a2c681bc7f638d458802fc852641b29718b220b54f5da305ec97e952f613cb7c

Analysis

max time kernel
148s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Size 5.0MB
Sample260507-mft8vsft4q
SHA256 a2c681bc7f638d458802fc852641b29718b220b54f5da305ec97e952f613cb7c
MD5 34b3a2e2adc9d65cd9c16c848a14d164
SHA1 b2ce6301e2d5c27861c38cfcd7474846c8032ac3
SHA512 94b08f3532b75b6b16e57103e028d464aba9fcedd132c878739a55c2d89badfb9f00807a7722963051a1b181e7a962a7dda8dd77462a800daea5bff8e3a30821
SSDEEP 98304:rxLfGD4racjhWcZluU/DBkC0JwqjzMQlQiQj9Mtl:rEpcBMU/QJwOMoICt
TLSH
T19A36BF12FB46C1B2D992017555AEAB7F08396E244B34C8D3E3D01EAF88715C26B3F796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4188	alg.exe
2564	DiagnosticsHub.StandardCollector.Service.exe
3432	fxssvc.exe
3628	elevation_service.exe
5920	elevation_service.exe
3244	maintenanceservice.exe
5928	msdtc.exe
5924	OSE.EXE
1368	PerceptionSimulationService.exe
3032	perfhost.exe
4940	locator.exe
5868	SensorDataService.exe
2004	snmptrap.exe
4396	spectrum.exe
1316	ssh-agent.exe
4656	TieringEngineService.exe
3260	AgentService.exe
3380	vds.exe
5540	vssvc.exe
2488	wbengine.exe
1704	WmiApSrv.exe
392	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c4cfa0538b62accd.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5a396cf0bdedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067da4bd00bdedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000937daecf0bdedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000268ec1cf0bdedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce41d2cf0bdedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b66b7ccf0bdedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Token: SeAuditPrivilege	3432	fxssvc.exe
Token: SeRestorePrivilege	4656	TieringEngineService.exe
Token: SeManageVolumePrivilege	4656	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3260	AgentService.exe
Token: SeBackupPrivilege	5540	vssvc.exe
Token: SeRestorePrivilege	5540	vssvc.exe
Token: SeAuditPrivilege	5540	vssvc.exe
Token: SeBackupPrivilege	2488	wbengine.exe
Token: SeRestorePrivilege	2488	wbengine.exe
Token: SeSecurityPrivilege	2488	wbengine.exe
Token: 33	392	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	392	SearchIndexer.exe
Token: SeDebugPrivilege	4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Token: SeDebugPrivilege	4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Token: SeDebugPrivilege	4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Token: SeDebugPrivilege	4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Token: SeDebugPrivilege	4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Token: SeDebugPrivilege	4188	alg.exe
Token: SeDebugPrivilege	4188	alg.exe
Token: SeDebugPrivilege	4188	alg.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
4984	2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 4016	392	SearchIndexer.exe	104
PID 392 wrote to memory of 5616	392	SearchIndexer.exe	105
PID 392 wrote to memory of 5852	392	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_34b3a2e2adc9d65cd9c16c848a14d164_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4984

