24576:8Oh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8OhLNiXicJFFRGNzj3
- TLSH T1FA55126A32DC10F5E579903D8AA2820CE371BC29072257EF4290517E5F77FF89D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 838b9efe7ebd9666666de9ddbbe61a20cd18a4da7b0335b804f63064bfbe7c35
- MD5 d3f0655236c955aa60809c7cd36aa735
- SHA1 229daf676e5642871c793403022dc45cc93a76e3
- SHA512 a3615fef678f5b8ef9dc41d0d944a827fddae9cb47e11affdfc7dbb41e5e44c585d973ec5f29e73cdfb75e1afca5aa856c4e6d10c6bba2944d40b97e429897d8
- SSDEEP 24576:C7NM9YqZqmWMUkPjZM48Mv6bEhsG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:C7cBWMpPjN8DbEhfLNiXicJFFRGNzj3
- TLSH T1DD65AE2E6BEC81E5D476D13DC9A28205F6F1B8611B318ACB5162833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 ffcc0498a83b61f6f9e9c9c9445096d7e3984442e14600e0536d837b9b3e169f
- MD5 8063e162008f8eb5df6da15e94cf643b
- SHA1 24fe5cdcd4827b2e59cf4d9355fb9548fe7870a7
- SHA512 276e56e33fd5ae638c0a0fd685c19128dcaa7d06ee34bb3970cd7e934745805083bd08ff595a9e325898d11adda2eb2ce75d920d65360354066ef91233a60abf
- SSDEEP 49152:mF2YuHNETovAvNYf8kmmLNiXicJFFRGNzj3:n6BCf8kh7wRGpj3
- TLSH T191858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 d90023c9fc7d9e2f6cd65ffb1e5810fb8fdd9df1c44e3138d801b58c09c883fd
- MD5 704c06aedac20cd9aa846188b1c909d8
- SHA1 85e85b9845ed9bc5f558b4e6a72144419011fd3d
- SHA512 91ae846b50a8bcdb735f32d9a78a3dc5cc07d6bee615cebb4009de58dfb252283633be9c03733d8843d8058f71504d9c723ce2a9c0d4aeb523e4a14de0548c99
- SSDEEP 24576:EAFs06+Omlf8NXEbToV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JFs060loXu8LNiXicJFFRGNzj3
- TLSH T11565BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 b18a42108955b10514c227c1c086021f8d24e3c0e23116ab607c9f08a2821419
- MD5 a1e41c699c9b5850bacdede952d4992e
- SHA1 bc754b484ae7ae44cbc6b88f9a49b8e4ea0cc311
- SHA512 321a88dd0d9af5ae2d830b0cb7e24a555c08a4386b9785915f0bdb00f40a349c56d00533571754fdd6519ed8c5030e3f5706417e01bae4e7767ade2520dee8ac
- SSDEEP 24576:eJnJ5D3WX8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eJnJ5DGX8LNiXicJFFRGNzj3
- TLSH T14875D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 f51b9a8c6f8b3489fc78e9854c3969223a071ea393523ce40e1a37473f8d904f
- MD5 c990324df4e2778a376b89bed4047be3
- SHA1 c7eb3c266754431f7569a23dec1a9a02fa92c550
- SHA512 8054ca64ef0bd5cc2bf2ba5575631497a3aba1b59776ebc99d55d75cda2183984817383abc7cadea691cf81086611a7f3cdd124669aac15d6fb08a234d24d075
- SSDEEP 49152:3g06DIKdwc+eQnSt65aViLNiXicJFFRGNzj3:wo7wRGpj3
- TLSH T1FF956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 e629192a21a3d6af123b5c420ddda9996ccc3a94583070214e403befcaa548ef
- MD5 41e2b04825810fdbe3921247e09d37fe
- SHA1 f69db7af3a889fc7878c53be33228dd4dd3c5905
- SHA512 1811fd4a59422e7c36cff0edc74cd84356106875009b7140026ae2d70442d82af7c1f6fdd7d13b98915c7a884812fc5180dea8e3d15f53e4b07473c0a33b799f
- SSDEEP 24576:unQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:unQLNiXicJFFRGNzj3
- TLSH T1635512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 3c5195475c70bffe84f6812ee33624f1ae50f36ea36081a41c01ced0042f5aa6
- MD5 035c013f9e5bb6cbd5e15e9bacf80511
- SHA1 ea32c4b3ede7883057ba2dec549d9f40787223ef
- SHA512 722b84e6f4143c8a6aededaab4c96f1ca96f252cd00aaee5146629633d0b588f5cb93136a1d33221adde39fe6d2408d82d125ddc1ea9722e4eb5dec8e84e5385
- SSDEEP 24576:eIyP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eIsLNiXicJFFRGNzj3
