9308ed663200c3d8531f1c9f2ea13134963fade488c922f72045838109c98622

Analysis

max time kernel
150s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Size 1.2MB
Sample260422-reqw9sgx6m
SHA256 9308ed663200c3d8531f1c9f2ea13134963fade488c922f72045838109c98622
MD5 0e81be8faf939c47ff836711947a72aa
SHA1 b64fa7c3af81580eda9fddef0a923a38a604380f
SHA512 4be212413274b7f47cc56d4739c5b9d150374323b6aa09a709f738e248c70f578703a623e66091a1d164dc74f36538c350bca70b1c99c6b8f8619e85d1a909e0
SSDEEP 24576:2it/HoLHLcbWbn3Oz6E1k82JEBEtLY2NlSzswJCAQPWNzS:htPoLQi3OzVJwnlSwwJ7z
TLSH
T10345E0223662C036D17211705D7CEBA6507EBE740F2246D763E43BAD1E701E3AE35A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5236	alg.exe
5436	DiagnosticsHub.StandardCollector.Service.exe
1696	fxssvc.exe
5960	elevation_service.exe
5464	elevation_service.exe
5488	maintenanceservice.exe
5800	msdtc.exe
3124	OSE.EXE
5392	PerceptionSimulationService.exe
2616	perfhost.exe
2656	locator.exe
1988	SensorDataService.exe
4604	snmptrap.exe
996	spectrum.exe
5716	ssh-agent.exe
1020	TieringEngineService.exe
2628	AgentService.exe
1028	vds.exe
1428	vssvc.exe
4812	wbengine.exe
1136	WmiApSrv.exe
4300	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a1eda69f14bf40d2.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4d2306b61d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac44846b61d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001df7b06961d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4b8126a61d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da364f6961d2dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040cc066a61d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c030cb6961d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeImpersonatePrivilege	1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeAuditPrivilege	1696	fxssvc.exe
Token: SeRestorePrivilege	1020	TieringEngineService.exe
Token: SeManageVolumePrivilege	1020	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2628	AgentService.exe
Token: SeBackupPrivilege	1428	vssvc.exe
Token: SeRestorePrivilege	1428	vssvc.exe
Token: SeAuditPrivilege	1428	vssvc.exe
Token: SeBackupPrivilege	4812	wbengine.exe
Token: SeRestorePrivilege	4812	wbengine.exe
Token: SeSecurityPrivilege	4812	wbengine.exe
Token: 33	4300	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeDebugPrivilege	1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	1108	2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	5236	alg.exe
Token: SeDebugPrivilege	5236	alg.exe
Token: SeDebugPrivilege	5236	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 5220	4300	SearchIndexer.exe	106
PID 4300 wrote to memory of 5936	4300	SearchIndexer.exe	107
PID 4300 wrote to memory of 2076	4300	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_0e81be8faf939c47ff836711947a72aa_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5236

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3688

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5488

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5800

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3124

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5392

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1988

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4604

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3456

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5716

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5220
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2840 2852 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5936
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2860 2872 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a97bb2176a6686c39f72fe2bbe0d4833f7c055b3d1d497df402e5d18e79a6046
MD5 0958111323a1a60ea77275961e6d9a6f
SHA1 a86c39b6ddb2ab1e244fa632f3e0a0f3550e670e
SHA512 0817daa738f18efa0247b85d48f509b2a2501e50e246faecdd5a3f3198b6aee445f28ff9c3470ea65d2c240442ad2f1ebde0ba7628902955af3dcd1e025cd923
SSDEEP 49152:Zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxndnlSwwJ7z:v3q6HjBl5JP
TLSH
T13BD59D03F2D900E9E06AD578D7469133EAA2BC890B34B6DF0780B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8a025907c48353f94feac52076dd31a196f0f8a08cb2e20b134428a009b97b8a
MD5 d6b89d7ad590b97d6de31d9070a68f35
SHA1 caed44a761b2b524f8f5213d46e412e34bd9c3c2
SHA512 bc71e0721db12a56287560dcd7dded08ff8a020031bdd65c769b43ce3b25c93ce9da29663ce5efedf1ee945a74a9127bc94251e3cd9938e410ec33372a7a0c29
SSDEEP 12288:G1XLsswWkxy2lRq2czAOtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:kXYfDtczAOtLY2NlSzswJCAQPWNzS
TLSH
T1A865F129B7E008F9ED674239C8A2C511EB3378944760E7DB03E4AA654F332D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2f2dcbefd90bf30c28c46a1bc5bfb1cb88693233d29fe809019615f8117e88da
MD5 a281d0589fdf6a615dd7fe66648badf1
SHA1 744030ed94f59e0a3ee231ec9be3f20fc75b5c78
SHA512 86e756855bc2a3c650bb029989d69008cdf790ac2feace7b9a3e5cf5d9280055a92973b5228e75ff1717cc19594ff13db9da00001ef761f964260ec2fa32c39e
SSDEEP 24576:60Le5ji0hmxirMftLY2NlSzswJCAQPWNzS:6Pji0AcYnlSwwJ7z
TLSH
T161859E16F6748371D073C0B9C5D2A69AEE72308557308ACB0286D77C7F676E68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d28fb778b638127385e50899fb69d64bae2dbf9dffc7cc0d3739c0f850291601
MD5 2a2bc7e86d4526ff8a75089434692bc5
SHA1 6bba4528603502f6a898f77edc175cef9f32871e
SHA512 5941a5ea8982c80adeb6945ba8d623520aa0af34e6c74367d803aa2fe174511fe6953fe88014c91e0261beec413e881efe8a043d14c55aaacbc4b4eed6dcb6e3
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyuBtLY2NlSzswJCAQPWNzS:1/ezSC6vUzPvxHjyUnlSwwJ7z
TLSH
T16A755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 748a0ef345b2e429eb5936b7f3b0447b08a6f1ccd1376f877e1f2edd3253b4ab
MD5 cfb2634ef2c7e986abbf5377f21ff0e2
SHA1 5d7762bbfc5c14fc4c3a47ba315721c12a7c53f9
SHA512 215660a3ddd9079efb4fdf2497fce20c68835c3813516e32e039ffdcb4fbaddd6a2f90ad4eded951ccebbf42a4ca1b1ebaf18141be5ab10ae296ddf3d3b403b0
SSDEEP 24576:AVbqPb88hv/l+6KtLY2NlSzswJCAQPWNzS:AVO88hXl+RnlSwwJ7z
TLSH
T1CB559E66F6B48331D073C0BAC4D2AA9AEE3234415B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cdd388b23320a537dade92f1fdfdf38d023c3188f4a631fb7837b888a2f1a572
MD5 1ed68f683b148224543b55630645b5c2
SHA1 edbe87c5a7d642df6deb30fe8e16be958ff3ea11
SHA512 5d6816447723cb7e81030c72375b88084a71290c5d8d2e78dfb7a6ffef8faabef0a3ed51c2f3c1d78c3bf17267edbc068c2b2147b05c8d82e96fc31c656e088a
SSDEEP 12288:pRrtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:pRrtLY2NlSzswJCAQPWNzS
TLSH
T1524523ABEBF084E1E3930D31D4AAD07277634DD8E610EB6316C4BB99C73910AECA514D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 96e888d9222edc78cd0e46bde9d260da130df7b575ef325a9b10edddd1a2fe66
MD5 4140726da65a6eb35bfd96e5888de8be
SHA1 04fac9a0b40e67919ae2d6e74809753bc2920c58
SHA512 ddfb39e1079ac579fa872b6ac12bc47cb2afcbb898926ed1febac95e0abe469263b37a4728bf24575739d482acebaea89c9fae49986fb25c790c8b9d6d466b9a
SSDEEP 12288:neBNUbTVO86UCtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:nJIUCtLY2NlSzswJCAQPWNzS
TLSH
T11D65CF7BEE38FCE2C27A4DB95A91C200E77278704B61A3CBD165830EDE235E15E79815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 14a772caf37e1be4106ca5d6f7562c93847c9b314dc8ae290afe0da04cdbe461
MD5 94e66ddf68ad980e9ac499c67c188567
SHA1 e6d10a89aa0a46e7dc9f7e83f12876708af16c34
SHA512 c12267db79b488172242ddccda0dfa490017f83b5d3d48038afe8711c332ddffc4354ac75308592e821eca92f1b0281a0141ea1c7f157dda2438c370495fc889
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:4QvGAdlCEL8c/yRNw5C45JP
TLSH
T195267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 7c2fb71ebed9d7ce2836c10b03ee1622aab4bf26d0a0e91a5a3406e9ba9526d4
MD5 852dede55645979ef6b8217bcc1a5b34
SHA1 344437341c41f6a5a257631d5ce4dbdebf3e6a1c
SHA512 16b3b7cdde70d2997ab681113c88f0d1e7532390db00a19cc2d653a33d95159fd1ad447c5f5981803877cd6429083f6cefadf5b2b446eb008acac3210f51c306
SSDEEP 12288:qAwSfxL/2Dc34DLLmt0LDQewsAjctX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJz:/dewsAjctLY2NlSzswJCAQPWNzS
TLSH
T1B675E031FE74D432C3BB0DB21B36C716243D69604B511AC3E3E89E9D9A342D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 08b4892e5ee61fd8bb9064a837cc0aeb96fac6c02d9e026eae75be2bbb8d8524
MD5 a16b0bff217bc6e9a984a88b8e81d6ad
SHA1 2d1747fc6088b3fa3d0cf7de277d3e023ac84634
SHA512 906d48f495f73f53e218a061cacd1a7da561f51f1ff861bf3c1f0e5da8d9ef1449dab17a4d146d4268239f94730ace0624049ac92a0d157fdc85bcdf90ba3606
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZ:/UEtQevvqc2W1cpV2EI32
TLSH
T15B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cf9947d8cd18280b9f6b6ad7d1076824180ab92572d6a09fb6f70f5344a94ba4
MD5 d1cbcdafb3a99f376829b0921ac1616c
SHA1 e104b1e0aad629be02bf37fb247e2d105ab1db0d
SHA512 ddc7f23e30f52667091651b82f7634f797702185b647908f056ee9b892e144427ece277995c7d7dcb135546f1ffca2544559df14d491864f018668dff27193b3
SSDEEP 49152:vCbRquA/m2yL5zTfFiV+XenmE3/zonlSwwJ7z:ooquVjnmk5JP
TLSH
T1B9D58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 118181b9f68ce46cb7b96eb31fd74c96efced46f6883c5332878f858ac9101ea
MD5 2fe6150a2a0e837e24e7fdafb04f02ce
SHA1 93fbdb4932f3f7ea29f65e2ab6d84f2464bda95f
SHA512 f475657230764153e9dc58ac226fb82b0bd9b046ac66ef643e453b5af92d0e9ab7f1950f220ca597eb5b5a8b3b5c6df4e9841118d59a978b5736e252c31cd987
SSDEEP 24576:vAhGLJIFoiwtA5l7S53FtLY2NlSzswJCAQPWNzS:vAMyFoiq5TnlSwwJ7z
TLSH
T1FF359D81EBF955D4F5B3AA7899B69171EA76BCA95E30C20F2150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2e45090ce978a5b4f4a0c4e2b5d560e02fbe4c5940a8e641becd7064919bdf7c
MD5 a9910061ffec962d716c6e6e847a3626
SHA1 fc9637e44fc95984d57ea769f248825984255b8f
SHA512 55856a3656e9b0b5abcc07cca9ba58ffcde13be5f0abc137aa3ec323b4ed07a06a01f87e39c51f5b163bd5b82e150f1b5590a7621b39f17fa611c874a71e0400
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+ChtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyC0:/wuoOWQtLY2NlSzswJCAQPWNzS
TLSH
T12865E08A77B40CF9E5A74639C597C132F7B2B8512A20DB1F17A0C75B9F37221AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 084e3efad46dae3667b69667fddb050835d58677eaad449dbc35ff4694d80350
MD5 b747a1a3ad2f255e38b2be5cfce9cf28
SHA1 1813105d29774715b48981386a2708eaa25fd835
SHA512 2d162dae3105a02502a7433e582f9751833dd915adf1132ac39e71afb49daf36dbf49e57eb4715f6bad3c21507977d88bb6ce27d881e7ab0c4d6b6df3900bbbf
SSDEEP 12288:yBZ1IystX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:cZu3tLY2NlSzswJCAQPWNzS
TLSH
T13955129B33F460F5E2A30A39C8E59511E7737894673083CF1694A7AA5F33AC69D39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d111d42497f265b92cf2e65907611a3b8e079e7305c7e0b46454391cb7ed6eb4
MD5 36226a1edf20d5533f27e1141bf21edc
SHA1 86344a9fb728f94e3f32b60e7007e4cdf03fcf4b
SHA512 fbf5554a4abd45a97ded47ca5421c9f6e5ca645da88271f5c9ce69f4206e4bcdebfe1957de07b5e9d41ba4d857c50002242246d661e9d888c3b7cabb00ee6b00
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:EQRQyi36YOcPQLvw2gAf+PN3Z5JP
TLSH
T1BC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 065ecd29af1c7d67febcba44bba5a28a8c287e4c8471ac183fba33dedac38483
MD5 abcd56d6db8cf90fa91ba8958d57d1a1
SHA1 c61ac70711545436c93546b52fa9bc0128918446
SHA512 68d17e839a38daf5609a944e74cfbae23119b4c699d0a895a51df72b347fc76ce41962a935b2dbfc2c7d3c6701f8dd13f954734167027f197cb3e80f35b7ebfb
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:UQRQyi36YOcPQLvw2gAf+PN3Z5JP
TLSH
T126667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e33fc110f84026df82c0bd204dd8d365bf7647e261bf54ad2f477b9425b80796
MD5 6911cfe159702897336fc1f49d43be68
SHA1 62987296ba4e37a9413b38480349574bc733e2b8
SHA512 61db7c223d1fbab7605b6fd29d818f40e782b08ba5076b2eeb83ce7e33b17d5924791615fa1b1559f5dffe7d2516ee9af52f8e7062e301307633fa128ee3a150
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ntLY2NlSzswJCAm:m68Qg55nhheWu7PNU3/YnlSwwJ7z
TLSH
T1DAB54933B2F200A9C44DE1769F4A873196D27C758FE0E3DB854572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 961bef238343453487855adeb01822d601e7e54edc94ba98bbcaeb502f35bedc
MD5 cbd96a5ee603fa5a064e571191c42971
SHA1 5c4366dc26285070cfb04c20c89af9319313a261
SHA512 b8441168cb6d315a718659759a737bf6c3fe1124473687a34b9ec8a5c335138d707df364ede456ad62db8e6e1a5011adcce0f1b911681be1fe015da01d189500
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99z:dy5112gYy5azzVvL69nLKnhZi5JP
TLSH
T1F3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 45179b5b17d9aa6e61bae16d1f376e3d3dd6caf9e171d6704c09680f041ba2a6
MD5 c2b8ac5350efdc4fdd3bd00e18e27fd0
SHA1 b2816ebd742933cadc819e38e3b09c5a78bff585
SHA512 23c427a82706bacd0edd66f5a9f8505da3cfb12bc6e5d622d04fc3289faf2f7c3f4b5f24d63064a65731234903f4e726be863aec384a43679c5570eb68356ac9
SSDEEP 49152:rB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6nlSwwJ7z:9u6JmVxd2dh5JP
TLSH
T1EFD59D13F1D901E8D06AD578974A9233FA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6a93eda840297ef0dfe015e8f03a7ede8a95862be2f459fbb7a699634da8d149
MD5 38c969dd6af0208e2b327f4850e5537c
SHA1 e6bcc8a1aa98e301dfd460a1b2939fbf02c732e0
SHA512 d690e50261577ef0a785dc8e2b51cc535366d261c1d76f5caf286efca07617278fd090c180ac2f7279f34ea5bede30b673eeb43cad60b4efdde88c306a543c09
SSDEEP 49152:v1hpsNoJpF1A6UU44CwH7R4xmnlSwwJ7z:vmifPbRk5JP
TLSH
T1C3B5AE13F2D901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a2cbbaa73721601e3c79c0b4d5d926f708616ec4378e27c2e9eb781f2884a3d3
MD5 6a31824f18f3b0a6989d62976725fccd
SHA1 05790f9e7eed926582b95dd45c62045ec92b0863
SHA512 746fbdf8a134ca501ef35ba35c0906d834e8e84e876e82ee81697a98357f8509ee2d26c3ca748c293267d588032a6d3ea45413dd4f7932c60233e2426554c89e
SSDEEP 49152:jSuZQIY0Be2KRRVtOnks6NMHqNnlSwwJ7z:B5dKTi61W5JP
TLSH
T1D9C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8cabe85974e52622329ba25cd3c2f5d5d924108cd0de74cb3e65b95980036a93
MD5 62786c64fdd25adddf91da3f429c43b0
SHA1 eed7cc51c0fcd393267f5bf80025aabe8774efc9
SHA512 945051bae125e55483303d3b77b471f3154501cb34217e48981db02886408560ade9ca82da9f396d83b1adbed63ed4344ae50ef621df7aac8d793075485d08c2
SSDEEP 49152:phtSn8EApI0figngiDn0AP5wqnlSwwJ7z:YX2iyphw5JP
TLSH
T15595BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 123f44cffb67c5c5773ed6f870f7410937bec16a2b1b52f8d5fc070abd9b2883
MD5 0d43893947721d769375ed92ce7b6bc7
SHA1 49f80251e2e6165159b97c0f4fe91422d7a9ffae
SHA512 ce621334e103e0504fc47167bbae2b8ae22b7244ee3cf29b9b6b0b2c1dbf2461f912a8be9b3e45f5ced26b1be96579cd3deca99562ce44d13ff70635de460827
SSDEEP 12288:ADtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:ADtLY2NlSzswJCAQPWNzS
TLSH
T1154523AFFAF188E1E2520D71C46AD072B7670DD8F710E6A327C8B765C73911AACA514C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c2b02aa3d384f31c753c16cf759b6d40cf591febc8c5c9487cdde87c8fca9bea
MD5 791d7ef77a8431b3719cc5ae2fb52fe5
SHA1 50de66f4f7a1d9531887b1fdfd6d3327345691ba
SHA512 e5b1a46de7e86855aaaadf00a0b1d9d3af27a02abb79c93f51a24c73e1683758cbae44a9cf5416f22763b2cce45da55b0c134283f0c644d86e5534e9f5b0828b
SSDEEP 12288:fYtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:fYtLY2NlSzswJCAQPWNzS
TLSH
T1684523AFFAF088E1E2520D71C46AD072B7670DD8F710E6A327C8B765C73951AACA514C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 07f22dc1ee7a5f8e894830df4bfad654eeaa2c141a814cbc026d5bbaa4c11253
MD5 dcb308dda768b7d4e27afa7a387bba55
SHA1 01634c37e7675a923ffd94c6cacd4c620e372276
SHA512 c4166575bfd20f6bf4c9d5f0640eba4070cc5ed4547ac94d302d2e17832bcb6d0203716f720683383966e35c8b229069cca340f753428b588477a1ea091f0307
SSDEEP 12288:c6tX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:c6tLY2NlSzswJCAQPWNzS
TLSH
T1314523AFFAF188E1D2520D72C46AD171B7670DD8F710E6A327C8B765CB3910AACA514C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e8a95cdb07d07a43349097a9d74403472ce32e2b55748542c46f3aecaf4b7f2f
MD5 60e29ac3f678957cff626f3ff3bfce7d
SHA1 6f79453b27555d45ad1cbbbff99d2f80341b6bf7
SHA512 5ddd0e195cb1c0dc4d67a4eece14f4f521607514d1dd08e21a50378923282935739f23450b5ca290d71b546cfe0799bf2ad55aba81fc79dad02effd93077f93e
SSDEEP 12288:QVltX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:itLY2NlSzswJCAQPWNzS
TLSH
T1194522ABBBF444E1D1620E35C866D022F7B37CD8E720E7AB2784775A8F31255AC74648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 58ee712d4fc3a428a35d35190a348c5aa98ad294eacd078de9fb27188fab0440
MD5 6394ebe258cb52bc17f306504a3d90f3
SHA1 25584781ae75dc45be0d1234a04438a66942dfb3
SHA512 a37f2d0a9fa4a476598d6c35a05578c446de2010fce362a976711ae8462d0e77093098e2c4fae0217706fdd5e0d4fd1476910c4d792260dc53198d6f67c2ff57
SSDEEP 12288:UttX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:UttLY2NlSzswJCAQPWNzS
TLSH
T1A94523AFFAF188E1E2520D71C45AD072B7670DD8F710E6A327C8B765CB3911AACA514C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a4dffad48d338e30fe8d5e2394531583a7fbfdcb9693d2d0f66d4ea8a8f8d913
MD5 578515db166aa814874c5b5cfd2585d1
SHA1 f7e1cbf8d8094d8f8b0facf770fabbfcef165093
SHA512 013ca01c729ba5d200cbdaaf16f06a51c62c64e15b20bee14c4b1893e2b41525c66debad65e7e36e41d48c4147f7dd6b8974824a1d1c9f74869137ee9dee5efa
SSDEEP 12288:p0tX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:p0tLY2NlSzswJCAQPWNzS
TLSH
T1484523AFFAF088E1D2520D71C46AD072B7670DD8F710E6A327C8B765C73911AADA514C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9114ff393aae4aeba5764424749d34d16d5095b390433197a1e5c675230c05a8
MD5 17d2491ce0975e6c096d878a96429bdd
SHA1 ac3cc3c3c48ff0873004cff34ae1b9ee9e4845e9
SHA512 d74b00be345c25a80b0bae8103c01ccf9eb0657de47316e3a695da4199cd637fcdf87e9044db00675c4c8204744647cbe39163c98f410794d8d5a247f862443d
SSDEEP 12288:zAtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:zAtLY2NlSzswJCAQPWNzS
TLSH
T1FC4523AFFAF188E1E2520D72C45AD071B7670DD8F710E6A327C8B765C73911AACA514C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 402ab18c2f9baf6b8f84ac3c673e6469e6bcef6188cac06c617113c3ef908f89
MD5 0e26da33f58c576d4cdb68c7ab820ae3
SHA1 ece9f131c7239dc6fc53133ca77fd2660bf414d7
SHA512 0ff3311a965fde5f6e67c19bf02b6a425635b8c3a1352f8b8babe4b85937e23c644cc500077aaf76e451d2316db43888a1144bdc14e0681fa3d33fdf2abffdcc
SSDEEP 12288:HiZwb6zzFEoS2cPvy4tX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:CZMSzFVSO4tLY2NlSzswJCAQPWNzS
TLSH
T1516501A9B3A008F4EC63453EC8658912E6B27C594B60C65F13E837675F333A15C3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 53c6fb85f23505a882927ea17f929015f3321ac7db932a68ece42463c6cb74cf
MD5 b8cc90d75cf3946c2a3cfcbe4676d730
SHA1 e686dac132520fa7f43f4bddac8e5611225addaa
SHA512 b511605c4ae4fc629dc94eac2f48abbdceeb18a9497123c5625365381e232bf5f61911614566ac66eb0834002bc55c20520b08e0b2ea40b3da63b9894eaa5fc4
SSDEEP 12288:iHtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:iHtLY2NlSzswJCAQPWNzS
TLSH
T1984523AFFAF088E1E2520D71C45AD171B7670DD8F710E6A327C8B765CB3950AACA914C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 bd99a91a4e4c6ea8c52f5458a303fa0feffe9d7a5977682681b72f000239ebe5
MD5 ccfbc7c9f1b65c059d7a69b02a3b1010
SHA1 cc97e573d855f390a404504c10b40557fb415668
SHA512 f11e4d5cdaa8e3e31d31237df36e518f174d655af8768677cfa7bd54a68eea3b8030a15c1afc463ffd525ef5b7a073885acb0e1ec9850601c20d7c47fd6c92e8
SSDEEP 12288:G7tX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:G7tLY2NlSzswJCAQPWNzS
TLSH
T1764523AFFAF088E1E2520D71C45AD071B7674DD8F710E6A327C8B765C73911AACA914C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 705b61a13c6d86360a1ebe88c79f24802f26e5ff455466aa59d55194b09a6e30
MD5 73e3bbaf59e87e869d3ddefd0551b28e
SHA1 021c655c4ce1767926ffd867ec611ace9e206959
SHA512 077c977ae2c851ad1850831f9b5c7511357f83c9fdaf31f95d4e8718efa06e9bf1b070cb5867db439b2b74a63c8ea9b62a0f1dbcb93b5106be5b886e06fead3a
SSDEEP 12288:hyPz5L8stX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:wzystLY2NlSzswJCAQPWNzS
TLSH
T1D555125BB3B120F8D1730638C8A25A12F77278755720DBAF139467765F37291AE3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b13b361c9c79364f2cf830a9997505d0b87926b1ce08879d844b6cff9872c34f
MD5 9b854601a5ff373efe0ee6bc2772f0fd
SHA1 6a40c9f86dc720faedde1b6809a248d45cce812b
SHA512 1b4f62d0607f5788e51ed1f88e45cbfb40b7cfda7158d9663e32436c6f834b1a41b1edc44da07dfde6e8868923db2102cb6e24c06ce379241626b5a1630bb546
SSDEEP 12288:pHtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:pHtLY2NlSzswJCAQPWNzS
TLSH
T1734523AFFAF088E1E2520D71C45AD171B7670DD8F710E6A327C8B765CB3950AACA514C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 992916d64cc4d8536c6121ef947134345b61e2c18c071b0b40d522db4508bd09
MD5 f5195b78b4cbe8bbca1b31ea53579a3d
SHA1 eb3739b15c62fcfb2aa67fb75db6e5ea46f1b407
SHA512 0c6ed9ef1d0320ced0eb9d8305938e1d0964538fef8c1de4bc657f5666b2234b41cd889478551e2f7b0fa923b61fe33184653ace70aa3677bbe11c2aeb9a6d23
SSDEEP 12288:4HtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:4HtLY2NlSzswJCAQPWNzS
TLSH
T1E74523AFFAF088E1E2520D72C45AD171B7670DD8F710E6A327C8B765CB3911AACA514C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 41dcb46dc27f19db76c5be4b5680c71e5e788959c7559ff3ad33360319c14499
MD5 dc8943ca61be5369643c732edd71da3f
SHA1 1ebee552e98ca109c4bc23f4bd9695e8eaa39bd2
SHA512 1b8dbb72fdc6206bfe9b93cae34941cb66f6f937703e8962955caf735c3faae2c9df36e79fe52123cc3d97e502eb95427fc0f661a7ac7daf0d4202078a5f9069
SSDEEP 24576:7CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAWtLY2NlSzswJCAQPWNzS:7CUxPTY+8Wg2lIL8lrIUJLWwLnlSwwJP
TLSH
T14C65AE1EA3EC0896D0BB81358951CA16FB72782E1B21D6CF2160C37D6F27AD95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 8d91c0c73cc8ee6de24bae9f069c244a1ccf398622fb5225b42fb4270d8621d6
MD5 7dda8a58e737fe70e2e754bc457d1a88
SHA1 3a07d8744e990a4e69378a4e518de13c37544aa0
SHA512 183bd003ebeeba07e3e0d0f476c47959ae4c5f5de49200b41e4d339d852c7c660303604873fb1cdfb25f2cee01b166e99eabf4e6676bb28612f1bb1ba529c994
SSDEEP 12288:PNsf3tX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:s3tLY2NlSzswJCAQPWNzS
TLSH
T11C55F15AE2A401E8C06E1675CB569651B3337C6497E0D3CB23C0F67E0F3A695ADEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mark[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\28VRDO1Y\mark[1].txt
Size 2B
SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
MD5 444bcb3a3fcf8389296c49467f27e1d6
SHA1 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
SHA512 9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570
MD5 SHA1 SHA512

Submit Download

config.ini

Path C:\Users\Admin\AppData\Roaming\SuperBookmark\config.ini
Size 110B
SHA256 d5301c6301fe9abf370f33579a72267f14450db9eb5a8c2b0622de53257d9e70
MD5 ee4c5b3060fbf5b943bae044cb02a965
SHA1 a9c91617eb2bc7cfe7b95728d3dccd351c8fb9fe
SHA512 09b990244835198d94501ddb4b9e45bbd8a7092ce504e2f292266953c2b1b6479d16a05ecd57446de85393feb6b2e34acd707d258ebcd5b7941e849ac517c135
TLSH
T1B9B092B2AD92C98D1C272680E01E81A0C482949CAEB7E0A123D40A462D1DB069E2D91C
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ffa7a1c9af2cdafafd6c6cb6e20528ddd701014e2b15be11d9a4120e5539b81b
MD5 cfe70820e0206d0380004b0613b797d8
SHA1 446476ce232585879f17fa4b548185da3a13a502
SHA512 2dfe33081d8ab66d2a847c61352ceee02463b0f184b1e2d447a6d0574e0cd26bda8b9f026fb57d6cc2051c122a8a72a02ef8408d6c520940525587d5d17c1dd0
SSDEEP 12288:natX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:natLY2NlSzswJCAQPWNzS
TLSH
T1E34523ABE7F488E1E1770E30846AD031772B6DE8EB10D6D33688B7958735586EDB420D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0c2669ee990044903fddd5cab99d71eb26060a91138c23a966f537ad8aaa4a4f
MD5 d3b7ebf4d4865187877bf1fef4fb3fd0
SHA1 bcbc93c2b28372cf2fd810e7d8045cff3eed8717
SHA512 aaec73c2e14a63dcd8e5121c7c1f1543745cb5c9c20e0663c8f08fed02d1a84e5086c3564f43ac8756bed368bd66207d459af6d8f28d909350216b188ae8682e
SSDEEP 24576:e8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC8tLY2NlSzswJCAQPWNzS:HRZwQCyiHiQEaiPnM1nlSwwJ7z
TLSH
T15C85B01E63DC46A4E0BAD278CDA74407E6B27816573197CF1290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 ae4dccb30850d37b0cc8aa25bc1b2661c25767f0a1bbe75978727f306fa9364b
MD5 770a70556ff291e405055c49fa5dd5da
SHA1 2d7db72c7f30b89b71bf80c19eed491e35399157
SHA512 135fca6d5c5d7598d2c7bde850bfe10dc8aff5370910991d0f4b739e1c163fa672b243d89550d3807c21ecc28dc370302b55da1673cef248352449ccfeb14355
SSDEEP 12288:ObxA1U7KqtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:ObxA1UGqtLY2NlSzswJCAQPWNzS
TLSH
T13A55016F66FC14E0E17649398896C112E3327C696720E7EF21C4937A4F3BAE99C35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1c9046c5f50d367cf9b473b45cb7b6180f521cd9ba6716206900007a76bbb5ea
MD5 679f434f1cee9c87070484907320da34
SHA1 4ad42b244cf0a98c7dffe242e518da3390aa11da
SHA512 bcb39734f1c78e70ef28bb18e83465de8e0133e32c53778a6106e348f1e0932a0bc272c3fd0d01a6279eb00075f113f04a733fe10133025bb24d567b9a13f3b2
SSDEEP 24576:KjsmP0yHaqrVqHra44KDzMsrn1tLY2NlSzswJCAQPWNzS:KjRP0yHfVqzlAsrnTnlSwwJ7z
TLSH
T1B745AF2EF2B910F9D4AAC136454147B5BB71782D1F209AC701B0C635AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 94255060a72e2aa384ff304e368a3dbc1ffa6261a2216544210a66af79043264
MD5 9bc22ffc7c14f0f5c7c1941072f95d49
SHA1 22cc761575eb98bf150e92ff9c0ca088b95d52a2
SHA512 d1557e1cde60316ed67c167a607f79e3fb3230a9da8600f39a3c752a28c8b8aa7cf71b52840f992ac333ef1acb788a7897dcd3e131729c936bea75fd49263ff1
SSDEEP 12288:KUtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:KUtLY2NlSzswJCAQPWNzS
TLSH
T1F64523AFF7F088E1D2620E71C45AD03177235D98A710E7E326C8B7A6C73959BACB5148
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 db3c6b1785c272c310a8dca311db589eb7ae54b70e00f813e5522da011f8414d
MD5 1d25486f2678bd0400cc2f6c7dd59595
SHA1 d89f90dc4da4e5c22ddbc2fb6d13eed621488d8e
SHA512 95f921f4474fd45eddb7cc29e878dbbaa7ea21200df28e99819f3109357e65b4561ed8f748d7cfd66aeacf3809e89697c72c8c962c19a41c85d1409176debb56
SSDEEP 12288:YOb9A4LWO+vAYFTOtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:1pLBUTOtLY2NlSzswJCAQPWNzS
TLSH
T17A75F159F7E404F5E967813CC8A68522E672789C1760E7DF03A88B651F237E68E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5350e75de077b29b30eba320219a73d50b74f91912ba17b798f9022a4624cae8
MD5 086b613eb2aad1b30eb8fa674e442c87
SHA1 ae83442f1d373ab57dab61f1fc1054ec4bb94231
SHA512 af4c8fd088fd3d1c9d149780d3ec3f12f334831cfa92ed4e3bf2c137ef1c73dc648a2156702adefc08929d96dacfcb80c95f4a4e906da530580848b75c3014ff
SSDEEP 12288:P70VmvIYNvUyBpztX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:YrYNHptLY2NlSzswJCAQPWNzS
TLSH
T11765E12FA2BD08E4E57B5579C9838215F27378A6171192DF05E0837A0F27EE9BC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7f1aaed2cdb54dfc5d4a4fc3d38e6823fc061809396bcde005543dde75505735
MD5 acaafa20aa3a9af2beadde26841567d9
SHA1 27b599d23e18f23039a7ca7abef5da6abde55044
SHA512 2bf5e82016670b51d8c59c9b11f9d2f220f0ac5d9f6b4105d62630fe41a0f14e2dd5025a48a81986f9c568d6ecd33b8f39a07709f5554ecd88e16d2aca69b144
SSDEEP 24576:jnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKq:jnXoJJYH84VVS6AmEcJas+cHBjSSKHPP
TLSH
T12565BFAEA2BC04E8D5BBC17DC5C24506F5B278651331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dcbca26d476969800aa98f561bf01030b21ef25b064e7cfb0751f3f191521e40
MD5 ef64f882d5f895df79c072592db96a05
SHA1 245aecc44badbb505725277959f0c3fa8eeffb08
SHA512 e1ed860d47d3cd91fb30680b8ad5c52943811fcbec40e0ea85b7d3c8f06293df80251df813dd9a08ea9961090e0616ef5e259c4527ef401ff5cc177c426d5eba
SSDEEP 24576:Kv7Xbxd9Tuycf8M/TYlSuxrr2PCLtLY2NlSzswJCAQPWNzS:KDLL9TuJ0M/TYj2PAnlSwwJ7z
TLSH
T12A858C5EA3EC42D4E07BDABD85A79046FAB2B855273081CF1291856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 dc11c005fddc8725b7d00b0c6ee4974b45104a2705dcd1fd1e9f171c070c4080
MD5 3f88d7a033fcd688d629e7109c6b7b5e
SHA1 be876b8a659ef341a4e09d8ff164a53be31c2c9b
SHA512 089cc0308d041c29e4b53289ebd4cc681cf3d4ec9fff8cc096109490a140ade507b2d9403a56d7f59dd638e86f75ffd3167387311f4dbbdc3760ed6e812a3375
SSDEEP 24576:aegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wOtLY2NlSzswJCAQPWNzS:angOJOmPOHhqnlSwwJ7z
TLSH
T13255BF3FB7BC15D5E03EC17D89968916F6B1782613259ACF0190827E5F2BEE46E39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 470d7c4e75243897c20c4a6b07c8adc9e5d95c4bb5ac36f996c3f29e2dd30a57
MD5 ad74eff600ec242fdcc98920196fd7d7
SHA1 f6b694c17e674fc6351bfc71720fb7f25e9aa47c
SHA512 c8115d30104ceb4d1f2d5a67be19e237092aae7e437cc0a28287583ef2ca01ab7b639405c5bf65351efeffd77bd183af63a57c7227027564ab5bd89169425e28
SSDEEP 24576:gLJnJiTk3R3waE4JrO0tLY2NlSzswJCAQPWNzS:gLJnJK8R304ljnlSwwJ7z
TLSH
T11575D07DD2B810E8D4B7C2B4815A5656FF32346C2B21A9CB29B4D5353F12FD0AA79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6dd1a7f842d6cefe4f94782b55e0dd5fba400698c82498e856eb0d67688e0bfa
MD5 ab5913097489a705e83cba1cbabff923
SHA1 460e3979dfa2402dc581854a60ae80dd5b46a76d
SHA512 40c376eeeaaa39ee044ffbd8fa2cb72ab238e4931216dbbcb72054a94b54a014da668b4e35a03f999959e3f8900c4d56a739d24b9bf0d49233b996c1de058223
SSDEEP 24576:iA9mqCceDQncA/BmlvLto8cFVr9og9P/Z6pmtLY2NlSzswJCAQPWNzS:d9mqCzDScAZmlvTcFg8Ph6EnlSwwJ7z
TLSH
T1F0955C15F7EA5298E8B3C9F1C96694159B337C409B34F7EF0A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 dd810b7937a4a383f3c049bb26f3ea02d13e91044e6f3d74216bbfd01d1c32ee
MD5 3d5a772dbfc1378be7b1f56e8145e027
SHA1 05aa2ffb7c3df38ae2d38a4449ed0172a9ce937b
SHA512 619ba041253d3c22d0b604d5ae69b7294cdce0a8d78e07850e7ed234fa128bca326bcb1eb2a056889d3d9de9cffcd95ba78f623701e3266fae48c763447262f3
SSDEEP 24576:JlYJeXm5jUuEetLY2NlSzswJCAQPWNzS:JlYJeXmRUuEanlSwwJ7z
TLSH
T19655129E76FC60E0E16B0979C4928521F372B4B46311A7FF12D0D27A8F37AD66D39A40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 950cb3e94f28f0f3505da2dc2a9f1d3b7dcf9806cd6c91483891e3af288a984c
MD5 824b5c0ca7a071714688e44bba540ce0
SHA1 2a32d962799ce7e95bd902eb8537bcd67f19b1e4
SHA512 2e99eaa0f5bd9cd35228a0341e15c1ad9468f89c78b0e6345327dd6ec0111f8b07312bdd83262d4171c5770bb6ee79d6b047313b87a6cf24c582b1a104f8f4d7
SSDEEP 12288:Jmu6kyVtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:J7tyVtLY2NlSzswJCAQPWNzS
TLSH
T15855125AA3F454E4E2B60E38C9638160AB36BC649B1097EF11D0F73E9F366D5AC70B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 ac456be6245a0e144b87d83fdbad7c4fa819edfa620a93a0f7848a7ece108935
MD5 192ee8c260a292735333e320484c739d
SHA1 e2f94bd8d8f7ff6dfe432a95b2d1c1f94895d78f
SHA512 dee808cca1b1e6e77b38b4d25893a91539f0ec9d7c289449e52c31f03c389b1da58072f2241e9a162ece90347c4cc21990ca01b82ce130c3fbd041b72d2ccd24
SSDEEP 12288:pPOtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:tOtLY2NlSzswJCAQPWNzS
TLSH
T1554523AFB7F054E0D1520D31C46AD071B36739A4A710EAFB26C8F7B5CB3A186ACB5548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 22fd7f65b5691c4b6881714f3525e4fe16fd7cb9a59ac840791c1b56b9d28b84
MD5 b8505224bb1077310b55a485c8e5680c
SHA1 486525ef398ed77ed5074ba418eead8bdd935da1
SHA512 a079beb5e5c5e50fe538a3f436a27dbcf2a168baa3c89bf54b8c42c47464b65c5bcead191cb6f0d22a49e503b14341ca42fff21dffb6c472745f117884fa6044
SSDEEP 24576:vC+TyQIu93VAumZr7jmXtLY2NlSzswJCAQPWNzS:v/TfIq+YtnlSwwJ7z
TLSH
T18F558C1DA7F91DCAE276C675C8A34493E633B871136186CF2044C17D4A9EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 81b437c2c31829a2ecc9a65ebf5db4a66eef0a7a9822ff6810e6d0b219faf4b9
MD5 640334fd439ebbdaeb6926efe554acd3
SHA1 2078f7833782c5218c7f13bfa36b0951c62c43ac
SHA512 6314c8ad9e8da2448d6a3587afae748291ffc1732b3fc649da589fc0a68ae3103b9508d322357d5c6652f4843fa5dfea1afd7b8f3dc6f5e5689cf6b1600f797a
SSDEEP 12288:GcyrWOstaa3kcsytX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:fLQikZytLY2NlSzswJCAQPWNzS
TLSH
T1B665F01FB3BA00A5E1A78238C8968152F7B374745711A7EF02D0C77A4B675EABD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1e46712c52bece7d196d45ad35e4e70ce521da71c877fb637f3b3237b9b11428
MD5 a1cd55add7dec2148436de3bd26c41fa
SHA1 5579ba13c749fb228954b8ff7a0cdf606aac5059
SHA512 a803bb0c4565c00b9087b20061d4d39a12bf8e69bb13fd05b5282fc7016852e6d828053e28a67f9c1c9b5fe4d4ada36d126da21226316ff296167e827bd913c2
SSDEEP 49152:NpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPznlSwwJ7z:OpC7b4+80GTkT5JP
TLSH
T1BCA57C3DE2F800ADD8AA8775C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 111a001c4bd36b28a7e1f6172f0dc560cf4338ae7d4fa82ec2bda91c5bb4a4ee
MD5 18af9d950b3f8e73cf130a8e420e270b
SHA1 8457fee5903c96b5abd2085bdbcbf943810f4279
SHA512 69578764e4ad648835d923128b843f46656d44e402e476b72085b91a39951f8666cd2df1150be2f19bfa8eeb94bc4fa5a57ce48f0580cc7c4fa86bbc9b825a14
SSDEEP 24576:dSAwJPE1IDAo+4Kt+l44135UQNtLY2NlSzswJCAQPWNzS:dqPCIo4Kol4/QrnlSwwJ7z
TLSH
T14D55AF2AA7F946E4E17ACB74D663C511FB7278221331A3CF5290913E0F169E89E79F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 1fe0bbb2cb0abb8646afaf52b1b2f6fcf665bac8ed3cedb54009455a0a766188
MD5 e3539d5ff30c389abbda318ef0576ef1
SHA1 b5d66fbf1085c484d011fac174da5cea25d7c94a
SHA512 7c8b571ff7f4edd624cf54f8451f2e2f515cbdba561b1c86ba2cd7f1fa0c89090277621feceb4866a798c4ca0e97a4b215cb79220e829898c61ece7b26de1e9a
SSDEEP 12288:RSsyLCFBoPLCRyf6NQ4tdtX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNm:hyLXPLcM94tdtLY2NlSzswJCAQPWNzS
TLSH
T16E75D13EE76C04E4E47AC27CD6A38506F67238AD0331A6CB15D491791F6BEE4AD39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 d79a86546336a266761c067de6720f2ffc9530101d2550b0a32f3780e89760c2
MD5 a19d09ffe13c09108bd7f3f6a7e34d78
SHA1 64e3746849a8f9c45aaebff1aff763490422e686
SHA512 062a3cb3a0c9fd56e21987cb8b4da5371e7e00512c4fe7c2b7ffa18633741db41d1eded1ef8b95900f5330a750eb18c75be96ab2b18c6689e578c6f19ab0b57f
SSDEEP 12288:e9lyvj3IkxjbBzitX1JYopNyAdqmAHzsZwjJ2rtOrPLL0AOSoJoYyyCzNzS:eWv8qjpitLY2NlSzswJCAQPWNzS
TLSH
T12965125EA6F464E4E0760A34D426C121A2727CB51720EAFF31C8E6BA8B356C5DD3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/996-189-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/996-186-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/996-360-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1020-444-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1020-213-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1020-207-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1020-215-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1028-242-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1028-233-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1028-239-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1028-484-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1108-104-0x0000000000400000-0x0000000000532000-memory.dmp