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4028

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5920

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3244

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5928

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5924

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1368

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3032

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5868

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2004

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1516

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3380

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1704

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4016
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2560 2708 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5616
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2052 2856 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3c39e7de66a3750c95a0335186034d882090955d2fee73bbe05db5bd100e1051
MD5 09e33542a4362dac9b56a6478fa90232
SHA1 fee1214ed7c8f4cd23160a140ba227c37e925338
SHA512 949dfcc5e2ec185b7ddb709838e2b454ebc9fee5bb8c9fad00c3d6db989e9a2173d4ab6eeba033cb176ca6de0ddf0be0e253f8f8f84b18702526b18b73c6ce17
SSDEEP 49152:yb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnEQrHvMiMtl:U3q6tjBzQj9Mtl
TLSH
T142D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 cd6443115a5f027ebb1283069a39b868ebedfd6a6c2292ce86068fbc011081b6
MD5 39ddd5542b0179a9efba46c718882787
SHA1 bfdfc79b1983a54b276b5a1f2abc518bdfc7500a
SHA512 1d9fdc80af979476f83527f841cd769a62e5bf544403a2c0f148fed8cf4998c91b3255ab582dc5386850503e40293088f9b88e6b8aeea269326c1933ed3907c0
SSDEEP 12288:R1XLsswWkxy2lRq2czA/2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:fXYfDtczA/Qr4kzQOXnKN/zGM7Zl
TLSH
T1EB85F129B7D408F9ED6B823DCDA28502E63378514364E7DB03E499690E373D89E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 fd165a08cf334830f2b6c9f1f05b145023cde8c4798b13a68dc8f322a407c7ef
MD5 3d9f268f40fb6394cdf36d78c14c7030
SHA1 2de041b042dcdf7962a6a0927b946a700026cfa1
SHA512 f35afe092c1395fc9806a7d682489344a1d5807a0a5f0d710a5367e61148547d866104d6cab776399b58ea9798a168401fef99eca6ba8cb7dee848d2a1a41d55
SSDEEP 24576:w0Le5ji0hmxnrM8Qr4kzQOXnKN/zGM7Zl:wPji0AxlQrHvMiMtl
TLSH
T161A59E16F6748335D073C0B9C5D2A68AED72308257308ACB4296D77C6E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2707b21f85cab488b0183f141c669d4cb4e8b99eda5e478d573bf38d3070701d
MD5 350fb1c0f70ad9e5c18aeeb70a758fda
SHA1 bbd436fcc34ec6ecef90806640fe66805817edec
SHA512 ae10e67031d36e5e60a1ec7981c76f4ac45962f8d2be1bfb959c6f5388247f94631cbfe2883872b05e78ad614ebcb2eb2ef71dce757b466ab55333dc8c224b3e
SSDEEP 24576:Pa7/ezSC6vUyDZaqgrvWx6q8wyueQr4kzQOXnKN/zGM7Zl:C/ezSC6vURPvMHjyRQrHvMiMtl
TLSH
T174755C25F5788323D0B2D0BAC5D6AA9AFE323046573089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0305d2a473d6cbcdaabd949022e4f74466ab89679117c77f083cd2c9510969a9
MD5 3dd51a7ae09271239aa03b1f299fa25a
SHA1 e0873c1c75518be135d6334e0b80c4b00891568a
SHA512 ea987457b71492214c9c473e6ef9302928272982522377989aba162b7cc6e3bdd81ee8304dd4b529d2387f10542ffaaea128f5d7c23b68fa5e1993331f61e905
SSDEEP 24576:CVbqPb88hv/lV7jQr4kzQOXnKN/zGM7Zl:CVO88hXlVHQrHvMiMtl
TLSH
T1FF55AF66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 5e5c0930e3f2811b2b0b7940ee2bb45b3e5c121f9ceca691e96e363b15ff4b08
MD5 8c8d59d036a6c561ce5e3cc223002942
SHA1 443b0ee8a9c4e02c62a8bd1bde1c7eb7d2ffaf61
SHA512 cab4cc9a9cdb0879411ac7984081a49bc61d74158eb46455410d61ae7af6797b70d989db6d1bde6fc6511ea10d17a9775896f989921d65b0187c3396fa8c98aa
SSDEEP 12288:/Gg2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:/GgQr4kzQOXnKN/zGM7Zl
TLSH
T1EB752357A74C4082F3AF8E33FB51AAC2963A4C41815D9DA3C0A4FE8D4C7F5ADE18A516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 58e2aa913a32af09451038f3cda40f9a01d43c2dd412f0b5a7a69a43de5845cb
MD5 ca3f6d85470c9c9a25c447bf43e15915
SHA1 9ea23bb26609f64c2af8ecb863d4a9028b36e739