- TLSH T1E8651245538850E5EAB9013CCA738164EA74BC349F2156EF9180BA3FAF36FD59E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 e78f89fb91551dda37e7d9e0d6dad64be48a9a7cdc29188d3b5ed6d36e2d76fc
- MD5 f22577e424160fd84865b55256613d8f
- SHA1 b321e813aafe676187438da3be03876bf4a8155a
- SHA512 2cd8540818a9634ad1d5456d7ff8436cb115ef73954d9db56ad2f81848be39ee0bb9f14abfa5e46f67ffc38ea61b26eae3ca88a76dec624ae60caffb01c0428c
- SSDEEP 12288:9yieiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1BD55239A118965B1FABD003D86364824F1543E3C9B2628F7A194793ED339FDBDF38852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 cc8deed0b51e36483daa055e3b4cadff61ea3756b85df90b5481b71baeb2a366
- MD5 888508fac7b911d72fcbc70433c3c7f9
- SHA1 72ef59195dd8976ae35a5577dfb57d807bef15ed
- SHA512 749b5c7f8aa0fca63ed97fbc241ad60ea0c8dd324ec6e1fbd0e05a54f87c778b694caebb70d5fd2998de43ff2eda2e9feaf597517c43e1b85d4d579447bde119
- SSDEEP 24576:VQ9MxZKdcz9dw3O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VVKZOLNiXicJFFRGNzj3
- TLSH T16A558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 3e78141ad66318831d40c27401ecfb2310448a944e3e3356d32168db4360eb88
- MD5 699f39da74e12f80e2b82208384d5870
- SHA1 ff6eebe35fa0ee8f55509ce524c9a31c067a3d58
- SHA512 c7c69218bdd318c94bd40aca7e1183263b7d62b9bd9669f80fd2802313b3bf9f8e4cc26e52cc41ec18977b7ac4ac070912984cd0825fd1b98813c6431f4e1fa0
- SSDEEP 24576:zyocDApz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WocDApzLNiXicJFFRGNzj3
- TLSH T1AC65E05FB76D40A2E176813C89858204E773B4345B6257CB6291C73D8F37AE9BE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 d694306fb0630dc5570ebf90e777cbbea9f0193f0a966d259a1df44b0fbbc16f
- MD5 e27af36bcfb3e0d974f975f5897ca8c2
- SHA1 4f84b2de3a519fc1ce4ad07cfa9fa2bd839d25c6
- SHA512 f599a83429497f17755bc69e1e7a46d35f44343f1479a82c87fe0db25b54f311cac47f32cea41ced915da42eb4028b01ba0a9945255674a140d993e78a623140
- SSDEEP 49152:RWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKzLNiXicJFFRGNzj3:J0zuNIN7wRGpj3
- TLSH T130A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 efea989f2d3377b0336285c8d52727c2381c3083385a5222dc88e32e5ca2388a
- MD5 b4c1d44941fe4a7e1acbc1afae9cb7b7
- SHA1 582db95414ca2464ad0d1e5c0adbd56dec87de03
- SHA512 d821afdd579cb5fd162d714ff726ac2ae601db411211f27111a078b3816be61875e007b822b852a84c9411885290ec0701b3c989ee570b03347cc5cc57307fba
- SSDEEP 24576:e1QT7EcpfxR+N5AWAz3ooiYzjMqbQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zTDxR+N5YzTBjMBLNiXicJFFRGNzj3
- TLSH T1A855B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 dd9d669ff45a4fa8db30e42c2713df7a29007baca8215bf5e6079fdfe33607d8
- MD5 712f799e8229217fed194765187c4308
- SHA1 3e03bf1e843bd7541ebf6e247b5d0c24a4cd90e0
- SHA512 ea8100947e2313fcfda8c0d7b5603f127d9f666708514b9d453791d515da8404c68944062e15e4ee8a856c3d94ebc4ac32d5cc7a7c2eac9757c004b3df3d10aa
- SSDEEP 24576:pTMdOz0FFS+UmSLk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:j0K+UmSLkLNiXicJFFRGNzj3
- TLSH T1F775F17EA39D14E5E47AC17DC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 2d58c862844981798beb21296a798f6fe156ad4c098970c21aac6981539e0c1c
- MD5 586266124b35cda1c955e93f006bd96b
- SHA1 78299158c0cf56ca4a208019fb962af937da3ad1
- SHA512 9f608764928c650eba2992c6d0e2bf70545f578c41606430a625a159b087199ab582ee307bb55427e6cf6d49a9952a36b5532d6442d9d1b4f5dc15ca1743343b
- SSDEEP 12288:94KGeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T11755125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0A97E9B36FDACE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH