Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win11-20260130-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
- Size 1.7MB
- Sample260423-dpr1eshw7s
- SHA256 ed42a45aa6539ef8910387bdbfd3e460cccec55684fec4f34f9ea0cadc7df495
- MD5 55235e8e8a784d157bedfcfe33e09020
- SHA1 17ba524a8f9ef9f6375a733d2d24bce987686d59
- SHA512 4996df329f4f610ab4b53b6c417430fc1b66c0685598e70af2c7cc7afd5a2cbcafaee67d26578c6e50b836609b10b424396169b88eb7da27a4ab2197bfab3b87
- SSDEEP 24576:i4UKRgN+SC3+I8KN9A99JhO2WDnMBztrdRQ6Ax52+Mw1zaTlnRX9jaxOgdQ0mG:XUVH5KNejJhJ2nMUgw1ulRX9OxjdQ3G
- TLSH T1C585E0117D46C673DAA442F86C3BDA84406DBE50AF6560D7F3A833A71A307D3A236F46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 5840 alg.exe 3172 DiagnosticsHub.StandardCollector.Service.exe 3336 fxssvc.exe 3224 elevation_service.exe 3368 elevation_service.exe 756 maintenanceservice.exe 5224 msdtc.exe 5872 OSE.EXE 5276 PerceptionSimulationService.exe 2500 perfhost.exe 116 locator.exe 8 SensorDataService.exe 2872 snmptrap.exe 5624 spectrum.exe 5428 ssh-agent.exe 1324 TieringEngineService.exe 5508 AgentService.exe 4100 vds.exe 3908 vssvc.exe 5820 wbengine.exe 5384 WmiApSrv.exe 4552 SearchIndexer.exe - Loads dropped DLL 27 IoCs
pid Process 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 37 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\locator.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\37e593ea958e99e9.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f23fbfe4ced2dc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b767c6e4ced2dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3e7e3e3ced2dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea1c20e6ced2dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000201a99e4ced2dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054ff3fe5ced2dc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000826b0fe6ced2dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf7d7ce4ced2dc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006b896e4ced2dc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011cca9e4ced2dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a85e1e3ced2dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3172 DiagnosticsHub.StandardCollector.Service.exe 3172 DiagnosticsHub.StandardCollector.Service.exe 3172 DiagnosticsHub.StandardCollector.Service.exe 3172 DiagnosticsHub.StandardCollector.Service.exe 3172 DiagnosticsHub.StandardCollector.Service.exe 3172 DiagnosticsHub.StandardCollector.Service.exe 3172 DiagnosticsHub.StandardCollector.Service.exe 3224 elevation_service.exe 3224 elevation_service.exe 3224 elevation_service.exe 3224 elevation_service.exe 3224 elevation_service.exe 3224 elevation_service.exe 3224 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4408 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe Token: SeAuditPrivilege 3336 fxssvc.exe Token: SeRestorePrivilege 1324 TieringEngineService.exe Token: SeManageVolumePrivilege 1324 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 5508 AgentService.exe Token: SeBackupPrivilege 3908 vssvc.exe Token: SeRestorePrivilege 3908 vssvc.exe Token: SeAuditPrivilege 3908 vssvc.exe Token: SeBackupPrivilege 5820 wbengine.exe Token: SeRestorePrivilege 5820 wbengine.exe Token: SeSecurityPrivilege 5820 wbengine.exe Token: 33 4552 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4552 SearchIndexer.exe Token: SeDebugPrivilege 3172 DiagnosticsHub.StandardCollector.Service.exe Token: SeDebugPrivilege 3224 elevation_service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4552 wrote to memory of 5048 4552 SearchIndexer.exe 110 PID 4552 wrote to memory of 4148 4552 SearchIndexer.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:5840
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3940
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3336
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3368
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:756
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5224
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5872
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5276
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2500
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:116
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:8
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2872
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5624
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4852
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5508
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4100