Download

memory/1108-8-0x0000000002460000-0x00000000024C7000-memory.dmp

Download

memory/1108-0-0x0000000000400000-0x0000000000532000-memory.dmp

Download

memory/1108-485-0x0000000000C00000-0x0000000000CBB000-memory.dmp

Download

memory/1108-1-0x0000000002460000-0x00000000024C7000-memory.dmp

Download

memory/1136-278-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1136-284-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1136-491-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1428-254-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1428-486-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1428-257-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1696-48-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/1696-47-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1696-59-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1696-56-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/1696-54-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/1988-489-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1988-490-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1988-157-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1988-163-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1988-165-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1988-294-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2616-143-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2616-268-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2628-231-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2628-225-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2628-219-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2628-227-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2628-229-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2656-154-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2656-152-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2656-283-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2656-146-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3124-126-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3124-241-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3124-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3124-129-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4300-285-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4300-300-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4300-316-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/4300-335-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4300-292-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4300-286-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4300-492-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4604-175-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4604-338-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4604-177-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4812-266-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4812-487-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4812-260-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4812-269-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5236-28-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5236-31-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5236-22-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5236-128-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5392-138-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5392-132-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5392-140-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/5392-256-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/5436-36-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5436-44-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5436-42-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5464-78-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5464-80-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5464-72-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5464-203-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5488-94-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5488-92-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/5488-96-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/5488-98-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5488-86-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/5716-195-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5716-201-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5716-204-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5716-402-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5800-112-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5800-106-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5800-218-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5800-105-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5936-506-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-511-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-508-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-499-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-507-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-505-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-513-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-514-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-496-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-497-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-510-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-509-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-512-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-502-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-501-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-500-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-504-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5936-503-0x0000025BE49B0000-0x0000025BE49C0000-memory.dmp

Download

memory/5960-68-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5960-63-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5960-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5960-188-0x0000000140000000-0x00000001402E9000-memory.dmp

Download