64d72b4a035d4d36bc1d55fb58f7d20b358ea692b184ad275893b9299e96ad6b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
Size 1.8MB
Sample260504-pcv24aaw71
SHA256 64d72b4a035d4d36bc1d55fb58f7d20b358ea692b184ad275893b9299e96ad6b
MD5 c34808c2cfe97cf2012ee1c3c0583a2b
SHA1 618d06bcd4504f6f80eb7f049cc628d7ab76df6c
SHA512 99af622d9535928d4f7f6f234b2348d275a69f1a989870463ec919273e80893ae7233d422b9f97fa36fa3af9b78e0cdc6102223d8b66e748ae47b24db348c140
SSDEEP 24576:nbdrZe4aWOLT4JqG2OTmxK2MtENKKtHJycb5374jo:nNZCWOLT4JqG2EmxK2MtENVz2o
TLSH
T1CF855A1267F94128F1F32B71EEB993645A77BC71AD3AC50E6280125E0DB4E90DA72733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
5480	alg.exe
5368	DiagnosticsHub.StandardCollector.Service.exe
5176	fxssvc.exe
5456	elevation_service.exe
2392	elevation_service.exe
5836	maintenanceservice.exe
2004	msdtc.exe
3028	OSE.EXE
6116	PerceptionSimulationService.exe
1732	perfhost.exe
3760	locator.exe
3732	SensorDataService.exe
2656	snmptrap.exe
5280	spectrum.exe
3844	ssh-agent.exe
3940	TieringEngineService.exe
3976	AgentService.exe
5356	vds.exe
1140	vssvc.exe
5744	wbengine.exe
6048	WmiApSrv.exe
2964	SearchIndexer.exe
4348	AdobeARMHelper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\edc32a04c682cdf5.bin	alg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_166656\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_166656\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee7f8847bfdbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037295348bfdbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab38a448bfdbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b0fbc48bfdbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089097641bfdbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4348	AdobeARMHelper.exe
4348	AdobeARMHelper.exe
4348	AdobeARMHelper.exe
4348	AdobeARMHelper.exe
4348	AdobeARMHelper.exe
4348	AdobeARMHelper.exe
4348	AdobeARMHelper.exe
4348	AdobeARMHelper.exe
4348	AdobeARMHelper.exe
4348	AdobeARMHelper.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3968	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
Token: SeAuditPrivilege	5176	fxssvc.exe
Token: SeRestorePrivilege	3940	TieringEngineService.exe
Token: SeManageVolumePrivilege	3940	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3976	AgentService.exe
Token: SeBackupPrivilege	1140	vssvc.exe
Token: SeRestorePrivilege	1140	vssvc.exe
Token: SeAuditPrivilege	1140	vssvc.exe
Token: SeBackupPrivilege	5744	wbengine.exe
Token: SeRestorePrivilege	5744	wbengine.exe
Token: SeSecurityPrivilege	5744	wbengine.exe
Token: 33	2964	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2964	SearchIndexer.exe
Token: SeDebugPrivilege	5480	alg.exe
Token: SeDebugPrivilege	5480	alg.exe
Token: SeDebugPrivilege	5480	alg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3968	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
5896	AdobeARM.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4260	2964	SearchIndexer.exe	105
PID 2964 wrote to memory of 2460	2964	SearchIndexer.exe	106
PID 2964 wrote to memory of 892	2964	SearchIndexer.exe	107
PID 3968 wrote to memory of 3600	3968	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe	108
PID 3968 wrote to memory of 4348	3968	2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe	109
PID 4348 wrote to memory of 5896	4348	AdobeARMHelper.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_c34808c2cfe97cf2012ee1c3c0583a2b_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  PID:3600
- C:\ProgramData\Adobe\ARM\S\28457\AdobeARMHelper.exe
  "C:\ProgramData\Adobe\ARM\S\28457\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\28457" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\28457" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5896

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5912

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2392

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5836

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2004

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3028

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6116

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1732

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3760

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3732

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2656

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4220

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3844

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6048

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2820 2812 932 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2460
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2848 2776 932 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d0cd4faecc4f7c0ef5438f9d02703497ca6234a5d62f1a7afb4f511f238ee019
MD5 4044ba749e1f7faca6a27dbd6f190a2e
SHA1 d09fc43bab9e1bae19d37fe792cd7487686c780d
SHA512 00e23b43dfaa785650bf3792a7c4b822c6237634c16deb2c19d0b0a810def6d83fc5a874f34f93da7793aee9853a50597411616c1f9c178b8742eb46c0240569
SSDEEP 49152:Ab+632BuPkFKRrdE6oh7stBhuXjfS4LWxn8z2o:q3q6gjBB2o
TLSH
T100D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 3f693ce3db9c361c91c08d8fab40300731c507c1f2a3eeefda145562f813a75e
MD5 2a773598412aab70490402db192d3914
SHA1 45ad00e64b8997bd0680c21342b8d55966d8b24c
SHA512 03c827f27e8ad57bbaa20ce4441cc491d51a656d2a0ebf4018ad69c7f80291abd89b50ca042d4273fa783105303841af372205cfeba8b5e8d21b63270e394867
SSDEEP 12288:n1XLs2TWkxy2lRq2czAeY6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:1XYSDtczAeYKtHJycb5374jo
TLSH
T17D05012567E409F9DD37827CC8A28612EB7378510770EB8B07E89A651F237C84E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 71d9cc5541b3555436fec2c00ebbe3a30d5f0dd27712efb9d6748be316d31926
MD5 ab8e11318e1bcb2cc72d50ef149f169f
SHA1 3e89e5f408cc674de225cbfad5cdb047e35101f5
SHA512 3b68fea3ed892a345052eb026e9e4d376e6362b85897e0e341cd6fa3cbfa5b1dcb851b5918ba5a0e6eed04dafe37482e18d9c786eb1fbb32dd0bce70bd26f939
SSDEEP 12288:jweNYV0ezUEh04/a0ZD0wxpGZIVuhrHsK6lQ+OxY4qyws1S2uJycb5igYjmCC4jo:n00e4Eh04rxOrMKKtHJycb5374jo
TLSH
T11545AE16F6748335D073C0B9C5D2A69EEA7130821B3089CB4296D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b1a03db4cbb7a8603fd49975b59599bd217052a5b550d2072977246743f8ee93
MD5 60b9afbd39eff56995d20f442f32824d
SHA1 27952dd75cf38128b5d66a93838e306f434efe62
SHA512 9458477e54a9fff379cb64f0c42505d68a29de77eb3c78496dcda7488cf6b646e66ae27ec9e0bcefb4bb54a31cb144a8a7cbf65651b6689d360ff1163c2ff39d
SSDEEP 24576:e+c/ezSC6vUyD/aqgrvW/6q8wyuYKtHJycb5374jo:G/ezSC6vUzPvuHjymz2o
TLSH
T160755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 702eca8470ccf75b61ec43c10e854d9d8183d2d5fba850cda65f2fba69955359
MD5 f0bcf0b6c44a92a96934e928422cf133
SHA1 b4b08a817464a7989ab4d504f994188e64612111
SHA512 5bbedbc35ab6847a1be5206764ee58aa7061731b613538636f34ef8fffc33e0800a5d0c8220dcdfd9eeb75d707de226180d50fd9a4adb5297dc72ee737aaa7ad
SSDEEP 12288:0aJjBt33vscG/Yi+l1D0hwsEBoW/lx4jf0Im98U6lQ+OxY4qyws1S2uJycb5igYw:0abtPsD/Ev/l+dUKtHJycb5374jo
TLSH
T18C559F66F6748335D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 42170876a8c6567bb2ae9e97c7103fba9e9b2b77696fa58dae4cdce402fbd954
MD5 b0573925a8122a02a527456e3636df66
SHA1 c7b8a63668f37e11bbbc1a285c76ea2b945674de
SHA512 cbd377f00e334d1bb302d65c7356a46b8bc70b7e64217bf6fc187fc25324df78eb1101c8efaa2889ed05aa8a915118ce094b763e1b5313b1275d951348606900
SSDEEP 12288:+tE6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:+tEKtHJycb5374jo
TLSH
T1C4D423228B69434AC73783BD74DCABB647956E950C396D890FFE37844C14B89C1CA25E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 1a6d3e021ca4b1b83b136accb6baac4792d220ded1f9ab40dea7ad1d12846118
MD5 8ef31c95ed3111199a3704e3c9ed0b8d
SHA1 7aa027e09fbd59d52f8b1a56f6a0e3b133409b70
SHA512 7dc232677a01875789daa9995e7dfd6d474d5ac6dd97f0cdc12cc80b2c272d2ac3a7fd65fb4d8be2ed59a90aa7cbde12ebb06e859e917839f771f5a54f4a1e60
SSDEEP 12288:6eBNUbTVO86UV6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:6JIUVKtHJycb5374jo
TLSH
T1E015CF37EE28ECD2C27A89B956918740D77278704F22A3CBD175830EDE135D54E7AC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 4e834657723fbaf7d6402a6683d5375fa122074b9c14a03f4c3a492f9b64a21f
MD5 547489ca1c585fd141b50ad1d120f5c0
SHA1 0af5dd6adbb318808ed1a25c76b26cc08977bd75
SHA512 2a4fca84df7b8b45faad1a075f2a65c0f41960612827c32b0907dfb5f3d6a46f3c30fea01378d30cb68c6a47206856b092a90b47056b20c0a08adee5def634f2
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ69DN5J/NRV3THp:5QvGAdlCEL8c/6RN75Ci2o
TLSH
T171366C656BF880F5E0B7E178897A8672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 7c55e2884fc6d1bd095ac955464c3bde3807e018681ee1d3609d040567c9e06c
MD5 fca3f6081b74ea3421c3e1110b297fee
SHA1 46bc3c49bde2a2d674be43777f3aa64d8f41dcdc
SHA512 aed56c8b63153b14910ebca5e31d717d72d7a0a28411a984ecc6b38fc5dd7186e90c4dad3d6be58f18a0266a8ca6b0a7941da52f087bf5fa3e1cdfed5b99d40c
SSDEEP 12288:wAwSfxL/2Dc3bDLLmt0LDQewsAjL6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:VmewsAjLKtHJycb5374jo
TLSH
T18915E031FF74D036C77B0DB61B2AD716146D7A604F6229C3E3E89E8D59202C26376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fdf0dc33848b3ae81cd0c50aa49b3343908364c6cad05ee7bbdb115e4a7ba2ec
MD5 dbdc2cef3e0a53cc9da4c659c481caea
SHA1 112eb617ab40a3f5244a3a1e26fdbb9a65f2a986
SHA512 0e19b84f173067ee865f27e65e1b13a3cebeda622e955b84673d65864452ea7da424f97eb5e704f093201b2664a909453870f719c2c54214ce7a60f4827197b8
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrBdPlbuJH/9:DUEtQevvqc2W1cpV2Xrr21
TLSH
T1ED474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d5cd4343cc81d1c1102d7e4b2e099d002dfc73565a8f3af55c779bdb8b1d1f03
MD5 d5624ea2890b4c5342e8f021c0cd1732
SHA1 2d1db7b91acbee9fdf1250d0a246390f22a365ab
SHA512 76ed85cdc7870b92c5baa53e56e8f29a3a88c8955e1cc5f8fe1e43a503828d1072dc96e17ad404dc3e0692028fb5c3886580e6907c8271870343c7e3dd3f9e13
SSDEEP 24576:ffbRquA/m2z+L5WqJGrHCYRFiV+XenmE3Pnzc344MKtHJycb5374jo:ffbRquA/m2yL5zMfFiV+XenmE3/zqz2o
TLSH
T1D6D58D0976B8C2E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33BD58A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 db1d5702fbf641962e03f58465697163bea9c96fe3e4d818ef1c1e84720ec4b0
MD5 fdee5a612b5e21f0a8dffa4f3d4499db
SHA1 c7f1d239bf33c5aeb5d6dc1a8b4e58f8e8bca4ed
SHA512 9cd99b67aa4241d6dbdc6ca9454e65744b19126092e87a63fcc593e958144a897f55e46e87c1e125f798ada8587133a651fa24163bfa0d39ed9912ecbc30e74e
SSDEEP 24576:bAhGLv8FoiwtA5l7S53LKtHJycb5374jo:bAMwFoiq5Kz2o
TLSH
T109459D81E7F945D4F5B3A6B899B69171EA76BCA65E31D20F2260D10F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 43cc1ecd69d1d78ffd30473c35b37fa15f2f3da32f671244366dac0fbf0ba057
MD5 4f35355cf45b38a5cc855d127ba94a41
SHA1 bb0bd5714b8eb6be99118165dbee8ac5330bdd99
SHA512 b376d2d273a1a029bc55a96c84103f8190b07e1e97359fb5e3e79523c56e78957c82e78ec14e55b81348e0c5c82c5ad130ae9035ef0a6f8ff38ee7492e9ada99
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+C6u6lQ+OxY4qyws1S2uJycb5igYjmCC4j69:UwusOWRuKtHJycb5374j
TLSH
T1DA05F14677A40CF9DA778238859BC636E7F2B8012A35DB0F07A4C65B5F27351AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 48ab4f7d2e05c4c3caada3a032c3945c939e8f5900417f73a83c670901e19595
MD5 75019ed245c6d92af49a9a59c1126cd5
SHA1 98f066d5c72162558709e78961cddfd96c1b366d
SHA512 cc411a19521777b599a545a6fceb7e5522b8b3a21746ae224bd72bee0c22185f6b648a4c54eace7909ac5bc3b0f67e9c38ee9c574b5988c83c39f776b0eb7f1b
SSDEEP 12288:L411I7e6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:M1uCKtHJycb5374jo
TLSH
T1E8E4125227E812F9C273837C98E89B56D7B23452273657CF1BBA03991F12BC54D3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e0dda81e0dece88f2ffc038f1e09deb00422a4f6f0d0d5d9b55cde82cb1125e4
MD5 e6a24bf0bf6bb3d65082e770da44e2c3
SHA1 05fc68d8785eacec91a1178a1af28e0c172f2d1e
SHA512 d774a246b9be66c962174348173cb62c6fd4f2f3726687b42854a4c0191703432619f0e977af30e752fd284075c2392c7a8ba895126bec064c3bfe24458d1b11
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U9:xQRQyi36YOcP8Lvw2gAf+PN3P2o
TLSH
T161667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b7e571046257308b845169475ccd45c934e805e31094a3de582c94a73d2b3c12
MD5 b7fcfa35617203edb41d150a4ebb379f
SHA1 9e71405c40573367d2a0bae4935b8aa8ca915752
SHA512 f31ad8ba672c4fcf371dc5b9696412c30c68fb46fef2ad08f9fb26423e10f5ac71dc05fd12f07e421f3d353421f0b20ccc1c84a15aefb07a43483d01f5e49fd4
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0uKtHJycb5374jo:o68Qg55nhMeWu7PNU3/Gz2o
TLSH
T155B55933B2F20099C45DE1769F4A873196D27C718FE0E3DB865572061FB2AD06B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6957ce5563314e0e85e01fd49d20cf2572390902a0e31e0fa62d1b7a4b54a655
MD5 c89d915e065c4b67310e6579e0e11759
SHA1 db8d3e848ae4a49242812d7f1fea2cc62281aace
SHA512 8351028510f6a6716f0faee9a29eeeda6ef67741baebeb70101d27e95e684a5b69d0ff2ce36caa0d7b51554c1ac182b7d1a0c41250bb505fed4df81bca74c410
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99j:Jy5112gYy5azzVv569nLKnhZE2o
TLSH
T1A6167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a25aa10bd571df569ece454389d52fef296d9574f442c80cc206ab5f0a0647e1
MD5 ba80f5769fde828732f5b6e89a3e6cb8
SHA1 d73aacac25875b35f94087eb0120a7932bb96940
SHA512 a851bf97c3c8de6a84f34423d7b55882562032c8aadd1880136036d4bd547be3e72e4eb0711f9c87d91d3f71dcd78292fa9c3d3fe1954bcd91d675feb98c07a9
SSDEEP 49152:nB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glrz2o:pu6JmTxd2dv2o
TLSH
T10AD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ff2c9fcbf297f788f820f496b166ae3f4418fd65e852c5afee10c812e54dc90e
MD5 7c9df1f23bb3e82da3740f8d5b21a39d
SHA1 c2f1fb7a3dfc45a62167505c9db28fbb7277a8ed
SHA512 5b2ea1d21b89c3634f4472bd685b43c45d7e80e23b91bcbffb8fa8de15b3f0f9e8fd732bc9045d419f472ae3f159f5aa835af2ee671273c27509b8013763bc73
SSDEEP 24576:HCUBvvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAKKtHJycb5374jo:HCUtPTY+8Wg2lIL8lrIUJLWwWz2o
TLSH
T17175BE1EA3EC089AD47B823589518A16EB72782E1B3296CF1170C33D6F27ED55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 c93ee8fa4326a7bfe7f96f4acd006d636bf1a80633934ea3f7bf558734debc18
MD5 92a82b2eefa45e0020d71d7fa458d1d7
SHA1 1dbca9accf044d20457a79d3ad5e8c5e2ec7d9bb
SHA512 694ed94b4a5acb6f38d72363bf87f0c17cd2471946f9ba6edf18572de58088b45591265bfbc01f68c1a03f34a77a229fd6c71ebcddb8845b2662db9143e81f8c
SSDEEP 12288:T5sfK6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:UKKtHJycb5374jo
TLSH
T193F4F116C29802D8C12EA279C7999A52B3333D6546F1E7CB1BD5F53E0F36A808DDA707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 102B
SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
MD5 c42592fd019ec4a186471c670ded3b4f
SHA1 2d5a5b980279b0305441b007778a31c18e84cfb7
SHA512 dc22dbfd7fd36284002bcaa73c2224d42afa850123dedac16c37ac48abddebf6d0c7db1d02793dcc9553d226de60a2cad8075a03be7efb4caa29e92157bb36d5
TLSH
T172B0125313D54C10F4101801CDF444337F2270C0680AC00CC0D1111744F0CC0CE622AF
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 1KB
SHA256 0455266557c8e0933ce0097d6f9d254e01adcb6f7aabab6ff076124b39f7ac53
MD5 7730ef035aae2d3557059b649725a0ae
SHA1 13675d6d2652fa094b8048e3605480c104a160d0
SHA512 ac71134b00bab0de756ac0a55ac9891a95620ae21e3b55d9f91cd836551b9ca33c8829bce423f0335a46ebc7cdd106468c0ec7738350a92fe2904cc1c040c4d6
TLSH
T1B2219D832AE90164F5B35F54EFF9947357323CD22D19C86C80D4124E8CF1A90D5B27AB
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.msi

Path C:\ProgramData\Adobe\ARM\S\28457\AdobeARM.msi
Size 1.0MB
SHA256 f3f339de3a391d7f8baf37009ec52a6948d769977e2f407faf46f7064a524638
MD5 9474db895113963c06cf1050a3d5c91d
SHA1 5c599ee58ffb1fac122823e30814702fa38eec2d
SHA512 cb4fc2145582e459af1d8eb0ef3f33a629929eb7e0730a7af15d98b4c5577a5a5b3853c5695bc9e356be96c35a91cec69f57a81322c839a2cd6d73b9958d35af
SSDEEP 24576:5tsYy4SyBEqipH6t3uhK76TwlO/TTj11:5tsYy/yUpaiqhETTz
TLSH
T12935F107B3804236C59A0235544F87724B79FC348B21426B37D9B75D3EB27E0AABB5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\ProgramData\Adobe\ARM\S\28457\AdobeARMHelper.exe
Size 413KB
SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
MD5 522026a14d6bc781d2a15c665e454310
SHA1 9451a39108326ba578793b1feb62f23a02bce916
SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
TLSH
T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 b3c4bf9650881a4b53d7bd875c0f628570663cbe01d37b37faae0d121e511c8f
MD5 c20830914128f24d8d40c2ee276fa1fa
SHA1 bb5caeaf08a8052816e7dad4e7c6f3eec7cd1a01
SHA512 cc2e1db68f944951ed6ec46ce6dbf2065bd21c886c61c3efc4bc85369c050a1806cd508eceab4f7863f4b39e2a6a905c5768341e50c406608edc5f5f2d06d80f
TLSH
T19EF0DC6A5EAB84225B12447C16F8EF7120D7268F08E98916283838E546865A8668E40D
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 727B
SHA256 760f0f1f65d0019f9e362cf0af2afc0e1c90454a120e174ce01d34c5f997fe85
MD5 00440d9dcd15b45101f3fa41133cd40e
SHA1 b0862d2271651a0bab418a16b40d1c3a28057de4
SHA512 6e37e28f15f9a26212da8fd008c4aa516920c0bbfdd0d377f081b292a214c310df3826c905a67e6e7a464748fab2495a1c80d7a192f0a2021327b0cd89e83d8e
TLSH
T102014452C65CEE659A02F5796384959035C34221E88E41AF72AA90D0E3423A4FF3AA99
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 727B
SHA256 1b7a51391e61f7941b66ce0be46bb6f670ecc80055ba72168bfc834a6ad59c90
MD5 a4ee363059cbb22092fcb3c4df806a81
SHA1 4949934d3b3081358bcfd8b3a01c959d3d004571
SHA512 758acc5280522049e12292253942cab79e63df65e0a1812b31284f437684197a48a89cda8e62002520426a6af52eaa3341dc76ac1f9dcb08bf8eda7bc8f3acff
TLSH
T1F501940A022E03497A33D985CF4487AA7B63CE68308CB00D3FBC3FA8BAC4F291511917
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 ae479d4ecdc5eab901290785ee6e30fbcefb56fb3a8d8aa22e0e7c8e321d349e
MD5 d425d8e180ea9023a5e5f6cbb63b54c3
SHA1 f87badda86a7ed275e1413b2da74c5848f5e2781
SHA512 538a5753d27ff19d0aed42ad59e9f9da083e657db31ea6a050025a417d2b892ab744a8251628a8840fde9c56053e2a4fd6772845c43c43d4413d805f83fc8916
TLSH
T17301650255ACD75075008D22DBDCBEF4F16BE2E8398C0A90295C78EE0ABD315C1D6C50
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 0642d8601ea4af2292a161691e6c4a51e370f8e7d1b537d01af4189640ae190d
MD5 72b90cca846bc171926f27fc21f00df8
SHA1 9dcb56aa891d35dcba33dfddd30f597c5e4027dc
SHA512 d52d871014a1d9433740d4ceb9b66e6e997f78867123f51246f6993c2237584ac0e8e079ddcc8f4e787b7b21a65fc923e4dbb8361709709824a0b56bfed3f57c
TLSH
T189E0203027FB117FF560DB7803D9D1D5AF36F1127D5466BE08D1142D6905E004CA2C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 404B
SHA256 ba083c52462f7a3063a73359d1d1102cbbf880499b7c010c3f00765d24f2c416
MD5 7f16dcd418b2671c08262b62628bf198
SHA1 ad9580fed5a79c986de2d8765297f972285ab685
SHA512 be4d663ba87f6a1f4b9868bdafaf887f238924c20acdd4d536cd628b95095c776b91d4a9d97372560ab00cd71b3a42858af9547782d5cf4b05dcb3ee40ba3050
TLSH
T1EEE0263035F5456EF6E5953847EA9C23AAD9F64A0952E7B90144178EBB52B800CA1638
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 404B
SHA256 05e9e850870522e6c29f11ff95af3b7692a8392d5cabc51da5cdd86be7818a14
MD5 7d8bd1bb121aeeaf16aa34b043c91440
SHA1 499e4a32f084b95768fdcc1a02960c399a68e295
SHA512 7cf2d81a3c2f43c3e530cf490c8f3e406c29660a80c53bd39f8004dc132099f238d793d93a2c57bdf07c1b1ecd51f3e3bae8004f04c08451ef58efcc83837a29
TLSH
T111E0C03033F4456EF0F0B4380AEAD86348CAF2561912E3790000174A7621B404CD2124
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 c2f25be5e0550c168f00a9c71fd34a7f9f9eb33b730fc63c66486b66d26d795f
MD5 51bf40af58e4f35e17591296b5a2e0cc
SHA1 ae6cefd379c484fbdbf4d6eac2d964478d2b2ce7
SHA512 10063dd1c9a7c504836a351312e43e1aa9b2dce14390833d4d4e9f3a805e279ab78a8e47421680acea257196992175de2f861a75a66be3d94fe8aa3fa053145c
TLSH
T17DE06F2C2AABB45FF190D83847EAE8BA0D89E301249092B821818309BB03E405C10AB0
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 1KB
SHA256 d6ec838b59f9eaa8f7ee79686c01d7978b98cc5623c79c284a69d36ec0306025
MD5 3f64c2143a6e8407b4f6196a53ce5853
SHA1 b728604bbbf840d5716f5d110d3437584fd0f4fb
SHA512 6efedc6173b48421e60ac8de075e2a6c76af1f28c4cdada1287d2bc9d8148d3ddcf68ae867565c3bc52e26663313d75e486f49b03738837279dc64e233870e4a
TLSH
T1CC21F1E8C238A5F73BA141ACD3193F955C0BF0A40960DFA072F0C6953B92C6C9F07214
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 1KB
SHA256 7d2b31e86cd6261a50c922c6f2701f688f881989df83778e3885009eb22b0c3c
MD5 e66cfe3e8f843e1de9cfef97979a9b60
SHA1 f75d41c4c55f758aca521b66888bd4e32159e59e
SHA512 083727956bd506b28e2fad87b424122eacc6f659bc4cedeaa49e847cbc8a54e5a75c8a83d51ac6aefb746128aa310fceb1621e665c34ec636925ff46f299807d
TLSH
T1863101E8C239A5F73BA1419CD7183F941C0BF1A00A60CFA072F0C6863A92C6C9F07614
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp158A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp158A.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpCA11.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpCA11.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpE29D.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpE29D.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpE34A.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpE34A.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpE965.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpE965.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 b35f1e135c06d190a974b007f8cdb3ca06922e604463d52ba16ea1145dfb7496