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5820
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:5384
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5048
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:4148
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 897ee608e519b63a7c3702f4051e8879db18a7472dc35cb9d149afb574064457
- MD5 c13dd2e0318be9eab80293eb0904276e
- SHA1 e81511bd64e49605ee4c89c3aa1d289e6260351b
- SHA512 bcd74e52e48d682015c371cd5fb1cbc380ea607e968a25f055d9698a0afb0114d6ac4e70b5d3a6e763d2b424e7508cdd5cfe7369b62bb4f79081b13b9798cba8
- SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxntulRX9OxjdQ3G:x3q6HjBVRoLQ3G
- TLSH T1A2D59D03F2D900E9E069D178D7469133E9A2BC890B34B6DF0790B6562E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 796a4576309f7635d1d8587a60f149d940598681d8f3adc9b9600f220b027117
- MD5 a3e0b75f739e423fc2fe0b84d48a6680
- SHA1 039d560b4325072066d8370bf2e3f04e89f0b8d3
- SHA512 eeddf924bf075d4a3902ea1eeec3774ff3643650bec2daf95b8172228ce39bf361240eb0d6e960906d350526466cb3a1df9116331d07e9f6b4b1bfd797817430
- SSDEEP 12288:+1XLsswWkxy2lRq2czA+zPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:MXYfDtczA+zaTlnRX9jaxOgdQ0mG
- TLSH T15D650228B7D409FAED678179C8A18501EA73BC514770E79B03A49A760F337C49E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.6MB
- SHA256 5dee544303bd87089c55d87e0bc9d6a337c8e65e6fda472903acddd0a16c1124
- MD5 fc5fffbd3a7fa3425f1b776b13be9137
- SHA1 af5194581634bd9f65ab6bf4759a0fe3ac0c151c
- SHA512 69993712c0def1d1120eb4a7d5a8e63e3c20b0a71c3776548afdaa86e414896d2a2f052081838543626deabe323f96b44e4483632554749577583896d219c8fa
- SSDEEP 24576:K0Le5ji0hmx5rMlzaTlnRX9jaxOgdQ0mG:KPji0AX0ulRX9OxjdQ3G
- TLSH T178859E16F6748731D073C0B9C5D2A68AED7130865B308ACB5286D77C2E67BE6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 0823f94495efd6a6887db16f0b07d9bdb5642d81251beb5d683045a04dd9b1f6
- MD5 ab267c4e70f0bfe8af1201785c937650
- SHA1 05359d238c759539831413b50ecafd54f462d57b
- SHA512 63062c434e90efb07d28c18df80ef3661df12c6f4b0b02d50fda38b335693df7afc7a603b20acd3225da5ad9e44c14297ce249cd79e5b86fe35f1ea9b24fb60a
- SSDEEP 24576:za7/ezSC6vUyD/aqgrvWE6q8wyuPzaTlnRX9jaxOgdQ0mG:e/ezSC6vUzPvxHjyAulRX9OxjdQ3G
- TLSH T176756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 c07f3d0f20e5bb0a0241ab68b66feb74350e96a0add34fae74591757a6b061de
- MD5 13209b85816712697f7b7cf0fc50e8bd
- SHA1 979ba024c677aea426aadaf02b534c6e4078a684
- SHA512 93e38c483ebecff8cf2da811a498c2514d0e01f38331a2cf9499dff153178f0b72670675bc181510d95047688e51377e89f837ef9e40fae35019dd2f00b40377
- SSDEEP 24576:hVbqPb88hv/l+6CzaTlnRX9jaxOgdQ0mG:hVO88hXl+xulRX9OxjdQ3G
- TLSH T1D855AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.1MB
- SHA256 edfa56922822e6bfa6a09d1b13b9d18d7b63a03bdde8d7df07ecc7d9ebf86846
- MD5 2f29501b09c8808ee13084c73077501a
- SHA1 be8111e505e1ec5d680ff3b661781142ae09fceb
- SHA512 f111e4318540da8d130b16ff7b753d5ec28e12e65fc4d57f1034179fc4e0f78d01ad5a07f4a72e004122f21c4c270c6268dfe07d6eb330c97e4769c897e49395
- SSDEEP 12288:O5ZzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:O5ZzaTlnRX9jaxOgdQ0mG
- TLSH T1EA452358EA891673FBE1BDB3729135057CF4BE6158B1572B73093BAB0031A11F5187E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 bc3de54a587d5feb55197d4e2c9b83d71986574facb9e0476f4d68452548364b
- MD5 7a5f11091d034bd6d26e893ce7a7b4dd
- SHA1 39626a046965362c4720f144d14fac09a77a3d3f
- SHA512 51b7bc8c3e2687449ddc286a9c92578a17ba433e55102b0aba9941d87b7dac4d59b59ce565ca68ed3aa5a4aeaf708294fb1ba033170de8d6740bc00371e29e55
- SSDEEP 12288:eeBNUbTVO86U6zPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:eJIU6zaTlnRX9jaxOgdQ0mG
- TLSH T16665D03BEE28FCE2C27A9DB957918600E77278304F61A3CBE165830E9E235D15D79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 c6d3d8456533b5006a16f9e3fc5cc72486dcefb31499231766613abdf4a5fdfa
- MD5 17fcc1133a30b0668e4170269c5a6700
- SHA1 4f0d9714abb2e64bcd7484b386e776d34035aee6
- SHA512 2cd2a12432f05c6cc261fc70f0e90a8bdca1fc352ba959b7753d42a10a50b2eb5da75105f76444d793a43abc53f8617a265eb0bc32d71dc04d5582b4f8b6ce05
- SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THq:vQvGAdlCEL8c/yRNw5CgRoLQ3G
- TLSH T109266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 8e6d89ca47648f2f6ad085882dbc9dea70ed09aa8cb5939e03dbdd3c6c3dca86
- MD5 41a8ed2d79fe291767de4cae0b62fdf9
- SHA1 51ff0dc1f834003652cb53927ec737fdc3f99837
- SHA512 ad5fd349bd1721ae814d7e638562b2af211ab3b9d30ef5371437581c236165b6e5b67acb6d4ccedaba3befc3e792d94caa78b17b5aed69848dcf96a01ba71910
- SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zEulRX9OxjdQ3G:UoqtVjnmERoLQ3G
- TLSH T1BDD58D0976B882E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.3MB
- SHA256 e1456a7336c50f0f9a821d69574207aad3866003407f0fb9acd030602222ed99
- MD5 c4683469fed20aa3a4cb77647605858c
- SHA1 0a247f876b317c6e624d138440b4e112c07f1b00
- SHA512 6ddfe139aeed17ab4d7419fbf8e9d538bc886cab167475e3ad70472db609c09aae8f49c6ef9745a699a269bdaadb51633f9fb3df6be977eee7de062aa3900b96
- SSDEEP 12288:rmw5HEjsChN8BFgl0WDm+CvzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:qwuxOWgzaTlnRX9jaxOgdQ0mG
- TLSH T10755F14976A90CFAE9A2953985939136FBF2BC122A31D71F1360C65B1F33311BD2DB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 ed41fbab882ccb5f3653075e14de4cb231aba3adedd2304d864110651bb960a1
- MD5 bc1156de590c4431232131e3b22f70cb
- SHA1 c0a4509600a3a98fcd67bf5ad1af7135b0b1be56
- SHA512 3516283214537bf7d21b80132cf36fd50cb4b15cddb5691fe27f6dcaf350fcd4b629f891e5c9e7fecb5357cb22a557d0b99ce586578839fc98f8649f754817d5
- SSDEEP 49152:JB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOulRX9OxjdQ3G:fu6JmVxd2dpRoLQ3G
- TLSH T176D59D13F1DA01E8D06ED478974A9233F962BC490B35B6DF0A9073562A77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 712d6c2ae413dd761d998cc0c10daaa83d709d28bbd42e06a25d95197a1432ed
- MD5 bdbdc630807211655a3c3dcaa39b4be6
- SHA1 eefa4f86e2aa88769aba3e468ae705f6b1316808
- SHA512 1bedfaf642119c101e48eeb1c1eaf19796fcca5f133751920a3e27dfd5dd8fdaeebc7c1e2b6e80971e59a4e1dcf6dc0849686a222c77d83bc21258a77f8c88ca
- SSDEEP 24576:VcP4mcvIjkGOxhKP2l71nNKbrh/8KB1zaTlnRX9jaxOgdQ0mG:6P4m4IpOO67W8K/ulRX9OxjdQ3G
- TLSH T16265AE2DABDC0096D0BA917486658A49FAB1742A1F3286CF1160933D3F77EE58F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\ar-SA\IntelCommon.dll
- Size 15KB
- SHA256 9dcc12cf4697146628f3bf6fffd0a3af988551447d4b4cff5c9d6dc3c232b79a
- MD5 64bd605c042985c1d0a8c67729d34bc8
- SHA1 cb0423a49753ce2ce68f7174f1b2245652207d6f
- SHA512 62a1168358659e43ff2353abd943f13e46bf5633526a8038b14d87843fc779de18ac684a8a16b0c0d77a2684981858028825c6b4103043e67f46238eccc9fbb8
- SSDEEP 192:V0Bff6gCETCy9AI89kiLmEoXugAA23MiekMh/0l:VOMETCyi9JaXu428P/i
- TLSH T13A62A8109EA9C23DF0939770C597CA5362689857ACE9323F8A708F1969D42708F1FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\cs-CZ\IntelCommon.dll
- Size 16KB
- SHA256 4843117186aa2c347e9dce6f78d4a4b1ffe77eed8b5b8f3c62af2db631d5c40a
- MD5 e04c5a8c731ab56e8bb68572fb9e6dbb
- SHA1 167128bede2fdb066edaf93a2198b28eaae8e398
- SHA512 51b6012d560a6d52272366efe39fad91319283ef142b550908b6d60f47b06f8e56d833283518b0d17eaf05908682e07c69de1debfb17a04f85e418d31cc78130
- SSDEEP 192:BKJM443WgxRKBgY6zxx7zypdPz6wLjp7:BYM4WWgxQBH4Tzypxz6+7
- TLSH T110721301A7FC0665F1F76F7279B606A25D7BBCA27A35C60F4610469D2830AC0EDA0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\da-DK\IntelCommon.dll
- Size 16KB
- SHA256 87b349ebf9fd8c107daac7c54204cb827330660d37b53d06e9b2f387622503fa
- MD5 d4d4fed88a5a52284a9dc1c59dd655c7
- SHA1 f393b8d1423387b0c10304f804b6bee5dadfc90a
- SHA512 ca8bd1722e855b49e527e7a8e108ac7904d610de8ecbafffddf13cb4b190083e37c53a24c30ba4c036a105f8253f89f99496c9f994d1a82d65ee5c0f27b4f9ed
- SSDEEP 96:P8IAH7FK0XwndHkHSiV1pn2ur0brHmyWBkw71l3ok9FnuncdKw52afLNzO0GxziF:P8/yMrbnV8TggnVQERq+s
- TLSH T1FE72E261A3FC1629F1F32F70BCBB0655597ABCA6AE39D21D1600149D1C71B98DAB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\de-DE\IntelCommon.dll
- Size 17KB
- SHA256 762bdb9d4d98bf6fe1417e67610ede34ad0a532991542433785d9d279b096ac1
- MD5 473059aa78c2cf98b72b2ec891166d84
- SHA1 1e8d62322f1a15f12b5ea292e9db8509482f874a
- SHA512 9fa40c27b95753e39fa9ffe517defd9d4412f5a23e2329583b343415dd9ccae10974d5c66d4096fc4c8173dc976ab4d06df7dbc4968cdd172be2919640c53ef5
- SSDEEP 192:1iWFQKuO6wIfJY29EP0txfimGd057ABvR3Q/u8:1eKuO6wIRpimGd057ABvhQ/u8
- TLSH T1DF82EE10A7E95A29F1F36B707DBA12946E76BCE6BE75D61E1700248D2C31B40D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\el-GR\IntelCommon.dll
- Size 18KB
- SHA256 2f28aae16e89b3ddd311ccfb5de7d60c7ec5afd074510d4df498c704f62f3807
- MD5 b79c751cbc8e036c8abab8c57e08d165
- SHA1 e773d8bd4041f410317ed70d53b14f97a0467e68
- SHA512 8698e32df4f8aa2cc399a43878c0aef388da082bd2f79d4495091b88aabcc487ee155f27e6a0745860fdad21e104f959d6136195723293d5fe168d2a68f279b6
- SSDEEP 384:V2dB38MJR0OP6fycEHApljyZwm1m4l36taTM:V2diIWf
- TLSH T11C82298D8EAF1721DEF55DF2547385265A6EF8821420EE7B72F0304DE86D8118DC3E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\en-US\IntelCommon.dll
- Size 16KB
- SHA256 ab3ea369a5083b4354e8c978a3f6a202ac8d2f01ff4ac323509cab35e6332674
- MD5 183bbee140a469b0090853e2ea5e2b66
- SHA1 c8d8f37499b77fa6225ade511e8924481c0a3c70
- SHA512 686b3759b720542e2d3b1e66e9b82a2053211689d60a830109a614643764cafcdc718be5e8804246fda6271c94546be2b9c328eb12672f915c9e3726af176fea
- SSDEEP 96:5iHe0EAZwiw2u4p5DRI8qx1V1wo1g21yCOBTdv0EJjwxOLvdZuiyr/EWix29tgyX:5SewR8/X3iNGs2zdr5Ynla1IUf
- TLSH T1F472DD51A7F90628F2F73FB16EB616A04E7ABC62AD39D75E0600004E6975B44DDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\es-ES\IntelCommon.dll
- Size 17KB
- SHA256 0c13381abfc382a1d83f9e207e555ebf77eba35a078807bed0f6efc8f608afc5
- MD5 bcec2decf4c5dd9da2aeea60147ea32c
- SHA1 1edbcab13a0c49390a317e5d581ee6daee7684cb
- SHA512 ec53936cd386122cdd0a1d036adafa0b03231df367f8a2e78a483e295362d877da93b1c3e16ca129828a334c63f481add60d6b83f0110ed319a5557be01f4ac0
- SSDEEP 96:huHyOvkZMX1WxBG3wgcMuorFYUtmWnezlg5yuog9PPjsFYXkqT4m7qehgau3bReq:heygkZuUJqQKPrBAL9cQOGDJE/Ql
- TLSH T16A82AB40ABF91266F1F37F35A9BA1AA54E7ABC52AD39D10E8710056E1870F44DE70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\fi-FI\IntelCommon.dll
- Size 16KB
- SHA256 15bc042d61af139e46222775850dc32aceae92d90bff54036b137eef356eb308
- MD5 541a799f1107aaaffc1d6ef39c615766
- SHA1 4f69d8c7ef0c57daae357871db7daef1256e7da7
- SHA512 89fb3a78ea3f26e924a1a65d1e0349087574d0e384d084d3fc75ff5f6b2269df0b551ef16bfc7e670a9e9297e2b24d9d35595df3a485240520c00f5055cf440d
- SSDEEP 192:Yzny6lT6jKBQGEWy+JdD8PEEkrWEMahzqTLDJ8qa/PNyRo:YG2Wu5dDPYDuJ0Ro
- TLSH T1AC72E19497FD8664F2F78F70A9B652414A77BCE37DB9E25E0B00541DA930680E8B0B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\fr-FR\IntelCommon.dll
- Size 18KB
- SHA256 34c95716b01ffe5fcd094a583bce2f0c0b38e04927bea0226102656c20ea099d
- MD5 13464e2b2d8e55ef8e316b82884cf9aa
- SHA1 825a5b8ff513e80b244f82956d3404142441acd4
- SHA512 dd114887379567be30075f1b23e71b9919c72512b4d23730526359123ff8cf54da9b081147c14ac1ec1d44f514174b220aad8f0aa90dde2d35728a1e14ccbc4c
- SSDEEP 192:hyxHIrbZNs0CkyMkF8osnMkBCkspkI1kZUK/yOK5OdxNK2GuVVvbVTXJaAh1G1qu:hCHObZNu/4nL7ZU2FdxNKkjwq1BpY
- TLSH T16A826751A3E90652F6F33F31A8BA16514E7BBCABAD35D61D0610588E2C74F58C9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\he-IL\IntelCommon.dll
- Size 14KB
- SHA256 2ae923043cb58e495444948f812ec94155acb5416ecbdfb167ef18047d372032
- MD5 36e8a9c009c2b8b8e7f3f09fcfb72a3d
- SHA1 4a52332286481299c22c42646a9180ec96ea3cd7
- SHA512 f93d6de047cbfaa6019fb5c7cf3f8e63b8a466f0e388bf2315fdbe79e14192d2a694ce1fd838b9c468cec8d3e7be7421fbf6a7a3ebcf081c6029e25631874d33
- SSDEEP 96:xYHo9KC3TSivcXgXLOzGXDjr3ELnu66HzM+ElZ6sfMF+KcShizF1:x0o9TcXg3Tjch7ff
- TLSH T1D552A981AB81C5FDF864EF33D76B0A2E9AA4DD48256D771B981818543DBC7908B1CB3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\hu-HU\IntelCommon.dll
- Size 16KB
- SHA256 ed5dcfec16018b3b094537d624b0001809eea35bdd79deb186dcb09f5d3f3da4
- MD5 314bf8eb946f2d06f5b8b28bd901550b
- SHA1 d5b1ec8d7480cbffa4bb5ca787b5fbdeab9a43f0
- SHA512 dc4c82ced391f7eb28650df14a6c279d173b1977707f5715bcd594208f58ea75788ff9d8be2dea4dc99ac4e3a863eae203ee738fe5816b33d5e112486c6e25e7
- SSDEEP 384:cQJYJXxyMxRJ1JGiGqMs3ehgmfbOcMlgNh0sc:csYJXcMxRJ1JGiGqMs3ehgJcMAh0sc
- TLSH T17372C241A3EC1556F4F38F723DF657960A39FC75BA3DE30F8940928D2935680D960B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\it-IT\IntelCommon.dll
- Size 17KB
- SHA256 b41425d1bbaa17adfa90cb960f8a991f9606df6da6ef4d3a3257aa6b4f2b45dc
- MD5 a5c95e01adfc30f19746c6f0beb0e971
- SHA1 dff809bd415e0fcd5f91ee57ed4d26cb585b6757
- SHA512 cd0dd0b4b6faf1e598dc861c4ec93487851f7cd20c7fb16ce3303291413778ec4f0e5d7ad99f54f3f97c939643a8efd28dfaaf08bf68045ef3bce3b7410b95b1
- SSDEEP 96:NKHEe2ZilrmxjtthUGBU9NtkvcVQBJjbpPVbPPnegqeDdpWQG7s6AnyfRPa8Nc+l:NaElilwtdeMdX62ypa8uCwSHOzz5C
- TLSH T10882EB50A7F91665F1F37F30BE7A4A984D7ABD66AC39E21E0600048D6871E94DDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\ja-JP\IntelCommon.dll
- Size 12KB
- SHA256 00d13b036e74ba1844a8a0f403361e52d703f0e8ab41f873e5c72f25180c5d37
- MD5 be01e7b65b441a088d3aa04dcd74ec0a
- SHA1 4fd3598fa8b00f444818462bc022622c2a50757c
- SHA512 5df3993e855ab9ee7c366fd9314852ae8fdb60051aec801d3b3e50566671440d8d5a57aa423460df49051d073db67de8695a4422b90df64e149742839c3e83e8
- SSDEEP 96:ITHRmWG2iklZEC1iP/YGglBaq6voE6YxDUfR92rsV8qShizF1:ID0fDSEZPwXlBaHvoEnxDUfR9R2e
- TLSH T101420088F7E14F2BF4B6C6B014E77AA13A58FC28B6A24B961F40580F745860D4F46B79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\ko-KR\IntelCommon.dll
- Size 12KB
- SHA256 eee2b03e011e02794e67f43dfdf51e4653d9b504ff90985efe178bd977d012f9
- MD5 d4bae5e84969776195fed58fc7f8c4cc
- SHA1 33d9d86437f4d4a7984941e0097aae7defbed86c
- SHA512 e3f39606c50431c7bc71345b6ea767bbd3ede58c3e7733de2d34787815ea580297aa84e7dcb775588756bd5ea343736a481e14da12943b37469ad0111b16d3bb
- SSDEEP 96:VkHE08w9YNTOSuz5P29+nJ9nrrm5a4GmYTRmdWymhrFstShizF1:Vgn8jNBuB29+J9nremRmPgM
- TLSH T15142431ADABA9033E0D1A9B557E343D6926DA813BA43571FFB00901C7C547588FA0BFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\nb-NO\IntelCommon.dll
- Size 16KB
- SHA256 52abfc18c356b0dc681cda1eee88f0f2f81a4bcde2f4c4810c395ee7cb24343c
- MD5 371e5ae9d4f4f8f4b636a39d3f4bcbe9
- SHA1 de21be1fe10660f07fc84f579068fbd54d469452
- SHA512 ba049289ff90f8a6c98f127e6b3091befbfe2c4e1f8582259c610278ebd44b23a381f4a138b1f08aabe1dc00b95f2d861c388238120d37cbbf10555e4bb287ad
- SSDEEP 384:ZZZp6Kaq6Kaq6Kaq6Kaqv/Pfv/Pfv/Pfv/Pfo4IYo4IYo4nRn+/spHy2A1N8Q:ZVRn+/spDA1N8Q
- TLSH T143721490A7F91619F1F72F717DB906555A7ABCA2BE39E21E0600104D1C71BD8DAB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\nl-NL\IntelCommon.dll
- Size 17KB
- SHA256 ab7881d05b6ca12b8d16f67fded3d18dda24ecbfa084a4053a88b88d338d6ad5
- MD5 22020cd950c6fe819f2d6fb8adaf6944
- SHA1 a87d2e08e9c7272adfb3b0be7596927330ae2d45
- SHA512 967ed44fe76f62c7b5f8a54b4a6e185e1098e811dd8485107535b8f1eb250654c8ad76899dc804b127ebbb7ac7e6f9d0c9546878939804354b8d2a20aff7161e
- SSDEEP 96:QfHNxfvtdVTQb4U0sxr9uRidjw1WnWiVgb4bITFv01jJr9bdeUqGj37YwmIxMFdo:QfNxnSb3bX6qx11RdNmIfBN
- TLSH T1AF72D211A3F8462CF1F36B707EBA16505E7AFC96AA72D65D061015AD5C30B80EEB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\pl-PL\IntelCommon.dll
- Size 16KB
- SHA256 b01b305ae3ed134ed3caa450d0dfffca840673979d555239acb874710ba4ff9b
- MD5 f17d1fa25df4a333ef475dffca3620fd
- SHA1 7c8f1bd6953ffe2f6db7749a371af4edb075ac08
- SHA512 677129b26b25fb1f92edd4c3e6d20c47c4ac6b6528733f9660a237b0d14bb95fca7dd79b65531eb8d447ebeef25c9de6f6525b0d8cd50a42b587652fdcef8cc8
- SSDEEP 192:QBbHNYlpldK2Me2SKwHgi6fbeltjYgR49GIxz11OtAV:QVtQ2VSLR4j1gtAV
- TLSH T17872F341A7F80665F2F79FB469BA26944EBBBC32BA35D28F5640440D5870AD0ED70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\pt-BR\IntelCommon.dll
- Size 17KB
- SHA256 cf618d0fecd88352d262ed1708f8cc8c7a2ee691c11797f924c1a64679d5e814
- MD5 a9efe63c35755dc50814272ac3b14cc8
- SHA1 9d445208050a4343c15a8a61198da69921e4705c
- SHA512 1676fda351cc3a256e7dcc6cd8e5841cd8894f74779ac96a9cb017410020fd062899ce52f94d7d6a2f6867a961f3e7411f3103d6f59047a2964a7f98c6433bad
- SSDEEP 96:FQH9NhsFM331eukPRP6BtgnZt6rSZGxX97WqFxRWRIl4QIVbDj51CeVPAeGmxwGv:FM9NhbusxVK7PTGsnr/v6OQpZ9Ux
- TLSH T116729991E7F81664F5F36F726AB926558E7ABC52AD39D20E4610046E2C70F40DEB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\pt-PT\IntelCommon.dll
- Size 17KB
- SHA256 ea64f676a5da7dddd87254bad41253166cbb56066cee1671f17dda7c77bc4128
- MD5 4e966075c1a659e131f19a5a0f96e9f4
- SHA1 c286a481efe0c7767be4baaf6efe5af602e9c246
- SHA512 5c1541c1850d0412e0dcb7409a6eca6f474f6279cda1fc51a741e501bef6c11c24246311831493b9c462153ec61987e5b607ea638bd41367902d74f542a1d851
- SSDEEP 192:QfXgx2ZY6Bi7luVEfOWLYKsateQOYLxyqU1/EU2:QW6MlsNlK5texCyz8U2
- TLSH T1B772BE50A7F81628F6F76F7269B91A658E3BBC52AD39D24E0620049E2C74F40DE74733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\ru-RU\IntelCommon.dll
- Size 16KB
- SHA256 49c985b0da15ec07a00dc9f35e64a50c50a8192396929585c5c43847b63c2fd2
- MD5 e23459cee297ac0db4f3347181db15e7
- SHA1 cc0bf2cbb1bed06d8e08dde9990664fef96a56c4
- SHA512 f5d2676839ce0e17f205566975c33ba35b30a7a84e440caf2e5cc57146eadb223d18f43ca6b991fe65b1871058c0d7f6b67fe776ce89639077f36ae3896f5d11
- SSDEEP 192:QbC8Ghhv9nBsKLmTs2Hb+ZLT7GYL2kpRanmxzNr:QGpBsKLmY2Hb+Zn7hL2Rmdl
- TLSH T1B772454FF6BD9960F459D2B50F6749E7206AF710272682CAA69FBC68602C33473346C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\sk-SK\IntelCommon.dll
- Size 17KB
- SHA256 581d37bcbf6237f315bb14b6accaeff2b2d1837f49b9aee596f1702b53308fe6
- MD5 447dc58701494d2309b7e35bec8d3b7f
- SHA1 33074d2a063f2941600d6f02b9ce5c3ce1a2c65d
- SHA512 66fd535d5c1eea86cff4aba5a4636b33b134c887ebcad23ea63a5b65fae4bf66179414db4aa182868de28866aa74e54a113ee26fb5a13dd061d987995709ad39
- SSDEEP 192:V8VZ4QNBfhkuURzhe9se5k7kLHEOKDlAqMq3oDdxAUUL:VSVfhkuCzhe935k7kLHElAqn3MdxAUe
- TLSH T159724551A3FD1566F1F37F75A9B106A54FBFBC66BA36D20F8A0042591830B80D9A0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\sl-SI\IntelCommon.dll
- Size 16KB
- SHA256 9c6507fa4d52fb553e70bc8d15203dc7586fd6fb28e7fd9998de94573e5a8cef
- MD5 c25a1570eac8fc2af30f168a241141ac
- SHA1 324eaf9434d17a2cd489f04c9d810e5e6cdeee4c
- SHA512 aa67bc0a389c7c3137586ba7817f19a5e5155130642ca8720cde416d2a77b61d130095a0c51af481b2a2e75a7e021cceb31c02b3a65d59956313e1a3f6af26e5
- SSDEEP 192:1mt/In126m4OeR/+kZwAHG6USfBTREpkHqxSz8qJIpAd:1P126mrB65TRbvWSd
- TLSH T1BB72F042A3FC2659F4F76F7069B507A18B7EBC75BA3AC21F4210129D1822790D9B0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\sv-SE\IntelCommon.dll
- Size 16KB
- SHA256 dbf75fbbf1c643a218e99769a265c52159414ff07ccef9ef8d9739a1e1002e36
- MD5 6ff2bb3079a2e1c56fbe428bbee0c327
- SHA1 0168eeed4277795c26b7077702f4a4b709c77124
- SHA512 68ea9287b1b8a55caa7f034451907f695736b3cb317957820f076ceb2ab4886d2a22097012c74a7a57715e7a6df3a89a966dde7049ab770d574b4545cf0bcbb4
- SSDEEP 192:1gELo043AoyvpTzrsRevdm1bqtWCCUq5d3TEG:1Tp41yWAdmqWhUqDEG
- TLSH T1CF722881A7ED1669F1F34F70BDB6469059BABCE66E7AE21E4700059C5C30B88D5F0B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\th-TH\IntelCommon.dll
- Size 15KB
- SHA256 3bde78806e1216f5f8578863eb7b131ab6c29422dc2ca472f4dbc074cca4c97c
- MD5 ead185215027bd5c7ca33ec73f529674
- SHA1 fbbdf28dd8366016d9c6db23046c343578e7a109
- SHA512 a811cc47b60831ced3ad6392b12e432b0eaa204f94ab51976b92b3c3277e6caadeef31c7a7ad55b62e0e0f007c1c156783c83141d97ef101b0c887ffd2993106
- SSDEEP 192:lqazeO5P1U252kHCzg+cOWC/x5desFUJHW:lTzhI2HCFcXCpresFUJHW
- TLSH T1EB62CE35E7B21702D04AC1F0E2D25EA37D2CB812E45B9246C56FEE28B560A746BF1D3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\tr-TR\IntelCommon.dll
- Size 16KB
- SHA256 e5330a38a8c5643b5850c9e77a4006cb3d443b46e105e9fe015ea8adfcf774d5
- MD5 08e75114a82382636d54229ae7ba8413
- SHA1 97f719a377bdcdf0bffdbabd62b69c93179a85c0
- SHA512 2de56c9b070815c132d642fe6a4b0f51de78f8da9d8f78b36650e47d131eeb178845ca0f8a79106c8694d0eab8943fc16eafefde33c7adcc0fee599a78d8c078
- SSDEEP 384:hZNEtHk8ZMHqRDEbTovRIfoE6xDqRgk53iALmU2Cz1l:hj+ZM2u8JIfoJxEZhiALmkl
- TLSH T19272310493DE5A2BF2F30F757DF6A5810AAABCB37E31925F5711501968302D88A64FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\zh-CN\IntelCommon.dll
- Size 10KB
- SHA256 720b8c0acd1e54f0aa8bb5fe581859a0bfcb6e90c4cb99702210e087e9fa4f19
- MD5 b1d13f08900e6472ba48e4deb8e0bc4d
- SHA1 363e1ef6efc9cfb7b0a5993a679c1585674470b0
- SHA512 66541b8d6260d74a641b17e0922f265f288de28543fb5e9acf0d38a22686b5ffe85c64b2f504bb178bbbfc9a259b061a9ded10fab49aa6650d7d9e182738b6ef
- SSDEEP 96:svHZQFiUOUg3T5bGmw/gqmfaf32DycxBLe5TSnR1AHShizF1:svZQ7eJGmwgqmfavmtxxS
- TLSH T14A226385D7E00E3EF2A3463196F74A12772AFC506A638F0F6D40699E385C720DEA5735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIFE2BF.tmp\zh-TW\IntelCommon.dll
- Size 10KB
- SHA256 3ecbc68c1d442af25c6fd1446200439851fd47734a4d12187fd89410344fbf37
- MD5 3d7b0c192b1adfa6c01298b23826b7b8
- SHA1 78b733deea4f21dc93cc84a7ea2c93b64df9341e
- SHA512 58087fcbeb0a2ac6f829c797029fd5fb6d87f7e4fe4de1d576892ee5a952105e99d901af8e8d3a2cfb4c41a5f0345245f6218610db6c3128fe6c8661919ad302
- SSDEEP 96:VeHf+dGHhAGaNhuzmDRI/C2VkhW3agljIYlWd+uOU/HIlmLTvS4ShizF1:VOf+dtBznDRIK2VkhW3ZjIpqlmPSI
- TLSH T1BB228580D3CA092AF0539A349AE399F3BB7EBC163666931F9F41484F78606049F55F72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Intel\Logs\IntelME.log
- Size 8KB
- SHA256 9e846e7b94cbc84df3d8f297843e9a5dfdcc3f73d1af21bd5aeab984db1fb817
- MD5 01389e6aaf42e4b41d1fae996dd6ac41
- SHA1 00223e315542e771823a9c31d60ff10c61ec936d
- SHA512 ce56aea2e7cc84c72e30612c17ac6b89d3d4298c993f0d9645e21f93e91e97d4da5bf193e580847d92c7feba9ed9e0a994bccadec79ae6a2fa015778dcb3e7a4
- SSDEEP 96:VNgY9YnB6fnEfnJfnadfnafnrnnxtr74zwunhQr74zwk0s4:ngNnBincnxnalnCnrnrr4lhQr4q
- TLSH T110029B1F0FD2258FB0B2DB1388F38527A6727D9366343E5D24E9874A0693105B980FAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.1MB
- SHA256 026a86aa92844a9178ecf0f11ffdbf77b8cc02bdf07a327b6ab8629005cd42b3
- MD5 406c7c47293a8fef99bbdcb64e704281
- SHA1 b8075c286dbdd2f1b7b9a9dca904b0eed86d46a5
- SHA512 6896e4c4294357eec6e3b94f5ccca07f489e936f03f55fe99964e6d4df9cae51890cb9006f692a376c89936d655413390b0b42c4b87078ee0860bef952537a8b
- SSDEEP 12288:c9zPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:c9zaTlnRX9jaxOgdQ0mG
- TLSH T16C45231CE6CD1B73F6F1FDB2629161047CB8BB629D71526B720932BB0131A51FD287A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 65ec759c3cd1da3454559d33014e4a3c937f08656be3316ff4b29ca8a0bffdd2
- MD5 d746d7b5386cf259fa04697fe1116180
- SHA1 8606744d1f53520c707a586b79b4ae0f278585f1
- SHA512 7737c2a4e2180a148e229005d873a2b88f101c38667cb4fd6535d37c623b8a7f3dbda0e445bdad66dc4cbde05fc38e02c74dbf7f5931689bdd6e2f885ea9106a
- SSDEEP 49152:Ma0h2GEkuAe73q3pp46zwwQDulRX9OxjdQ3G:Ma0hNYG4JwrRoLQ3G
- TLSH T141859E1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE48E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.2MB
- SHA256 caa3964d717e3c178f4fe17e6c4695c27f9c0e0761751c6886de914fe96169f1
- MD5 f0781b2c564dc79f1a0fbf3d31b56a6d
- SHA1 b6b36519ef1db38b1a41ca249e63dde32c07d025
- SHA512 3542382226b679056a30d7dfdcc6547a2e7ae36ef5179207e280e9587256682ac9174d4fb1f04bbdaac6ffd2d8e0a582630b129239200ec4bededba89972e98e
- SSDEEP 12288:7hbHjfX4zPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:7hbHjP4zaTlnRX9jaxOgdQ0mG
