Analysis
- max time kernel
148s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
Resource
win11-20260130-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe
- Size 1.7MB
- Sample260423-dpr1eshw7s
- SHA256 ed42a45aa6539ef8910387bdbfd3e460cccec55684fec4f34f9ea0cadc7df495
- MD5 55235e8e8a784d157bedfcfe33e09020
- SHA1 17ba524a8f9ef9f6375a733d2d24bce987686d59
- SHA512 4996df329f4f610ab4b53b6c417430fc1b66c0685598e70af2c7cc7afd5a2cbcafaee67d26578c6e50b836609b10b424396169b88eb7da27a4ab2197bfab3b87
- SSDEEP 24576:i4UKRgN+SC3+I8KN9A99JhO2WDnMBztrdRQ6Ax52+Mw1zaTlnRX9jaxOgdQ0mG:XUVH5KNejJhJ2nMUgw1ulRX9OxjdQ3G
- TLSH T1C585E0117D46C673DAA442F86C3BDA84406DBE50AF6560D7F3A833A71A307D3A236F46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 3168 alg.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 1416 fxssvc.exe 3528 elevation_service.exe 4376 elevation_service.exe 2608 maintenanceservice.exe 800 msdtc.exe 4892 OSE.EXE 1496 PerceptionSimulationService.exe 3468 perfhost.exe 1752 locator.exe 3664 SensorDataService.exe 4324 snmptrap.exe 1948 spectrum.exe 1576 ssh-agent.exe 3156 TieringEngineService.exe 3960 AgentService.exe 1720 vds.exe 1676 vssvc.exe 3940 wbengine.exe 2212 WmiApSrv.exe 2228 SearchIndexer.exe - Loads dropped DLL 27 IoCs
pid Process 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\e: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe - Drops file in System32 directory 42 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\849ffdb7cd1bad80.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db spectrum.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\java.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000781ac0eeced2dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000415cc6efced2dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad54bbeeced2dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ab139efced2dc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c0953f0ced2dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2164 DiagnosticsHub.StandardCollector.Service.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 2164 DiagnosticsHub.StandardCollector.Service.exe 3528 elevation_service.exe 3528 elevation_service.exe 3528 elevation_service.exe 3528 elevation_service.exe 3528 elevation_service.exe 3528 elevation_service.exe 3528 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2768 2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe Token: SeAuditPrivilege 1416 fxssvc.exe Token: SeRestorePrivilege 3156 TieringEngineService.exe Token: SeManageVolumePrivilege 3156 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3960 AgentService.exe Token: SeBackupPrivilege 1676 vssvc.exe Token: SeRestorePrivilege 1676 vssvc.exe Token: SeAuditPrivilege 1676 vssvc.exe Token: SeBackupPrivilege 3940 wbengine.exe Token: SeRestorePrivilege 3940 wbengine.exe Token: SeSecurityPrivilege 3940 wbengine.exe Token: 33 2228 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2228 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2228 SearchIndexer.exe Token: SeDebugPrivilege 2164 DiagnosticsHub.StandardCollector.Service.exe Token: SeDebugPrivilege 3528 elevation_service.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2228 wrote to memory of 4836 2228 SearchIndexer.exe 106 PID 2228 wrote to memory of 2536 2228 SearchIndexer.exe 107 PID 2228 wrote to memory of 2112 2228 SearchIndexer.exe 108 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_55235e8e8a784d157bedfcfe33e09020_coinminer_darkgate_elex_luca-stealer_mespinoza_njrat_remcos.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:3168
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1732
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1416
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4376
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2608
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:800
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4892
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1496
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3468
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1752
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3664
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4324
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1948
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1576
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3064
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1720
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2212
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4836