MD5 8a5dabfe860441d8231dda17b5d4fbd1
SHA1 bbd09432de65c30a62c5c522212faf106be7a87d
SHA512 8ea9f0ad91b587d3b9568fcb6ae30e1d5034590f4c359e53a1d8ad182f3f64c9df30db8ed1145dabbb9991c36ee653c644be624bd1c5aad59ec866f16fa284c2
SSDEEP 12288:VPO6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:VPOKtHJycb5374jo
TLSH
T1E0D423228BA9830EC63793BC249DE736535937951F3668CF6FEE23845C14FC581A924E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 82f4c940afaee7f596377a8a888963b4fccb2abf8b6027600ed179d41c9a4997
MD5 cd1191bb48039d07b630929b778db403
SHA1 90bb6fa6c9641e13f2884a3b8b667f92b8ac9cfc
SHA512 d26902b259df5b0355d1156bd39bfd122f4fb4db282e924c92ff6f791e29aa59f688b02c39b0df381909e976d378be61b4feb47e325e4e4d0690f47be29f4e24
SSDEEP 24576:jSRMyNoSFw1d+rC4vrmRcGPiQEaTPnMRTCJKtHJycb5374jo:+RZwQCyiHiQEaTPnMfz2o
TLSH
T1E985B01E63DC42A5E0BAD278CDA74407E6B27816573197CF0291C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 700KB
SHA256 1fd1effd25d95936b044e425deb53307f62d735bc8a841b5bde4d33792987721
MD5 1e24e7c6c81b4c9aad9d63a2bc262216
SHA1 e31844a52a58b0f8bfd63d2f54e8b19fe2106f29
SHA512 a3769c2ceedac3e1044031434daaf6f259773e1ce6f3d5249ac171e5115bdd6ae825689de6006fe9dd0f74a9e41bc62b15948f72bc8b316b8d6086a99cfbc74e
SSDEEP 12288:ifxA1U7K/96lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:ifxA1UG/9KtHJycb5374jo
TLSH
T121E4122E57AC01E9D236D27D98D98216C33178161731A7CF1AE683790F27FD48C3AB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b3b275bb87edeac7be6329cec4a59506277550a0a5966b87d964629061135a97
MD5 da8ca69b2bcff62a4d0c263b887a266e
SHA1 c8609d8b0ba7ee1917c223560c1058bee376ea36
SHA512 6e5beaec60e883220c89afbde1edb3078d4bd1a9424ce2847eeac6d6aefca5cebace9b914b078f2a52ab3ef97ec8a310dc96963891e353b56b0bdf0d25a750b4
SSDEEP 24576:CjsmP0yHaqrVqHra44KDzM+rnU4KtHJycb5374jo:CjRP0yHfVqzlA+rnmz2o
TLSH
T14955BF2EF2B910BDD4AAC276454507B5AB71742D1F209ACB01B0C634AF0AEE89F35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 124c8bbdc6a86a728646364776c8f414860ee8a2dc1908971885431632fed7fa
MD5 d9694d5977c42721b7109624c19df58e
SHA1 a9c7f49e60f6c771774c92d699b9bb928b4592fe
SHA512 feef56cc012db0560912bcc526bcbc7036fef53bbf1bc95305bea60a1213a123a9e71f2fe22206bd2362cba9787dde540ded1586b7a65c505e77ea17c4b79a46
SSDEEP 12288:Q3j6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:Q3jKtHJycb5374jo
TLSH
T1D7D423228B9A434EC73783FD648C9B7747593B851D3629CE1FFF26404D05B8A819A25E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 962KB
SHA256 ddc50d4b7feb1300b8691fa820ba8d430e32370a0fdd5733f351357074dec5a4
MD5 de85b4963ddc4dd3382f3593c87d0c1e
SHA1 25ebac2832ed48411c80e99d55f89cbfc851d2bc
SHA512 a0729724c8d882d2aec64d59d09972ea759dbb504bbdbb797a4a5f98128b1e43baaefb9bac107d2461f778f42e77c5a2613728798de3df47348cf21c30fd492e
SSDEEP 12288:+ObzA4LWO+vAYFTg6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:nHLBUTgKtHJycb5374jo
TLSH
T18825F111E7A400F9D93BC27CC8A68A26D2B2789D0724EBDF07AD4B551E137E64E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 a676f48a62d491032c0639825919731e4c832f2579806685cd2812e6f767e9b9
MD5 52a874d574ad6334e0ebcd29caeb9a9b
SHA1 ae1334f51969791c0747b19024ed9d381a87893a
SHA512 dec52053fb8c53f933b1930da2ae9821563cc212352b7d765831e6987d48a29bb7cf0846faad28b999da5af858e26c2fd2e3d1a40323ae4f8c211df4e0ce7348
SSDEEP 12288:NAcVmzIYNvUyBpOu6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:XTYNHQuKtHJycb5374jo
TLSH
T1F905F12F52AD09E9D63B927D8AC68219F2727856172196CF05F0837A0E07FD8BC3E745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 b189a5c25e6146518bd94a5cdcac5e5c4059c8e5deac6a70519ffab826b2c1ce
MD5 d09386e7f11bc163846b2346803652a5
SHA1 0867baa77d6a597656daf72a2bfa62cf61b09164
SHA512 2b444516734318c0ca4a1ad0ee6818f66feaa55091e74ad5cfe2a16ac7689075d74fcc83a549069ac7117fca474fa171a08ae6f1755e9ad59bb327f573c1f5d5
SSDEEP 24576:fnXoJjNYH84VVSNAApoEO466aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKw:fnXoJJYH84VVS6AmEFJas+cHBjSSKHPg
TLSH
T13165BF6EA3BC04E8D5BBD17DC5C24506F5B178621331CACF026182BA7F17AE59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 300d084fadf87b2d2e454a4173afe5416b0a34a46f1dac843492020ae391d19d
MD5 11491d5011e8f189b1d83162415c62ef
SHA1 a4f664a047cdaf2da040605c1e8eb813477f6265
SHA512 6a0038739d23cafe3efdd29023ca43cf792df0c026a51b79256e9793647fc661591ba353399a32b6cd877ee0c5870ce70948e4afb12ee4a4425f3cd22c685fc6
SSDEEP 24576:ov7Xbxd9Tuycf8M/TYlSux/r2PCfWKtHJycb5374jo:oDLL9TuJ0M/TYn2Pqz2o
TLSH
T111858D5EA3EC42D8E07BD6BD85A79147FAB2B855173081CF0291856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 d4054041f8796f2be484ad194e196aeeeee778028daa1e8d1e30f3c9bfacdd3e
MD5 ef3bc210b44d9b81d2d673ffd8664b55
SHA1 09046c4f68c0b9a1d378ab1620dc1adb6da615b4
SHA512 9ce9545dcef7ac771a0883e944fb4bd80670b1d9de070cc020a81811e1fad3250c9f5709cacdd0df1431401eb84eaa2249c651c63c98c2dab4d7801b5eba7ad7
SSDEEP 24576:5egJgpwJOmPOHWAK28ZguIGyPsxr5Vin10w9KtHJycb5374jo:5ngOJOmPOHF0z2o
TLSH
T11455CF3FA7BC05D5D03EC17D8A968916F6B1782603355ACF05A0827E5F1BEE46E3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 0b82d1a7ea9cb3cc7b0b6249ed40ab3e42605943ddcf556ca87db78c12e101c9
MD5 9ddf041c701d53c7b39bc285e05210bc
SHA1 a47b08142701e57402b1261ad27ce4c7788de8ea