- TLSH T1B545127D669C21E6F1B1E5BA92915506EB70BC26172163EF3381427A0F37ED0AC38F91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 d4627c444a30653128009152107a5f3324a9a7e509c7759f30422753fbd8d7a9
- MD5 04ebe15b20dd8f24b8595bd39cd76ee3
- SHA1 6a168af99efb1b2d47986fd6b85a63afcbaeb8e8
- SHA512 b3ebe9c491bdc66fdcf4eb5eaa987e3c17077b788b6d54cb4fa34c84e8cfb63d6ec897c53aba887129552b8759664f92231af63428ddf43e8e6cb30a8085a0af
- SSDEEP 24576:N3YgnJcRTk4yti+R5dBR/gzaTlnRX9jaxOgdQ0mG:NIgnaTk46pBR/gulRX9OxjdQ3G
- TLSH T1DF45BF2DF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C638AF1AEE89F39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.1MB
- SHA256 c8748aaead9050ac896da1d6954771fcc02463664e7a2528bd739d2b007cbc64
- MD5 02d5dd440964568f18ca2128d72af3cf
- SHA1 e503e600d31a4a07a62bb4c489d9bfd2c24a6cb9
- SHA512 89232b0ea299db59f796016d3565e2cae458bbce349f7171cfae39fef679d64648d1d88a217a9d7a2e23a4aebe59c808b57fe51e035b196086d0fd8d91848e22
- SSDEEP 12288:a5zPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:a5zaTlnRX9jaxOgdQ0mG
- TLSH T1E135235CF68E1B73E6A0FDF3629135047CA4BB525A7213EB320936A70132A92F5387D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 80750d49de4aaabc186f678b960717d5052afab7978b873ce98b332ff14bb76e
- MD5 aa308793980a76fa049ea99c79c534b7
- SHA1 c581f02fff652da2ad8bda5e481c185cfe2d3dcc
- SHA512 a90804cf248613b7da44f41bd36f7907fdbe4dc18d33bdc59c01c1441e109462a1c0141fcd6d5c87da75a73166c77f3cf29285e08910859008a2d5b1e86485a5
- SSDEEP 12288:oObGA4LWOsvAYFT+zPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:FWL3UT+zaTlnRX9jaxOgdQ0mG
- TLSH T15965F118F79400F6E967D13DC5A29602E6B2B85D0760E7DF13684B661F237E28E3EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.2MB
- SHA256 125f4c71c4a72ee4f9750b1612aa6985c184c3d886d6a3992d6dbc2b7fe7fa21
- MD5 addef454e4292e94817f702320229839
- SHA1 859c8860d95c5a180d5da30120d9022110c1119a
- SHA512 4661f3dee8d4af19aeccac5444cce27fc637dcb8bde30aafa2cbbf74c29dfa62f6d0de87afded2b8962a057c526dfbc2f04cac8d9fc7b18f1dcefa2a2c17a2f0
- SSDEEP 12288:qpFtIOazPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:JOazaTlnRX9jaxOgdQ0mG
- TLSH T19645021D36DD11F6E171A57A96925209E7B1B8620B2253EF128041BF0F73FE4EC39BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 26e30729d1f9d7fa873f86d1e3d934a15d329ccb2890849a0458a2084c19e8f6
- MD5 01787ba55a53c96e16ca9e5bf652fbf2
- SHA1 61659876dc5ecf8f614f53af77c2ee2a08873354
- SHA512 fd4b578476f894089b4750798bce9f9d5afb9750470c58e4cb42b3934fb6c30dd864362236166311be41bdf9db32687a6733dbb2fadfa62d3be50fe84ec10d82
- SSDEEP 24576:V7NM9YqZqmWMUkPjZM48Mv6bEhsNzaTlnRX9jaxOgdQ0mG:V7cBWMpPjN8DbEhYulRX9OxjdQ3G
- TLSH T18165AE2E6BEC81E5D476D13DC9A28205F6F1B4611B318ACF1252833E6F37AE49E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 30307361837b1ab2ef86bd6356c6c5f9873661a069638d72c71b61ae782e6233
- MD5 2a71f6a14c19de4791841ccb2c640f69
- SHA1 1cbb0a221fba05b79e8d15f6a338c35d678e2d76
- SHA512 75d460ae26b0e674c7132e9bc159a74efb16a80ac3420c0f3ad3eb1e680f040895c324e33a5618a1afd0a559e69304b512e940448b002dd60846d0584ef67b5b
- SSDEEP 49152:qF2YuHNETovAvNYf8kmtulRX9OxjdQ3G:j6BCf8ktRoLQ3G
- TLSH T100858E2967ED80A4E0BBD2BD45B6D246F9B2B8511B3056CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 8a47f903760f7d417c50c1c00df90ecdad443434777f2253ecfbd25db512bd7a
- MD5 7640674f3e70d608f825ca053f437f21
- SHA1 539ebc9c5f5bcacd59a94f4d39cdd9878586d18e
- SHA512 7bd8e8579250c04104d829c80d622211e80ee7ca6ec110d3604e0997017e5620808ea6fc9cda163f4565e937b0e721557b9e935ca83846a4a66f8a5940302191
- SSDEEP 24576:AAFs06+Omlf3NXEbTo2zaTlnRX9jaxOgdQ0mG:VFs060lVXujulRX9OxjdQ3G
- TLSH T16165BF2F66EC00D5D07ED17E8997C91AF6B1746307215ACB0260867E3F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.4MB
- SHA256 484e1a5be7401fac39fe98f5138a3b791830ccdbc37bc579f282ca29d5b7ca5c
- MD5 f2df1136d9f2578b7bae38991f65de6e
- SHA1 019ff70a31ae44435f8959f0beac8d50b3772db4
- SHA512 f76de7207aeefbea189f31347c73de806213e2b4525fa841d4b27daa77997adced710729ea6dec3faa48b9e793037da43a28d56bd800d076ba1a669966db7517
- SSDEEP 12288:+CJnJ5D3VkrQzxtzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:PJnJ5D3WEjzaTlnRX9jaxOgdQ0mG
- TLSH T16665D02CD2A810F5E4B7D2B4819A2745FE71383D2F226ACB2464D5353F22FE0A979F54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 9338cae6589ae5e23a40a234668f947b222ec8ffd2fd01dbc297245fd1252905
- MD5 1a832ff6cdaed8ab381dbc96bcc88cb3
- SHA1 83f20244dbe77399a5146fa739b04f109bb77396
- SHA512 45db5d86d092361b29becda21916fcc3824b452fd2e99f8fce2cf1099e3489654a20f3163c06db156dbf0d6b9bfee56aaa14b57ea9694c490ba79fc6b4396426
- SSDEEP 49152:xg06DIKdwc+eQnSt65aVxulRX9OxjdQ3G:6IRoLQ3G
- TLSH T1EC955C15B7EA5295E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.2MB