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2812 2800 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:2536
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2792 2808 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵PID:2112
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 9da3d169f1dde70b7a29bc990774a8f45d61830c9fa1c25ec57a042d47548c77
- MD5 c1d6e729a777a69b8d9c522aabccc8cc
- SHA1 ee6068faccaa3d2b3a241b363f4e83073266466e
- SHA512 1942c4524786b81dbc450038071388262ba9ac639d68ea8a9d3b3dbc81817d68be97bae0c490f37cbbffe33a898ecaefdb84f3b3515edb9aa50eece25a6ef62f
- SSDEEP 49152:cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnRulRX9OxjdQ3G:G3q6HjBxRoLQ3G
- TLSH T138D59D03F2D900E9E069D178D7469133E9A2BC890B34B6DF0790B6562E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 8ff9d67d77b9c36c719358ceec7ecc95195a43242d569cff291e4c4946cfb5e6
- MD5 2c4fdf1e4e515400b5ea31a807c04b7c
- SHA1 362cd996408c00acb00c4cc285df8629b3d4078a
- SHA512 40a66b3fec09912edfb1620817f79a5f683aeb01fea1c58a13c64109f0de07ad50f4a1bbbcf8d9f239d5817d794cfc79ec322ae7af2f9c9c224efb5c9344d48c
- SSDEEP 12288:k1XLsswWkxy2lRq2czA6zPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:iXYfDtczA6zaTlnRX9jaxOgdQ0mG
- TLSH T177650228B7D409FAED678179C8A18501EA73BC514770E79B03A49A760F337C49E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.6MB
- SHA256 89ceb4b5e9efd3d694bc1e3b0c26cd80afe78088488f0c8933c34f3fbe507db1
- MD5 ffbe128de6f768bab72238284972f411
- SHA1 85ddc329c42beb41e7fb3d6632dda4b2725c1221
- SHA512 cf87aa4934880d0631060f0a1e50fce98ca200472689155728b88b2aaeee7c1cdb464f7582244688fa78bacb9e0b0d7d237fc0fad53cab1f5a60b3380ceae31c
- SSDEEP 24576:z0Le5ji0hmx5rM5zaTlnRX9jaxOgdQ0mG:zPji0AXMulRX9OxjdQ3G
- TLSH T1E7859E16F6748731D073C0B9C5D2A68AED7130865B308ACB5286D77C2E67BE6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 b9bf8030f580bef9c01578a695ef1bdd6d49991dc4d85faeec92306867c4367b
- MD5 dca849032f935957798b3eee8522c229
- SHA1 f5f3421fc59cc7dc1e1755fff71e15c13d9fcc5f
- SHA512 58500b97a3e371c9d84092a4318d5054a331cccec834af8f413f80838e29472af47d81f72196808ecf9621711f2210f3ba72637137653400a86c327dda442d37
- SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWE6q8wyuPzaTlnRX9jaxOgdQ0mG:b/ezSC6vUzPvxHjygulRX9OxjdQ3G
- TLSH T132756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 1319fc7c9cc36c321ae556d75e012238e196c5e7a8e3f101f2c3141629629f98
- MD5 df9255d7481c58b4cdbae9bb3eb472d4
- SHA1 4b6ce6ecf44918c1a7d5c41df4931c1fb0e19b02
- SHA512 c8e43fd042c3f618af2080901870a32d867af64013b43fcb119d92c136dce45f4c648ad3e91e18bd1cfa3233d101440f349f58ed864c7443184085f8c17a89dc
- SSDEEP 24576:4VbqPb88hv/l+6WzaTlnRX9jaxOgdQ0mG:4VO88hXl+NulRX9OxjdQ3G
- TLSH T1B155AE66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.1MB
- SHA256 d45957d867658fb2a93ae32bf119437f67530ffd901cc07344eac3b498732336
- MD5 2dc19f22e8512d4b95fc93eaa0f38996
- SHA1 d351aeb372c723039f3f7ac814a8c782389041c2
- SHA512 cfe9203a5a2f7565fdf4161a864a981202331dc34ffd007b3b7756ea7d8d4817d1b9ccaa2008c39ebe7966471363eda629a6d2673f0d82d7caf1d20d0def8087
- SSDEEP 12288:R5lzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:R5lzaTlnRX9jaxOgdQ0mG
- TLSH T1EE452358EA891673FBE1BDB3729135057CF4BE619871672B72093BAB0031A11F5287D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 0c5740756eef65be8e91952bcfed23bfb23d7c8f471b829867b789061d9f735d
- MD5 84b4afe7427c20650c17ba6843fe9896
- SHA1 db6e479db23d0d305e9c4ec00c0d39672a67f771
- SHA512 d0f91348c6e66dff0439f6cce4fedb312a7b79a417787615cbfb2ebf06878ee458f3f71d50e89cfd3a450c1277a22060b72fdd53ac21bcb2ade1483b771dee4e
- SSDEEP 49152:0CbRquA/m2yL5zQfFiV+XenmE3/zculRX9OxjdQ3G:doqtVjnmcRoLQ3G
- TLSH T18FD58D0976B882E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.3MB
- SHA256 d95dbb86688e8842b0ecad040c3e67d6c1fc2d60e1ce774cde8be622e719e765
- MD5 546bb33e0713d517c35ad251ed4b2a42
- SHA1 32ec77366b3618f01f50a153af710fbcccfc08c4
- SHA512 1fe86f4a30be6dcad9260bc0597eea78226542c5c1a435ec71544d4815d9a49b2b9cd1a9d7f28b8927d736918b21b320404c45b2e4152be6fd5c228f9a807a04
- SSDEEP 12288:Cmw5HEjsChN8BFgl0WDm+CvzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:bwuxOWAzaTlnRX9jaxOgdQ0mG
- TLSH T14A55F14976A81CFAE9A2953985939136FBF2BC122A31D71F1360C65B1F33311BD2DB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 3c56245c094fb53dbc779bafdf04118bbce298f995b2b46d3e2ce45972fb0a1a
- MD5 43d0242d74d31f1c20fd84a6b6ef4c51
- SHA1 7c4b927a963fc1188eedc188e9157e3f3a7ebbb2
- SHA512 11266dcfde5f52a940992c94189c74a1a89bd97c44ee863518e73786cfcf1cc782b3262a3726768181b3945b1583048c8718a3f2b518d4f3cdccb198d290644b
- SSDEEP 49152:gB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKulRX9OxjdQ3G:6u6JmVxd2ddRoLQ3G
- TLSH T151D59E13F1DA01E8D06ED478974A9233F962BC490B35B6DF0A9073562A77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 aea0078d759e5004cb026eee0341b0ff0c6cc294ade724ed61dc49d8a5da8296
- MD5 b93e0375f6250cf2641bedd80da7a6c1
- SHA1 6ac3facfe76bf9eaf2a7cfc2d4f39cb942e95644
- SHA512 3246609a21c8913ffe0facf1222d25aa127c3e6b7c03f1ed111c712007209cd06ded2d6c06c2759a90dee29842fb7bee4227f6662717b72aae2a40c36e9c5fcd
- SSDEEP 24576:QCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvASzaTlnRX9jaxOgdQ0mG:QCUxPTY+8Wg2lIL8lrIUJLWwbulRX9OP
- TLSH T19D65AE1DA3DC0896D4BBC1758A518A06FB72782A1B3296CF2160C37D2F27ED55E39F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\ar-SA\IntelCommon.dll
- Size 15KB
- SHA256 9dcc12cf4697146628f3bf6fffd0a3af988551447d4b4cff5c9d6dc3c232b79a
- MD5 64bd605c042985c1d0a8c67729d34bc8
- SHA1 cb0423a49753ce2ce68f7174f1b2245652207d6f
- SHA512 62a1168358659e43ff2353abd943f13e46bf5633526a8038b14d87843fc779de18ac684a8a16b0c0d77a2684981858028825c6b4103043e67f46238eccc9fbb8
- SSDEEP 192:V0Bff6gCETCy9AI89kiLmEoXugAA23MiekMh/0l:VOMETCyi9JaXu428P/i
- TLSH T13A62A8109EA9C23DF0939770C597CA5362689857ACE9323F8A708F1969D42708F1FAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\cs-CZ\IntelCommon.dll
- Size 16KB
- SHA256 4843117186aa2c347e9dce6f78d4a4b1ffe77eed8b5b8f3c62af2db631d5c40a
- MD5 e04c5a8c731ab56e8bb68572fb9e6dbb
- SHA1 167128bede2fdb066edaf93a2198b28eaae8e398
- SHA512 51b6012d560a6d52272366efe39fad91319283ef142b550908b6d60f47b06f8e56d833283518b0d17eaf05908682e07c69de1debfb17a04f85e418d31cc78130
- SSDEEP 192:BKJM443WgxRKBgY6zxx7zypdPz6wLjp7:BYM4WWgxQBH4Tzypxz6+7
- TLSH T110721301A7FC0665F1F76F7279B606A25D7BBCA27A35C60F4610469D2830AC0EDA0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\da-DK\IntelCommon.dll
- Size 16KB
- SHA256 87b349ebf9fd8c107daac7c54204cb827330660d37b53d06e9b2f387622503fa
- MD5 d4d4fed88a5a52284a9dc1c59dd655c7
- SHA1 f393b8d1423387b0c10304f804b6bee5dadfc90a
- SHA512 ca8bd1722e855b49e527e7a8e108ac7904d610de8ecbafffddf13cb4b190083e37c53a24c30ba4c036a105f8253f89f99496c9f994d1a82d65ee5c0f27b4f9ed
- SSDEEP 96:P8IAH7FK0XwndHkHSiV1pn2ur0brHmyWBkw71l3ok9FnuncdKw52afLNzO0GxziF:P8/yMrbnV8TggnVQERq+s
- TLSH T1FE72E261A3FC1629F1F32F70BCBB0655597ABCA6AE39D21D1600149D1C71B98DAB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\de-DE\IntelCommon.dll
- Size 17KB
- SHA256 762bdb9d4d98bf6fe1417e67610ede34ad0a532991542433785d9d279b096ac1
- MD5 473059aa78c2cf98b72b2ec891166d84
- SHA1 1e8d62322f1a15f12b5ea292e9db8509482f874a
- SHA512 9fa40c27b95753e39fa9ffe517defd9d4412f5a23e2329583b343415dd9ccae10974d5c66d4096fc4c8173dc976ab4d06df7dbc4968cdd172be2919640c53ef5
- SSDEEP 192:1iWFQKuO6wIfJY29EP0txfimGd057ABvR3Q/u8:1eKuO6wIRpimGd057ABvhQ/u8
- TLSH T1DF82EE10A7E95A29F1F36B707DBA12946E76BCE6BE75D61E1700248D2C31B40D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\el-GR\IntelCommon.dll
- Size 18KB
- SHA256 2f28aae16e89b3ddd311ccfb5de7d60c7ec5afd074510d4df498c704f62f3807
- MD5 b79c751cbc8e036c8abab8c57e08d165
- SHA1 e773d8bd4041f410317ed70d53b14f97a0467e68
- SHA512 8698e32df4f8aa2cc399a43878c0aef388da082bd2f79d4495091b88aabcc487ee155f27e6a0745860fdad21e104f959d6136195723293d5fe168d2a68f279b6
- SSDEEP 384:V2dB38MJR0OP6fycEHApljyZwm1m4l36taTM:V2diIWf
- TLSH T11C82298D8EAF1721DEF55DF2547385265A6EF8821420EE7B72F0304DE86D8118DC3E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\en-US\IntelCommon.dll
- Size 16KB
- SHA256 ab3ea369a5083b4354e8c978a3f6a202ac8d2f01ff4ac323509cab35e6332674
- MD5 183bbee140a469b0090853e2ea5e2b66
- SHA1 c8d8f37499b77fa6225ade511e8924481c0a3c70
- SHA512 686b3759b720542e2d3b1e66e9b82a2053211689d60a830109a614643764cafcdc718be5e8804246fda6271c94546be2b9c328eb12672f915c9e3726af176fea
- SSDEEP 96:5iHe0EAZwiw2u4p5DRI8qx1V1wo1g21yCOBTdv0EJjwxOLvdZuiyr/EWix29tgyX:5SewR8/X3iNGs2zdr5Ynla1IUf
- TLSH T1F472DD51A7F90628F2F73FB16EB616A04E7ABC62AD39D75E0600004E6975B44DDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\es-ES\IntelCommon.dll
- Size 17KB
- SHA256 0c13381abfc382a1d83f9e207e555ebf77eba35a078807bed0f6efc8f608afc5
- MD5 bcec2decf4c5dd9da2aeea60147ea32c
- SHA1 1edbcab13a0c49390a317e5d581ee6daee7684cb
- SHA512 ec53936cd386122cdd0a1d036adafa0b03231df367f8a2e78a483e295362d877da93b1c3e16ca129828a334c63f481add60d6b83f0110ed319a5557be01f4ac0
- SSDEEP 96:huHyOvkZMX1WxBG3wgcMuorFYUtmWnezlg5yuog9PPjsFYXkqT4m7qehgau3bReq:heygkZuUJqQKPrBAL9cQOGDJE/Ql
- TLSH T16A82AB40ABF91266F1F37F35A9BA1AA54E7ABC52AD39D10E8710056E1870F44DE70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\fi-FI\IntelCommon.dll
- Size 16KB
- SHA256 15bc042d61af139e46222775850dc32aceae92d90bff54036b137eef356eb308
- MD5 541a799f1107aaaffc1d6ef39c615766
- SHA1 4f69d8c7ef0c57daae357871db7daef1256e7da7
- SHA512 89fb3a78ea3f26e924a1a65d1e0349087574d0e384d084d3fc75ff5f6b2269df0b551ef16bfc7e670a9e9297e2b24d9d35595df3a485240520c00f5055cf440d
- SSDEEP 192:Yzny6lT6jKBQGEWy+JdD8PEEkrWEMahzqTLDJ8qa/PNyRo:YG2Wu5dDPYDuJ0Ro
- TLSH T1AC72E19497FD8664F2F78F70A9B652414A77BCE37DB9E25E0B00541DA930680E8B0B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\fr-FR\IntelCommon.dll
- Size 18KB
- SHA256 34c95716b01ffe5fcd094a583bce2f0c0b38e04927bea0226102656c20ea099d
- MD5 13464e2b2d8e55ef8e316b82884cf9aa
- SHA1 825a5b8ff513e80b244f82956d3404142441acd4
- SHA512 dd114887379567be30075f1b23e71b9919c72512b4d23730526359123ff8cf54da9b081147c14ac1ec1d44f514174b220aad8f0aa90dde2d35728a1e14ccbc4c
- SSDEEP 192:hyxHIrbZNs0CkyMkF8osnMkBCkspkI1kZUK/yOK5OdxNK2GuVVvbVTXJaAh1G1qu:hCHObZNu/4nL7ZU2FdxNKkjwq1BpY
- TLSH T16A826751A3E90652F6F33F31A8BA16514E7BBCABAD35D61D0610588E2C74F58C9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\he-IL\IntelCommon.dll
- Size 14KB
- SHA256 2ae923043cb58e495444948f812ec94155acb5416ecbdfb167ef18047d372032
- MD5 36e8a9c009c2b8b8e7f3f09fcfb72a3d
- SHA1 4a52332286481299c22c42646a9180ec96ea3cd7
- SHA512 f93d6de047cbfaa6019fb5c7cf3f8e63b8a466f0e388bf2315fdbe79e14192d2a694ce1fd838b9c468cec8d3e7be7421fbf6a7a3ebcf081c6029e25631874d33
- SSDEEP 96:xYHo9KC3TSivcXgXLOzGXDjr3ELnu66HzM+ElZ6sfMF+KcShizF1:x0o9TcXg3Tjch7ff
- TLSH T1D552A981AB81C5FDF864EF33D76B0A2E9AA4DD48256D771B981818543DBC7908B1CB3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\hu-HU\IntelCommon.dll
- Size 16KB
- SHA256 ed5dcfec16018b3b094537d624b0001809eea35bdd79deb186dcb09f5d3f3da4
- MD5 314bf8eb946f2d06f5b8b28bd901550b
- SHA1 d5b1ec8d7480cbffa4bb5ca787b5fbdeab9a43f0
- SHA512 dc4c82ced391f7eb28650df14a6c279d173b1977707f5715bcd594208f58ea75788ff9d8be2dea4dc99ac4e3a863eae203ee738fe5816b33d5e112486c6e25e7
- SSDEEP 384:cQJYJXxyMxRJ1JGiGqMs3ehgmfbOcMlgNh0sc:csYJXcMxRJ1JGiGqMs3ehgJcMAh0sc
- TLSH T17372C241A3EC1556F4F38F723DF657960A39FC75BA3DE30F8940928D2935680D960B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\it-IT\IntelCommon.dll
- Size 17KB
- SHA256 b41425d1bbaa17adfa90cb960f8a991f9606df6da6ef4d3a3257aa6b4f2b45dc
- MD5 a5c95e01adfc30f19746c6f0beb0e971
- SHA1 dff809bd415e0fcd5f91ee57ed4d26cb585b6757
- SHA512 cd0dd0b4b6faf1e598dc861c4ec93487851f7cd20c7fb16ce3303291413778ec4f0e5d7ad99f54f3f97c939643a8efd28dfaaf08bf68045ef3bce3b7410b95b1
- SSDEEP 96:NKHEe2ZilrmxjtthUGBU9NtkvcVQBJjbpPVbPPnegqeDdpWQG7s6AnyfRPa8Nc+l:NaElilwtdeMdX62ypa8uCwSHOzz5C
- TLSH T10882EB50A7F91665F1F37F30BE7A4A984D7ABD66AC39E21E0600048D6871E94DDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\ja-JP\IntelCommon.dll
- Size 12KB
- SHA256 00d13b036e74ba1844a8a0f403361e52d703f0e8ab41f873e5c72f25180c5d37
- MD5 be01e7b65b441a088d3aa04dcd74ec0a
- SHA1 4fd3598fa8b00f444818462bc022622c2a50757c
- SHA512 5df3993e855ab9ee7c366fd9314852ae8fdb60051aec801d3b3e50566671440d8d5a57aa423460df49051d073db67de8695a4422b90df64e149742839c3e83e8
- SSDEEP 96:ITHRmWG2iklZEC1iP/YGglBaq6voE6YxDUfR92rsV8qShizF1:ID0fDSEZPwXlBaHvoEnxDUfR9R2e
- TLSH T101420088F7E14F2BF4B6C6B014E77AA13A58FC28B6A24B961F40580F745860D4F46B79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\ko-KR\IntelCommon.dll
- Size 12KB
- SHA256 eee2b03e011e02794e67f43dfdf51e4653d9b504ff90985efe178bd977d012f9
- MD5 d4bae5e84969776195fed58fc7f8c4cc
- SHA1 33d9d86437f4d4a7984941e0097aae7defbed86c
- SHA512 e3f39606c50431c7bc71345b6ea767bbd3ede58c3e7733de2d34787815ea580297aa84e7dcb775588756bd5ea343736a481e14da12943b37469ad0111b16d3bb
- SSDEEP 96:VkHE08w9YNTOSuz5P29+nJ9nrrm5a4GmYTRmdWymhrFstShizF1:Vgn8jNBuB29+J9nremRmPgM
- TLSH T15142431ADABA9033E0D1A9B557E343D6926DA813BA43571FFB00901C7C547588FA0BFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\nb-NO\IntelCommon.dll
- Size 16KB
- SHA256 52abfc18c356b0dc681cda1eee88f0f2f81a4bcde2f4c4810c395ee7cb24343c
- MD5 371e5ae9d4f4f8f4b636a39d3f4bcbe9
- SHA1 de21be1fe10660f07fc84f579068fbd54d469452
- SHA512 ba049289ff90f8a6c98f127e6b3091befbfe2c4e1f8582259c610278ebd44b23a381f4a138b1f08aabe1dc00b95f2d861c388238120d37cbbf10555e4bb287ad
- SSDEEP 384:ZZZp6Kaq6Kaq6Kaq6Kaqv/Pfv/Pfv/Pfv/Pfo4IYo4IYo4nRn+/spHy2A1N8Q:ZVRn+/spDA1N8Q
- TLSH T143721490A7F91619F1F72F717DB906555A7ABCA2BE39E21E0600104D1C71BD8DAB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\nl-NL\IntelCommon.dll
- Size 17KB
- SHA256 ab7881d05b6ca12b8d16f67fded3d18dda24ecbfa084a4053a88b88d338d6ad5
- MD5 22020cd950c6fe819f2d6fb8adaf6944
- SHA1 a87d2e08e9c7272adfb3b0be7596927330ae2d45
- SHA512 967ed44fe76f62c7b5f8a54b4a6e185e1098e811dd8485107535b8f1eb250654c8ad76899dc804b127ebbb7ac7e6f9d0c9546878939804354b8d2a20aff7161e
- SSDEEP 96:QfHNxfvtdVTQb4U0sxr9uRidjw1WnWiVgb4bITFv01jJr9bdeUqGj37YwmIxMFdo:QfNxnSb3bX6qx11RdNmIfBN
- TLSH T1AF72D211A3F8462CF1F36B707EBA16505E7AFC96AA72D65D061015AD5C30B80EEB4B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\pl-PL\IntelCommon.dll
- Size 16KB
- SHA256 b01b305ae3ed134ed3caa450d0dfffca840673979d555239acb874710ba4ff9b
- MD5 f17d1fa25df4a333ef475dffca3620fd
- SHA1 7c8f1bd6953ffe2f6db7749a371af4edb075ac08
- SHA512 677129b26b25fb1f92edd4c3e6d20c47c4ac6b6528733f9660a237b0d14bb95fca7dd79b65531eb8d447ebeef25c9de6f6525b0d8cd50a42b587652fdcef8cc8
- SSDEEP 192:QBbHNYlpldK2Me2SKwHgi6fbeltjYgR49GIxz11OtAV:QVtQ2VSLR4j1gtAV
- TLSH T17872F341A7F80665F2F79FB469BA26944EBBBC32BA35D28F5640440D5870AD0ED70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\pt-BR\IntelCommon.dll
- Size 17KB
- SHA256 cf618d0fecd88352d262ed1708f8cc8c7a2ee691c11797f924c1a64679d5e814
- MD5 a9efe63c35755dc50814272ac3b14cc8
- SHA1 9d445208050a4343c15a8a61198da69921e4705c
- SHA512 1676fda351cc3a256e7dcc6cd8e5841cd8894f74779ac96a9cb017410020fd062899ce52f94d7d6a2f6867a961f3e7411f3103d6f59047a2964a7f98c6433bad
- SSDEEP 96:FQH9NhsFM331eukPRP6BtgnZt6rSZGxX97WqFxRWRIl4QIVbDj51CeVPAeGmxwGv:FM9NhbusxVK7PTGsnr/v6OQpZ9Ux
- TLSH T116729991E7F81664F5F36F726AB926558E7ABC52AD39D20E4610046E2C70F40DEB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\pt-PT\IntelCommon.dll
- Size 17KB
- SHA256 ea64f676a5da7dddd87254bad41253166cbb56066cee1671f17dda7c77bc4128
- MD5 4e966075c1a659e131f19a5a0f96e9f4
- SHA1 c286a481efe0c7767be4baaf6efe5af602e9c246
- SHA512 5c1541c1850d0412e0dcb7409a6eca6f474f6279cda1fc51a741e501bef6c11c24246311831493b9c462153ec61987e5b607ea638bd41367902d74f542a1d851
- SSDEEP 192:QfXgx2ZY6Bi7luVEfOWLYKsateQOYLxyqU1/EU2:QW6MlsNlK5texCyz8U2
- TLSH T1B772BE50A7F81628F6F76F7269B91A658E3BBC52AD39D24E0620049E2C74F40DE74733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\ru-RU\IntelCommon.dll
- Size 16KB
- SHA256 49c985b0da15ec07a00dc9f35e64a50c50a8192396929585c5c43847b63c2fd2
- MD5 e23459cee297ac0db4f3347181db15e7
- SHA1 cc0bf2cbb1bed06d8e08dde9990664fef96a56c4
- SHA512 f5d2676839ce0e17f205566975c33ba35b30a7a84e440caf2e5cc57146eadb223d18f43ca6b991fe65b1871058c0d7f6b67fe776ce89639077f36ae3896f5d11
- SSDEEP 192:QbC8Ghhv9nBsKLmTs2Hb+ZLT7GYL2kpRanmxzNr:QGpBsKLmY2Hb+Zn7hL2Rmdl
- TLSH T1B772454FF6BD9960F459D2B50F6749E7206AF710272682CAA69FBC68602C33473346C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\sk-SK\IntelCommon.dll
- Size 17KB
- SHA256 581d37bcbf6237f315bb14b6accaeff2b2d1837f49b9aee596f1702b53308fe6
- MD5 447dc58701494d2309b7e35bec8d3b7f
- SHA1 33074d2a063f2941600d6f02b9ce5c3ce1a2c65d
- SHA512 66fd535d5c1eea86cff4aba5a4636b33b134c887ebcad23ea63a5b65fae4bf66179414db4aa182868de28866aa74e54a113ee26fb5a13dd061d987995709ad39
- SSDEEP 192:V8VZ4QNBfhkuURzhe9se5k7kLHEOKDlAqMq3oDdxAUUL:VSVfhkuCzhe935k7kLHElAqn3MdxAUe
- TLSH T159724551A3FD1566F1F37F75A9B106A54FBFBC66BA36D20F8A0042591830B80D9A0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\sl-SI\IntelCommon.dll
- Size 16KB
- SHA256 9c6507fa4d52fb553e70bc8d15203dc7586fd6fb28e7fd9998de94573e5a8cef
- MD5 c25a1570eac8fc2af30f168a241141ac
- SHA1 324eaf9434d17a2cd489f04c9d810e5e6cdeee4c
- SHA512 aa67bc0a389c7c3137586ba7817f19a5e5155130642ca8720cde416d2a77b61d130095a0c51af481b2a2e75a7e021cceb31c02b3a65d59956313e1a3f6af26e5
- SSDEEP 192:1mt/In126m4OeR/+kZwAHG6USfBTREpkHqxSz8qJIpAd:1P126mrB65TRbvWSd
- TLSH T1BB72F042A3FC2659F4F76F7069B507A18B7EBC75BA3AC21F4210129D1822790D9B0B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\sv-SE\IntelCommon.dll
- Size 16KB
- SHA256 dbf75fbbf1c643a218e99769a265c52159414ff07ccef9ef8d9739a1e1002e36
- MD5 6ff2bb3079a2e1c56fbe428bbee0c327
- SHA1 0168eeed4277795c26b7077702f4a4b709c77124
- SHA512 68ea9287b1b8a55caa7f034451907f695736b3cb317957820f076ceb2ab4886d2a22097012c74a7a57715e7a6df3a89a966dde7049ab770d574b4545cf0bcbb4
- SSDEEP 192:1gELo043AoyvpTzrsRevdm1bqtWCCUq5d3TEG:1Tp41yWAdmqWhUqDEG
- TLSH T1CF722881A7ED1669F1F34F70BDB6469059BABCE66E7AE21E4700059C5C30B88D5F0B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\th-TH\IntelCommon.dll
- Size 15KB
- SHA256 3bde78806e1216f5f8578863eb7b131ab6c29422dc2ca472f4dbc074cca4c97c
- MD5 ead185215027bd5c7ca33ec73f529674
- SHA1 fbbdf28dd8366016d9c6db23046c343578e7a109
- SHA512 a811cc47b60831ced3ad6392b12e432b0eaa204f94ab51976b92b3c3277e6caadeef31c7a7ad55b62e0e0f007c1c156783c83141d97ef101b0c887ffd2993106
- SSDEEP 192:lqazeO5P1U252kHCzg+cOWC/x5desFUJHW:lTzhI2HCFcXCpresFUJHW
- TLSH T1EB62CE35E7B21702D04AC1F0E2D25EA37D2CB812E45B9246C56FEE28B560A746BF1D3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\tr-TR\IntelCommon.dll
- Size 16KB
- SHA256 e5330a38a8c5643b5850c9e77a4006cb3d443b46e105e9fe015ea8adfcf774d5
- MD5 08e75114a82382636d54229ae7ba8413
- SHA1 97f719a377bdcdf0bffdbabd62b69c93179a85c0
- SHA512 2de56c9b070815c132d642fe6a4b0f51de78f8da9d8f78b36650e47d131eeb178845ca0f8a79106c8694d0eab8943fc16eafefde33c7adcc0fee599a78d8c078
- SSDEEP 384:hZNEtHk8ZMHqRDEbTovRIfoE6xDqRgk53iALmU2Cz1l:hj+ZM2u8JIfoJxEZhiALmkl
- TLSH T19272310493DE5A2BF2F30F757DF6A5810AAABCB37E31925F5711501968302D88A64FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\zh-CN\IntelCommon.dll
- Size 10KB
- SHA256 720b8c0acd1e54f0aa8bb5fe581859a0bfcb6e90c4cb99702210e087e9fa4f19
- MD5 b1d13f08900e6472ba48e4deb8e0bc4d
- SHA1 363e1ef6efc9cfb7b0a5993a679c1585674470b0
- SHA512 66541b8d6260d74a641b17e0922f265f288de28543fb5e9acf0d38a22686b5ffe85c64b2f504bb178bbbfc9a259b061a9ded10fab49aa6650d7d9e182738b6ef
- SSDEEP 96:svHZQFiUOUg3T5bGmw/gqmfaf32DycxBLe5TSnR1AHShizF1:svZQ7eJGmwgqmfavmtxxS
- TLSH T14A226385D7E00E3EF2A3463196F74A12772AFC506A638F0F6D40699E385C720DEA5735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IIF3DDF.tmp\zh-TW\IntelCommon.dll
- Size 10KB
- SHA256 3ecbc68c1d442af25c6fd1446200439851fd47734a4d12187fd89410344fbf37
- MD5 3d7b0c192b1adfa6c01298b23826b7b8
- SHA1 78b733deea4f21dc93cc84a7ea2c93b64df9341e
- SHA512 58087fcbeb0a2ac6f829c797029fd5fb6d87f7e4fe4de1d576892ee5a952105e99d901af8e8d3a2cfb4c41a5f0345245f6218610db6c3128fe6c8661919ad302
- SSDEEP 96:VeHf+dGHhAGaNhuzmDRI/C2VkhW3agljIYlWd+uOU/HIlmLTvS4ShizF1:VOf+dtBznDRIK2VkhW3ZjIpqlmPSI
- TLSH T1BB228580D3CA092AF0539A349AE399F3BB7EBC163666931F9F41484F78606049F55F72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Intel\Logs\IntelME.log
- Size 8KB
- SHA256 3c348c936bc34130d3ad49be314478123fdb9d781d7e4c130ca9f5868ea18a22
- MD5 6d5e490751fe28691fedb92770fbf0a6
- SHA1 8bf8effa6262f52630a04be7957c617e0836bf52
- SHA512 629105bdab04df1c19d9b033651a84a2d21e521b81a6cf508329dd166759c58e8b6ff6647a710a9b5b731abdd0a7b08135cc90c477845fcc9d148b83d8b76553
- SSDEEP 96:96IP96nDItnktnZtnY/tnKtnLvnxZr74zwVn8Hr74zwRBZEd4F+T4:oIInDyn+nTnYVnQnDnvr4w8Hr4fa64
- TLSH T16612CE2F1FE5194FB0B2DB178DF38123A6317DA276347A5D24E983490A93244F581BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.1MB
- SHA256 4b81e48eb20db5f74850b0b57015f88ecf7fd9a6c0cf9305b2371e662c70325d
- MD5 82173e9cfc25055335eee02edce41202
- SHA1 5cedb9c0267579d52255337b264c5716ec1b77bd
- SHA512 9f2912322da5310790adc8b23ce8ea0d2adf77802080b52762984d15b38a1040216a3cc99710808b9a7fb60c5d7fe027526595404612655b56b632f8dda94b86
- SSDEEP 12288:VGzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:VGzaTlnRX9jaxOgdQ0mG
- TLSH T13C452318E68D1A73F5F1FDB262A131007CA8BA659F7152EB720937A71131A81FD38792
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 bd09ee6978471b06568c42b34adbccadb8680e845a72e20c6ed2079f7a230ca3
- MD5 4c82bf55b34b4e0aced38ee4485b6aa2
- SHA1 370f652f970a01647ce0e404811febe693a330ae
- SHA512 311af495639de871a449b9978fb69beb134ec374b38779036d7de8fdce04de1e1dcd09b6a0218aa35e3fdfe88ca3f7b68e1cfe3fd63d0b5660c9257e4a4c21ab
- SSDEEP 24576:38RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCczaTlnRX9jaxOgdQ0mG:sRZwQCyiHiQEaaPnMZulRX9OxjdQ3G
- TLSH T11585B01D63DC46A5E0BAD2B8CDA74407E6B27816473197CF1290C27D1F27EE49E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.2MB
- SHA256 4d1e9aac764919dfae28f0dca002b1cbf34fc06b91323338061b45380656c57a
- MD5 bb6310a5a119220a00f01a2f2a3467af
- SHA1 65ff4b234f8dc3dc531c9b51366a46cf72d43e1e
- SHA512 f0da0cb7954058e331fbc1a85c734a0c08d5df220dabeb4da4b20a6e12f88b740ea81a825725c2388f7a62cb4be0e26fc2141eab3b8d11c31edfcc0e99a059b5
- SSDEEP 12288:RbxA1U7K2zPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:RbxA1UG2zaTlnRX9jaxOgdQ0mG
- TLSH T1D845112DA69C25F2F1B1E97A95D15105EB71B826173193EF2185827B0F33EE0EC35B82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 8929cd335191ccb44d50773cddc76d3746d36d4a779fa3baa798adef60f308f5
- MD5 22c29f4fa642812918b0d6ef2b0a1e88
- SHA1 7f9b553dcc18203b20387ff8f8e7e308b69accd8
- SHA512 9cba1a32afa7154a4dc713ce53b349bf5bdcdec443bcfde25604dcd1b964aeb5bb3e1806c660843c8c932197ecd9a65aa21df034dcc14c1d4bc5f4dda05f8b00
- SSDEEP 24576:yjsmP0yHaqrVqHra44KDzMsrnzzaTlnRX9jaxOgdQ0mG:yjRP0yHfVqzlAsrnzulRX9OxjdQ3G
- TLSH T13245AF2EF2B910B9D4AAD172454107B5BB71B42D1F209BCB0170C635AF0AEE89F35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.1MB