SHA512 04edb45e9689f1d9c6f77b458bc80e042a9171bc22611a66509d9f03db88f06cb1084a9f58895598e5f77bd446a9f4d136d956a4c9d3630cbe78ddca87c16ae9
SSDEEP 12288:0kNTJnJiTk3IUO7aU+wahW4JKqO56lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:06JnJiTk3R3waE4JrO5KtHJycb5374jo
TLSH
T19715D03DD2A810E8D477C2B4815A1B66FF31346D2B2669CB19B8D5313F02FD0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0702be60cbb0da88b54152da1c25053ef3551cc369664cc37dfa02acf70724b9
MD5 d7e13acc713ecbd7d799671ceb207db0
SHA1 fcc923e358966837930f6697f48d531bbe907d6a
SHA512 e15286b36decd014a14660f13126dd8d9866acf2093de1b8d98896d78e66bca4da224aeb9a860aea875bdb0e2f0e2a69aef941fc36da3a8d93404b630d3dbf5c
SSDEEP 24576:QA9EqCceDQncA/BmlvLto8cFVr9og9P/Z6pjKtHJycb5374jo:/9EqCzDScAZmlvTcFg8Ph6Mz2o
TLSH
T1EFA55D05F7EB5298E8B3C6F1C96694169B327C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 700KB
SHA256 25c1eece118a002c65975b920e9d3f53ea9c2891605eb3facaabf456e8404860
MD5 5312c796200b52f208d7e265442deb4d
SHA1 718cddb9690f45ecb377a51d9745feb1bf480297
SHA512 c6f60684a9f14b31d1603de7807271b5c6592be6d4827c075d9b7a0a3697bc67c35f7f4b2acf652f17739a547ec474dd091c69d31026313505fd836c4a5502c5
SSDEEP 12288:+lYJeXm5nkEUuEWRw6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:+lYJeXm5jUuEW+KtHJycb5374jo
TLSH
T14AE4125D67AC21D9C23BC2BD94998B65D371B0A117222BEF0BF4C2798E06FC54E39B44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 a8bc1e1450f5ba1c58d99443d4634e939f95bac341e21ec95d36fe229c9ef3d2
MD5 d31f47c167671c2327d074ea29bc6442
SHA1 dbc81536408622c1392518bb604af340d507c10f
SHA512 57393c4ee455df33b15da7ed56e78b5c5ea611a81c261485690299aad44eb59325440f449f7a919da592ba9e8c4ef0626d6cdf3b819041b2f13774ff1fd0b04c
SSDEEP 12288:txm6kyjq6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:tctyjqKtHJycb5374jo
TLSH
T183F4220163E4429CCA36837C99AA83B58B757D201F3166CF1AE5F73E5E32BC49474B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 8a4931dce4c549460d9a7bc8c89a2d720f081b1f637c3e72b5686baf43115975
MD5 486821d77cdd9d261a5ee7faace29489
SHA1 a444c6e1e83f7d8cff3351e2e2d0c7fc49dfaddb
SHA512 b7f7befa04268028564cd2cf74a76b1ef88278f368a916617979d6206f7e8fa3a43f6fbd5b79a91351af3a5fa51dc3f157cfeb3ccd316c18c9c5ad6fbd79408f
SSDEEP 12288:qSg96lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:zg9KtHJycb5374jo
TLSH
T14CD4232247A9434DCB3383FC649D9B7683A937651D363CCF1FFEA2608E05B85819A64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4edaf7c6568eb9941eae629d73d79131e1a6bde864654cae21b6cef8ca0f8f45
MD5 ec6fa528005690c522d686162e661d1c
SHA1 e9ebd1560e1661268bc12ead7d16d8736ac8115e
SHA512 8b282507d9fddf021ec22327d7c599bd8c4af97cc738084f43cb74c55ea91c65b21f8241e5d5138f64f5e7e1fc0ae41d5ca6c39cd44431641b9ab24e3a950eda
SSDEEP 24576:CC+TyQIu93VAumZrHjm6KtHJycb5374jo:C/TfIq+AFz2o
TLSH
T187558D1DA7F919CAE276C275C8A34493E633B472137196CF2484C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 14530d558619212ca0db554969729711267fe7441be3e9827a7c68dd96f1a4b7
MD5 4990084a291dc7c254fc606126355eb3
SHA1 951ed11e481744ecf88b1069d9261692cee964b9
SHA512 1e6cbb042a13d8ee835f82e4076481c8491f10e4eb2eda7ab8cd9d597fe9a5a1d5d526e1dfcbe29ebcc58a9a97932d00031b436b3b955d0f58cc3bc841f31d8e
SSDEEP 12288:HcyrWOstaa3kcsf6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:+LQikZfKtHJycb5374jo
TLSH
T13805F00BB3AA0099D177C27C88898262F7B37471172267CF06E1C7794F57AE9AD38B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 11ee7592cd0a0056a458a2b901771944223a52cd58ba780b80ccd382e9b8e7c2
MD5 b1660d4236a47c11dc129de057e6902d
SHA1 19f9c87190e4499bbc7899bcc881fc7ff02eba3b
SHA512 8f03648f646e20d7a7ffa079180b4d8235953077b41e020bef3f558a51e26e21b97c87981e04cf1ba285903c28e9c123413b96db9745cfd7e327e561b8697676
SSDEEP 49152:KpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LhAPOz2o:npC7b4+80GTLT2o
TLSH
T1F0A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d6ec146322d37df8cce67cd55681a20f35d93969710a5db7d182e97705456ae6
MD5 0fca9339cbb1299f29fdf54a7a6ae6d0
SHA1 8c9aa0a8f8cbc8e22987e3a76673837075cbde7e
SHA512 59687421f50f532964c10853cf4d3d8d61958e735498e47a5fa12e506357196f75d73d516e8c9fce0e921dffc5168c5e4d76ac6bbc655fd444397c6109590a30
SSDEEP 24576:XSAwJPE1IDAo+4Kt+l4413vUQhlKtHJycb5374jo:XqPCIo4Kol4dQqz2o
TLSH
T1B155B02AA7F946E5E17AC7B4D663C611FB723823133163CF5290813E0E16AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 980KB
SHA256 eca8b03f1ecb70b1a0f9d2e6de8c09d5d0976db6ed324e8e8758419929051974
MD5 fedb1728f6fd2a4e2e20daf0bd4cf48e
SHA1 84f05636a0111679b7cd374710c0569c08df0d37
SHA512 13f3985d0d8416f24c9bb6e0761b993a9d1002f402cc9472786600eee2abffe61130c2ada5722f6132ad0a9b283a56e7e7e057fc83789ff14c5cd2acf10120d0
SSDEEP 12288:+StyLCFBoPLCRy66NQ4t3j6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:ryLXPLcd94t3jKtHJycb5374jo
TLSH
T10325E13ED76D05E4D53AC27CD6A38A06F67238AD033166CB1AE491791F1BFE46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 94fd98792e6048b91fd4e5d35349ce70f4b85682572a7e4eaa07b84c6d38f13b
MD5 a1e190f8190fa4c655e48903191b12e6
SHA1 f5666c499174f8d96d82408a32d2bfcb3aa398de
SHA512 2ee5bb6b3c8a2aeb52729d607bf659e795d03269594431acfbbaaf3e159553ff0e8c95ed06917348346fed67ba8e80e85ff6877e52293bc9393bd17b2d8cbc74
SSDEEP 12288:q9l+Lj3IkxjbBzzG6lQ+OxY4qyws1S2uJycb5igYjmCC4j69z:qSL8qjpzGKtHJycb5374jo
TLSH
T13CF4121A47E41188D13A83B8E46A837682B17D72173569EF3AD9D6764F35BC0C03EF19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1140-277-0x00007FF796460000-0x00007FF79692A000-memory.dmp