- SHA256 d5b55e0c402012dff966c1dc52c468859d28b468d088e7d910a39cd00d369b6e
- MD5 7fb43d978f58a86d4fcc7149a26b23a9
- SHA1 5742d202116737e56fb88772ded322cb771bb5e9
- SHA512 9d036cda022eee87fe44896268dc89f535d853766fb4c73f3a6a9f95688a668ad5f6267ad701e1b0d6028ac55c5548df51d82ffddfb9ef262a64f3c4cf9234d0
- SSDEEP 12288:QEP3RYvzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:rYvzaTlnRX9jaxOgdQ0mG
- TLSH T1C845126DB79D20F7E166E47A91914504E7B1F0712B6223EF2281927F0E33AE5AD3CB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.2MB
- SHA256 6bcc53cca4bb9b81e285ee8e528fe9418260e69f060ed9fe67b1118395bff710
- MD5 ff218f211ef7f6db813827e784e671e9
- SHA1 6447be76afb7828689c0b52bdebd921955831b69
- SHA512 9af7b45e01c263d24b5338201678430d7ac31ec2e9adb17e9df4204366909126a38c3cb9eb14bb89fd55b17d32e33de151b4278a04d064cf072e3a7192974b5d
- SSDEEP 12288:kjkyozPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:kIyozaTlnRX9jaxOgdQ0mG
- TLSH T1C5551208A3C825A7E6B59A75A6A25144AD74BC215F3153EF7180B73F1B32BD0FC34B92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.1MB
- SHA256 d88467864c2166f6bd18104a4f824526d3abf6794069866b2ce8e112e4e61e0d
- MD5 6aa7a4877eb551e68a3572a65db6b765
- SHA1 7809c5dbdc69088ce6358d873e482a03edbc12b2
- SHA512 648608f6b456767b9451757188960f1816ba8ac3934ad7241139707b05556c3d3889a2fc93f00f6175c0553ff575f6546b76863d61a5c3a39865f7d3805404ac
- SSDEEP 12288:rqKzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:+KzaTlnRX9jaxOgdQ0mG
- TLSH T18245231CF68A2677FAA1ADF2629135007CB47A715B7122FF324976B70232B81F534AD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 5c8864a0e317a6e89a505074733ab11b4e135dfdbbac733c405826c64dac06a2
- MD5 3d99dab072b8cc1712570d6cff9a9578
- SHA1 fb1ef49b84b119c10a143b6177db983fd395437b
- SHA512 650054b2a7982fecf844fd069905e60ee7e390ccde8c9e1c3bf3ffadce610474f333e5e6f14cdad40a9e32bde9dbb47812c1523b1784d3c9a19db11e0b897638
- SSDEEP 24576:tQ9MxZKdcz9dw3FzaTlnRX9jaxOgdQ0mG:tVKZFulRX9OxjdQ3G
- TLSH T173558D2DABE9099AE173D27595A250C3A673B4311B31D6CF2448D03D0D7BEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.3MB
- SHA256 f194de47aed9e0a42b64e971e82e046047c07d6b00d13a2d57a3ed0b0d1d8e96
- MD5 8381200af8f70015db15a59c9742fa87
- SHA1 1db8f78cb5cc2a8141272dbbf34a3f18fe31a8a3
- SHA512 ea297e0302edc9d4ef97e0e6c0c66155d6eec5b5b374ea1e0b1387464f8b3be7edbd06c60b1e2e10418db1950f61acf59ec93aa8bc72d32fa7fb8af374077f10
- SSDEEP 12288:3yoKo2eRple9pkzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:3yoc0ApkzaTlnRX9jaxOgdQ0mG
- TLSH T17455E01FBB6D40A2E172913889818705FBB3B4705B6253DB6691C33E4E33AE9BD34B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 617faaf8ad20af5720a773b360a16f7218bcd7d2c05d5e9a3da35ec2d84eb637
- MD5 3a6e86a94dd48d44ff23c6695c0d076d
- SHA1 3ccd7b639aedf30f3b33672fb76198c96c686a05
- SHA512 3cbb5fe23c3abc0c0c9c03208961faca6ac9618a25c71a200092bf6ce6efec0b727538f95df3a6a4392709f5bb9a8a1b4c41a9218f21288089e01a60ad67a674
- SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKkulRX9OxjdQ3G:i0zuNIZRoLQ3G
- TLSH T148A57B3DA2AC00A9D9AAC375C1451366EE71742E3F2065DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 5ae05a437e619c3b5479fe4e0778fca3a74b1142c07cca62f05a432e12587f99
- MD5 cdeff29133f02924bd07aad5ffd93314
- SHA1 ac86d6f8b4cb0486efc169e958c3cf9c1f9d2a2f
- SHA512 54dc6ced59618d94f1f26d26a9fcce25de5dc8a9f594f09aabb2b3a26ba500dd2ad522e7f95276bfc94aa17f75a1f12efb82f68a9de28a553d0df6067929b1ed
- SSDEEP 24576:E1QT7EcpfxR+N5AWAz3ooiYtjMqbvzaTlnRX9jaxOgdQ0mG:5TDxR+N5YzTfjM6ulRX9OxjdQ3G
- TLSH T11355B02EA7F915E9D1BEC5799A238502FA727821033193CF42A0C17E1E779D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.4MB
- SHA256 2b616f8d8b34a107e66075601a20a3d8a48404c165573b9a7f2b45a6fb4cc6f8
- MD5 898979f7c38e9a9401963d7b7c300316
- SHA1 3504e53cd0ed71f55f5c47288d8cd5a522f38f33
- SHA512 37aaa49e95c567650c18ec3c86e2202309cd8039d61737c2005335e6cc86041ccf921ba768bd839b7e3a07c58ab83cbb5a1e2875bbb199dc6fd7f30a51167b87
- SSDEEP 24576:lTMdOz0FFS+PmSL7zaTlnRX9jaxOgdQ0mG:/0K+PmSL7ulRX9OxjdQ3G
- TLSH T1BC65F13EA3AD14F5E47AD27DD6438906F9723462032266DB0690C1BA2F67FE4793DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 ba62203346290f476e81ebd3f53c19f27c0f50039f6587116f64d8de820c8ff9
- MD5 672328ed49cd5de131dd1327f57a7501
- SHA1 c4b31d59fb7d7e353db45a37f925ab85237e7873
- SHA512 e121a7ab78b5bea78014af19ab1de65a4cd7dc2faa844128b4584afead84379b9e78e81995ca3b759a4be5222bfeec2c84f258d86c1d3c0778833cd93cdb54dc
- SSDEEP 12288:E4d+zPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:F+zaTlnRX9jaxOgdQ0mG
- TLSH T11945121CA7DC35E2F5B1A97296621105A970B872173127FF36C4D6BB0B33AD0E938B52
- MD5 SHA1 SHA512 SSDEEP TLSH