- SHA256 5501ccc861788224045d6435cd26efbf450f740281f92c701b49d313a3c7232d
- MD5 b06db593d31197f23109c6f77a60ae72
- SHA1 26bfb7eb28ab984248511b75c4d9f682396f2436
- SHA512 c63b51fd5d6d1be912eb0f9078f2055c3a2e81c966fb29f89c0e4145d93cbb41421fbb61f75a721e58cb5a6012e46d099fca112bb328ce34f33727ba81830e7c
- SSDEEP 12288:ukzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:ukzaTlnRX9jaxOgdQ0mG
- TLSH T1C645235CF68A1773E6A0FDF3629135047CA4BB625A7213EB360936A70131B92F9387D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 266063c335f041465f4c5244459d8d74d69f098c77ca56fc966b3f16fd5c8ab2
- MD5 621026ef49d97cd1533cf99b895a80a3
- SHA1 5b6229a09ea6843c0f2949b59e1d3cee6bb9d235
- SHA512 28693ba52e26684fba0ac1817c8dba0d02d6cffc91e19e70246172fc74b75d4bdc75b39860abdf26da460310721c28012e625210032441ef919968fb6a3d3ca8
- SSDEEP 12288:yObGA4LWO+vAYFT6zPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:jWLBUT6zaTlnRX9jaxOgdQ0mG
- TLSH T1E765F118F79400F6E967D13DC5A29602E6B2B85D0760E7DF13684B661F237E18E3EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 c66884b62f6fbb733f7f228615e29becc529748ede9ca1ea9da2ed41e471559a
- MD5 a6f6bb63c6d3d053b4bb9884896f0cb5
- SHA1 25e17724cfa06456410dc78c4a73676b48f26d78
- SHA512 e261648cacb357003ee288f3e3801ac5b4e4684c5db3b6c0b931ec58c575b539600dd15b31a7cc7183adc008c0d13e4e292d414438a046d2102c116593a6b8f7
- SSDEEP 12288:W70VmkIYNvUyBpdzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:HEYNHnzaTlnRX9jaxOgdQ0mG
- TLSH T16655F21EA29D0DF5E57BA17A8AC28109F5727866172193DF11A0837B0E23EE9FC3D741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 268ff605e21435eca33a9ead73b1a88503c1c017567f27bde473bbe2e75b9b37
- MD5 9182bd8f813ffae62a2e072d1c76ead8
- SHA1 de7e3940ab6b3b843d6985c9e943a4e6b8be6a62
- SHA512 3485323202680f0591b1f30a1c23a400ef9f35fcb6ab095f4f72ebdeb868295423855784e5933da44b4f03c79112f0dcac94ff4bacaa3d076c707aec70594f98
- SSDEEP 24576:HnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKg:HnXoJJYH84VVS6AmEcJas+cHBjSSKHPw
- TLSH T10865BF6DA2BC04E9D5BBD17DC5C25506F5B178621331C6CF022182BA3F27AF5AE39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 c260fc15c07dae4fd5d145767ed7008b03308da882b5c7d1972bf1fdf8d28169
- MD5 ef76c553503043ff62a4e4158acc71f3
- SHA1 4eee63bb8c83b5ab0c449529d87533f02a53a427
- SHA512 8b45ea349ddd5aaa2d4ecc1804d251115300a2a8cdeb1e3ddd7691cbf244aa53a970e9cdc35f0188eac36d328d80959ea99ff0a6c5bca293752cd933a8506cee
- SSDEEP 24576:wv7Xbxd9Tuycf8M/TYlSuxwr2PCFzaTlnRX9jaxOgdQ0mG:wDLL9TuJ0M/TYW2PEulRX9OxjdQ3G
- TLSH T18E858D5EA2EC42D4E0BBDABD85B79046FAB2B855173081CF1251856E1F23BF05D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 9458adb7884b1107e5942c70159a4acf6d5fba8cab6eb3962058de544e96305e
- MD5 a18293a591a45b409b9c52b676ccb3e1
- SHA1 7ce0c52704a84e78497b20502ee5f3f057695ccc
- SHA512 203063ff96376a719af4d1b382314b211eb95e6bf66592d93e4c20d7b12e95373663769b08108cb9fbed1a0e5548c229b69bc27b1498473a54b869b2ca03c816
- SSDEEP 24576:GegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10w6zaTlnRX9jaxOgdQ0mG:GngOJOmPOHh6ulRX9OxjdQ3G
- TLSH T10455BF3FA7BC15D5E07ED17E8A928906F6B0782603355ACF0150827E5F2BEE46E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.4MB
- SHA256 f8bb1e97a67c0afc31bab0735a12f9932f1582580dca433ffa2263daa31d9279
- MD5 0409fee47aa6d15292638b53f08ef5eb
- SHA1 f8eaf2b1e18563bcabffa2d4723ae331797cca13
- SHA512 c84a8a27b8e37fadca5560d3dfb1e13bafcd530dc7e821902074ca3d88bb4c7d965b59e827587a04abfc176ea8da49a870d244468e61e8093fbc69d601209878
- SSDEEP 24576:/LJnJiTk3R3waE4JrOEzaTlnRX9jaxOgdQ0mG:/LJnJK8R304lDulRX9OxjdQ3G
- TLSH T17665E03CD2A810E9E4B7D2B482562756FF71347C2B216ACB29B4D5313B12FD0AA39F54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 3078b6f2de3316e403bdec9e1314333c827915fd906ce1dfb873caf7fa844b72
- MD5 cfbb6d3b2d5adecd40442923adb154c9
- SHA1 1e7e3bcfe8688277ec755b5ea6d5b33665f9fcd5
- SHA512 b9faa6d7e404ee5662b09b768a7277f0e3a8a5e3fd128f4da6ab12b0998193e17ca32429ebbe638e6b3347af4ccc444ca8b8b9a5ec7307828c9e72404be1f551
- SSDEEP 49152:/9GqCzDScAZmlvTcFg8Ph6QulRX9OxjdQ3G:L4RoLQ3G
- TLSH T15B955D05F7EB5298E8B3C9F1C96294159B327C509B34F7EF4A80CA6A1E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.2MB
- SHA256 c748f05a526bbca7d91f697a7358cfd9be074ecdd001ef66d8619cf4291c5c71
- MD5 e0d59280e23f432fb6d54ae851e4d752
- SHA1 8c12d1678e6652de91b1f1646aa4103e429bd28e
- SHA512 5ffeed90aafd51584f97ddc73544c4d37dea896acc26b7fbf7e8dc8c2280d512308a78b84617be0d628d87106c98406ceeda7deb3c120265d55205df0426a4dd
- SSDEEP 12288:WlYJeXm5nkEUuEqzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:WlYJeXm5jUuEqzaTlnRX9jaxOgdQ0mG