Download

memory/1140-357-0x00007FF796460000-0x00007FF79692A000-memory.dmp

Download

memory/1140-273-0x000002B2736D0000-0x000002B273736000-memory.dmp

Download

memory/1140-272-0x000002B2736D0000-0x000002B273736000-memory.dmp

Download

memory/1732-204-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1732-188-0x00000000007C0000-0x0000000000829000-memory.dmp

Download

memory/1732-269-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1732-193-0x00000000007C0000-0x0000000000829000-memory.dmp

Download

memory/2004-290-0x000001CC6BF90000-0x000001CC6BF9C000-memory.dmp

Download

memory/2004-161-0x000001CC6BF00000-0x000001CC6BF66000-memory.dmp

Download

memory/2004-254-0x00007FF676180000-0x00007FF676296000-memory.dmp

Download

memory/2004-160-0x000001CC6BF00000-0x000001CC6BF66000-memory.dmp

Download

memory/2004-159-0x00007FF676180000-0x00007FF676296000-memory.dmp

Download

memory/2392-140-0x00000282AA6F0000-0x00000282AA756000-memory.dmp

Download

memory/2392-141-0x00000282AA6F0000-0x00000282AA756000-memory.dmp

Download

memory/2392-139-0x00000282AA4D0000-0x00000282AA5CA000-memory.dmp

Download

memory/2460-396-0x000002131EBB0000-0x000002131EBC0000-memory.dmp

Download

memory/2460-390-0x000002131EBB0000-0x000002131EBC0000-memory.dmp

Download

memory/2460-393-0x000002131EBB0000-0x000002131EBC0000-memory.dmp

Download

memory/2460-391-0x000002131EBB0000-0x000002131EBC0000-memory.dmp

Download

memory/2460-398-0x000002131EBB0000-0x000002131EBC0000-memory.dmp

Download

memory/2460-394-0x000002131EBB0000-0x000002131EBC0000-memory.dmp

Download

memory/2460-397-0x000002131EBB0000-0x000002131EBC0000-memory.dmp

Download

memory/2460-392-0x000002131EBB0000-0x000002131EBC0000-memory.dmp

Download

memory/2460-395-0x000002131EBB0000-0x000002131EBC0000-memory.dmp

Download

memory/2656-220-0x0000016C62FB0000-0x0000016C63016000-memory.dmp

Download

memory/2656-281-0x00007FF6C8860000-0x00007FF6C8910000-memory.dmp

Download

memory/2656-221-0x0000016C62FB0000-0x0000016C63016000-memory.dmp

Download

memory/2656-222-0x00007FF6C8860000-0x00007FF6C8910000-memory.dmp

Download

memory/2964-306-0x00007FF6CEC50000-0x00007FF6CEF8E000-memory.dmp

Download

memory/2964-365-0x00007FF6CEC50000-0x00007FF6CEF8E000-memory.dmp

Download

memory/2964-313-0x00000209E3550000-0x00000209E3560000-memory.dmp

Download

memory/2964-302-0x00000209E2620000-0x00000209E2686000-memory.dmp

Download

memory/2964-303-0x00000209E2620000-0x00000209E2686000-memory.dmp

Download

memory/2964-329-0x00000209E3650000-0x00000209E3660000-memory.dmp

Download

memory/2964-346-0x00000209EBD40000-0x00000209EBD48000-memory.dmp

Download

memory/3028-171-0x000001E9F2E40000-0x000001E9F2F3A000-memory.dmp

Download

memory/3028-173-0x000001E9F3060000-0x000001E9F30C6000-memory.dmp

Download

memory/3028-172-0x000001E9F3060000-0x000001E9F30C6000-memory.dmp

Download

memory/3732-278-0x00007FF640E20000-0x00007FF64124B000-memory.dmp

Download

memory/3732-211-0x000001B9AD590000-0x000001B9AD5F6000-memory.dmp

Download

memory/3732-212-0x00007FF640E20000-0x00007FF64124B000-memory.dmp

Download

memory/3732-210-0x000001B9AD590000-0x000001B9AD5F6000-memory.dmp

Download

memory/3732-310-0x000001B9AD590000-0x000001B9AD5F6000-memory.dmp

Download

memory/3732-312-0x00007FF640E20000-0x00007FF64124B000-memory.dmp

Download

memory/3760-206-0x00007FF746AC0000-0x00007FF746B6A000-memory.dmp

Download

memory/3760-271-0x00007FF746AC0000-0x00007FF746B6A000-memory.dmp

Download

memory/3760-200-0x000002BA96F20000-0x000002BA96F86000-memory.dmp

Download

memory/3760-199-0x000002BA96F20000-0x000002BA96F86000-memory.dmp

Download

memory/3844-240-0x000002611A770000-0x000002611A7D6000-memory.dmp

Download

memory/3844-353-0x000002611A7E0000-0x000002611A7EC000-memory.dmp

Download

memory/3844-239-0x000002611A770000-0x000002611A7D6000-memory.dmp

Download

memory/3844-238-0x00007FF6AEC30000-0x00007FF6AEE1F000-memory.dmp

Download

memory/3844-299-0x00007FF6AEC30000-0x00007FF6AEE1F000-memory.dmp

Download

memory/3940-247-0x00000242EE8E0000-0x00000242EE946000-memory.dmp

Download

memory/3940-248-0x00000242EE8E0000-0x00000242EE946000-memory.dmp

Download

memory/3940-246-0x00007FF6F54F0000-0x00007FF6F5681000-memory.dmp

Download

memory/3940-305-0x00007FF6F54F0000-0x00007FF6F5681000-memory.dmp

Download

memory/3968-7-0x0000000002FB0000-0x0000000003019000-memory.dmp

Download

memory/3968-209-0x0000000001520000-0x00000000015BC000-memory.dmp

Download

memory/3968-0-0x00000000015D0000-0x00000000016BC000-memory.dmp

Download

memory/3968-2-0x0000000002FB0000-0x0000000003019000-memory.dmp

Download

memory/3976-264-0x00007FF648230000-0x00007FF64861F000-memory.dmp

Download

memory/3976-262-0x000001CF4FDA0000-0x000001CF4FE06000-memory.dmp

Download

memory/3976-256-0x000001CF4FDA0000-0x000001CF4FE06000-memory.dmp

Download

memory/3976-258-0x00007FF648230000-0x00007FF64861F000-memory.dmp

Download

memory/3976-255-0x000001CF4FDA0000-0x000001CF4FE06000-memory.dmp

Download

memory/5176-128-0x00007FF761370000-0x00007FF7615FA000-memory.dmp

Download

memory/5176-126-0x000002195F380000-0x000002195F3E6000-memory.dmp

Download

memory/5176-122-0x000002195F380000-0x000002195F3E6000-memory.dmp

Download

memory/5176-121-0x000002195F380000-0x000002195F3E6000-memory.dmp

Download

memory/5176-120-0x00007FF761370000-0x00007FF7615FA000-memory.dmp

Download

memory/5280-293-0x00007FF6F09B0000-0x00007FF6F0C73000-memory.dmp

Download

memory/5280-229-0x000001BC5DC00000-0x000001BC5DC66000-memory.dmp

Download

memory/5280-228-0x00007FF6F09B0000-0x00007FF6F0C73000-memory.dmp

Download

memory/5280-230-0x000001BC5DC00000-0x000001BC5DC66000-memory.dmp

Download

memory/5356-267-0x00007FF66A2C0000-0x00007FF66A57D000-memory.dmp

Download

memory/5356-354-0x00007FF66A2C0000-0x00007FF66A57D000-memory.dmp

Download

memory/5368-26-0x00007FF69D970000-0x00007FF69DA56000-memory.dmp

Download

memory/5368-27-0x00000287BFB10000-0x00000287BFB76000-memory.dmp

Download

memory/5368-29-0x00000287BFB10000-0x00000287BFB76000-memory.dmp

Download

memory/5368-205-0x00007FF69D970000-0x00007FF69DA56000-memory.dmp

Download

memory/5456-131-0x000001F80C9D0000-0x000001F80CACA000-memory.dmp

Download

memory/5456-133-0x000001F80CBF0000-0x000001F80CC56000-memory.dmp

Download

memory/5456-132-0x000001F80CBF0000-0x000001F80CC56000-memory.dmp

Download

memory/5480-179-0x00007FF72AAB0000-0x00007FF72AB96000-memory.dmp

Download

memory/5480-15-0x00007FF72AAB0000-0x00007FF72AB96000-memory.dmp

Download

memory/5480-16-0x0000025E8D2B0000-0x0000025E8D316000-memory.dmp

Download

memory/5480-18-0x0000025E8D2B0000-0x0000025E8D316000-memory.dmp

Download

memory/5744-283-0x0000018CEE810000-0x0000018CEE876000-memory.dmp

Download

memory/5744-282-0x00007FF7F9CB0000-0x00007FF7FA1DA000-memory.dmp

Download

memory/5744-284-0x0000018CEE810000-0x0000018CEE876000-memory.dmp

Download

memory/5744-358-0x00007FF7F9CB0000-0x00007FF7FA1DA000-memory.dmp

Download

memory/5836-148-0x000001437E760000-0x000001437E7C6000-memory.dmp

Download

memory/5836-147-0x00007FF72BB90000-0x00007FF72BCF8000-memory.dmp

Download

memory/5836-156-0x00007FF72BB90000-0x00007FF72BCF8000-memory.dmp

Download

memory/5836-154-0x000001437E760000-0x000001437E7C6000-memory.dmp

Download

memory/5836-149-0x000001437E760000-0x000001437E7C6000-memory.dmp

Download

memory/6048-362-0x00007FF702F40000-0x00007FF70306E000-memory.dmp

Download

memory/6048-363-0x00000219CA190000-0x00000219CA198000-memory.dmp

Download

memory/6048-291-0x00000219C9980000-0x00000219C99E6000-memory.dmp

Download

memory/6048-292-0x00000219C9980000-0x00000219C99E6000-memory.dmp

Download

memory/6048-294-0x00007FF702F40000-0x00007FF70306E000-memory.dmp

Download

memory/6116-180-0x000001BE77A10000-0x000001BE77A76000-memory.dmp

Download

memory/6116-182-0x000001BE77A10000-0x000001BE77A76000-memory.dmp

Download

memory/6116-257-0x00007FF763380000-0x00007FF7634C6000-memory.dmp

Download

memory/6116-181-0x00007FF763380000-0x00007FF7634C6000-memory.dmp

Download