- TLSH T1E245125CB69D31F2E16AE4B695911504E7B1F471176223FF229092BB0E33AD1BE38F80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 c1364cf508390f2668d2a492e7093d9e5810d24f18bb17005067b888317008b9
- MD5 74e5a254f5b1689f7dc045f1ec98ef6d
- SHA1 58d3091a5a5cda5ebb73cb2c896bc9beda1cbb26
- SHA512 1bd1ae1d8e7f403487b8dd95e82915ce2dc6b0a3143de131510c2bd0d2788c5cfb22060c57f81b87959aedad61998338881c3307baa743d3effd181ac542dfe3
- SSDEEP 12288:1Pu6kyTzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:12tyTzaTlnRX9jaxOgdQ0mG
- TLSH T1F9551208B3D826B6F6B59975A6A25100AD74BD215F3153EF3280B73F1A32BD0F934B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.1MB
- SHA256 fb730778e597450b73762073383575bb4b9313aee59268ba82786164bc27a816
- MD5 92ff5c7991bce6304533c47c6deacecd
- SHA1 e4157e53846e5ee4fe13604787fa83023d30fb0c
- SHA512 2a6a23fa5d4d89600c45471f9ef5b0fce137e4c9c09fde1643234e2994add331a9f63cb4bae1d70d97c60064c1082e6a40e8123e76be229d38b87c7f6213b5d8
- SSDEEP 12288:6P6zPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:W6zaTlnRX9jaxOgdQ0mG
- TLSH T10745231CF69E2673E9A1FDF262A135007CB4BA715A7122BF324976B70232A41F534BD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 a69b9fde627a46f411af3be99afc3cd0d4deeaf2e68d166e0c24b8659da6100d
- MD5 f51f8d2ec8eb99983cee8c947e21b985
- SHA1 7249c8f1a968c4640620a51a39023b71bc2c7c04
- SHA512 a4517f35756fb53a29c8c0781d19b2c2f8d15d5f464b0fcea66920f6b7a4a78828ce3281558f7a3bd726dc3d585b4d72a0a92da66b2c3b067a2fd167b034b8a4
- SSDEEP 24576:9C+TyQIu93VAumZr7jmhzaTlnRX9jaxOgdQ0mG:9/TfIq+YhulRX9OxjdQ3G
- TLSH T1B0558D1DA7E91DCAE2B6C575C8A34493E933B872137186CF2044C17D499EEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.3MB
- SHA256 b304d43b4f3875837c2b1ba6d216fef17ffc3c16729f57f767678031ea45cceb
- MD5 b853e91cadb6eaf5a6cdb3e6703b3076
- SHA1 912e97d1c8d5c825c2370d52e701f8ab48bca18d
- SHA512 4ddd9fa8213850711d2fd8126c795ebf23f8cf9582c172095c05200fc1acb06d62717a7a2652f4fbafc11d8f201ac5e4d40bdbdc0f4638ae3e240c96050d06f4
- SSDEEP 12288:TcyrWOstaa3kcsOzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:SLQikZOzaTlnRX9jaxOgdQ0mG
- TLSH T1A555F10EB7AF10A6E1A7D17988814101FAB3B471572263DF1290C77A0B776E9FD38B91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 73d74647efdfa5e07fcf7629fb17d8c823120519ee7209a3ef3acdc409964ca7
- MD5 dad813cc2f0f28472256667770fe3fbb
- SHA1 ad0bb82a6e8b7ab63a2b3f9d40cd59b1bac58203
- SHA512 b90a8a4729ad984202d1a11a4d6154b7b495e275801698db8419330f8af390b8102aa8e9da15b4d96893d8af6ace5264a65b9963131972eff6e66685ab450151
- SSDEEP 49152:7pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPTulRX9Oxj1:QpC7b4+80GTkPRoLQ3G
- TLSH T101A57C3DE2B8106DD8AAC776C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 72d50dca1a850828f05b54830fe762f84fd068c7881bada86ebd15fb1238a923
- MD5 a67247ff0238d101f3094f4f1419bc2d
- SHA1 8641584a86166ec2988b1bc4ae2b6dffa9ce3f7d
- SHA512 6072538125223044b48357c45cb9b654e34fd8082a5ebca9de72fc5d2711181398cfac54b52b423b0561a2de75f5d936b1dac402ee7b2efda42d543b17ad2553
- SSDEEP 24576:7SAwJPE1IDAo+4Kt+l44135UQ7zaTlnRX9jaxOgdQ0mG:7qPCIo4Kol4/Q7ulRX9OxjdQ3G
- TLSH T14C55BF29A7F946F5E17ACBB4D663C501FB727822133163CF5290817E0E16AE89E39F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 09d207006646d7239878c9106a222abff9b925376c300401df1bf048e7fe2051
- MD5 211c8cf59c081e10085763a5d276fcc8
- SHA1 aaa0566fb35437144bd10e7fe18211f802969ae2
- SHA512 48d913c618d6057ff985313cf246c29101174d950f556d7068dca64fbf2c254d4fe4dd0b813073b914486573f967a067b8a6230fb38fa3a3bfbd12e8c75ec1f6
- SSDEEP 12288:iSsyLCFBoPLCRyi6NQ4trzPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:myLXPLcZ94trzaTlnRX9jaxOgdQ0mG
- TLSH T16465E03EE66D08F5E47AC27DD2A38506F67238AD033166CB1590917A1F27FE4A939F40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
- Size 414KB
- SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
- MD5 16b9618962f5623ca791a1366eee5708
- SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
- SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
- SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
- TLSH T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 2b5016ece30b1e42485cc28d2de2410ceb5ce3ee24df8bdf07b4cf25c2c191fe
- MD5 3bca3d8c123b137c05c391d7265c32e2
- SHA1 46e9b8e1c493ea6084289dfe8194001f73e10ebb
- SHA512 ead86b322bde55d7a1bf7959900e80c9bf1aca5fbf6dd85c415e3067e214e44c1d9b16ff52444a2abf297ed4903b56d9ce3382508963235307582d07be277ea5
- SSDEEP 12288:y9lyvj3IkxjbBzezPaTlWO8t14XDtb6KX67jn2Wh0gd1nC0mYvn:yWv8qjpezaTlnRX9jaxOgdQ0mG
- TLSH T1DA55220DA6D825E6F0B59AB0E2625114A8B0BD72177166FF31C8E6BB0731BC0E43EF51
- MD5 SHA1 SHA512 SSDEEP TLSH