SHA512 edcb5436cc8412ad0a8d8c3dc00ebf55177a72fe49cbde31e582ad47f3846e1a231328625dfb41bfbad1d3093dea165b75341a78344b7fbdf71b0c033dbb216e
SSDEEP 12288:veBNUbTVO86Ub2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:vJIUbQr4kzQOXnKN/zGM7Zl
TLSH
T13E85CF3BEE28ECD2C27E8D795B918640D77278704B61A3CBD164C20ECE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 521ed34f960dcd1b0cec1ca31257f23791b42b9dce647498030e16524166b0a6
MD5 5c65306fec987ecff11bd1c1197116cc
SHA1 07abe8fc4fb7beb9c80663f605049807f84368ac
SHA512 09df966d1de09d02f7085ffab607d2b747e332dbf9f39f6bfac941ce110a7306b14dddea4366a3f1205f52a199a92c8f77a9fa64695b03f750c6915eb942c9e6
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THb:CQvGAdlCEL8c/pRNw5COQj9Mtl
TLSH
T13E266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 58a84053b2ea92bc9d81d7d25c120c80e71a77f89141fc1e55d093799ccc5e10
MD5 05aa9d85a9ce0c78af90d9a88ec347a2
SHA1 1e9f96d2760439a9962eb81d6c1e28c40f78de05
SHA512 aecba80116f3ccf93cc16c6729461a28a3dbeee6b50e9170ecef3a8dab5dbb8650c99d7c891178a46e60bb205769043be7f7c099fd7b5eaeef00de75af1ece3d
SSDEEP 12288:gAwSfxL/2Dc3xDLLmt0LDQewsAjV2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcm:1wewsAjVQr4kzQOXnKN/zGM7Zl
TLSH
T1C795E031FE74D036C3BF0DB26B26D716543DA9204B611AC3E3E89E8E49742D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ef0fdab43e8ee20896a7b126fcd6d411c633766cffba6c8b599af71c3f3b77ff
MD5 b600a25f8b40fd5537fe5fac9444039c
SHA1 a56207db454877b01df027b6cbe1eec8e86693f4
SHA512 a97bf5aac6bc84614aae30bdf13b2f3d62a66684570d0457d150f496cfbbe43402a8eb54e94be0cee26a1f011c65f54f84b868ec6261b75dd4905d563d0084fa
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH9ICt:7UEtQevvqc2W1cpV29I329Ie
TLSH
T1FF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4800f993c86850fbb23e54740291127b06d17f8d2b1cfb1479d9964587e52cde
MD5 a0731a5181f812f7692b4795e72dc0ce
SHA1 0f903dbf25056f65a6c6dc88be9a254e6c6153d9
SHA512 501244fbe2701914c45b44a8b294aed3bcb195818edb8cb74475bfec8c05d4aa0367f811637b1f347325c74f0d6b1b59191cbbcea6c419e897d616d47ba82a9b
SSDEEP 49152:hCbRquA/m2yL5zTfFiV+XenmE3/z1QrHvMiMtl:OoquVjnmaQj9Mtl
TLSH
T1A1D58D0976B8C1E4D1F6C77886A2C647F37178154B35ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9f0c6105d504f6ca145a0c7f04563800770e47764e0b3a9cc14d71216d8e1922
MD5 6b94e09edb79ba6882fcd1d2a0bb1b1f
SHA1 a776946bc62314e21745205f6f8fa742596d9235
SHA512 fd6987a5b11a00edfb82c97e65f9c3b8ecaed892cd2a172aef5a8112b333ca7db23d200a7fb01cffac553b97599671c4b023326996f019a76c933579b6e666b0
SSDEEP 24576:UAhGLmIFoiwtA5l7S536Qr4kzQOXnKN/zGM7Zl:UAM1Foiq5KQrHvMiMtl
TLSH
T12F35AD81E7F945D4F5B3AA78A9B69571EA76BCA65E31C20F2160D10F0E33A40DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c38c16edef16796c9b1962a833022abf133371d0ad8a9b20e4bc6addc3db0341
MD5 dcaa157ad9574988c225a8a40ef1e92a
SHA1 46699fba5f0fdaaa94623180a45f10d7e79ce966
SHA512 e51a16cebac18e16586b0b6f2a22db87c48c1a16adb2542e573131748bbef5d5be31784eee9c8e8b028547dff8dcf73abc282a2c851797da5b2bbb0706f7b899
SSDEEP 12288:Kmw5HEjsChNOBFgl0WDm+C+2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6l:DwuXOWxQr4kzQOXnKN/zGM7Zl
TLSH
T1B385F14673A80CF9E5A78639C657C532E7B2BC012625DB1F43A0C65B5F37361AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 d2b7b4bcf799b2cac17dc97f2ff7793e03a4cbacf4ca726c6e8aa52b4623e270
MD5 4b80a05cb65f05217c76e8c7e508ffdd
SHA1 bc4dd5c78b123bea38241ab40f3bb362b0b75788
SHA512 a0c17d948640456fe66964689e9ba26d8fc4ae8f2d859cd3457102174aaaf11f9a61f3b65feb8a936ffc2edeaaf891addfff5e3f90df618b6a9bcdc776ce03ec
SSDEEP 12288:mbZ1IyF2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:GZu0Qr4kzQOXnKN/zGM7Zl
TLSH
T11175239A33D810F5E2A78639DEE15B42D3727852133543CF41648A9E0E37AD9DE3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 512a6d23dd2c29d1dee36056aaed3734cad9d65014376f78d95c3df790f40fc1
MD5 463ff7a392e4b019bca8b0a27e3cd556
SHA1 2f3da9d90ae79c51bb4f18d6ab64247f9e4b0d48
SHA512 99dd24828878735e3ef9df7f8d89e811425fe3cac198d99f3541d0a42202de3098798182824a56013acf446e5bb0cf0d0cbcd64909a562092b453f85d06de03c
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UP:SQRQyi36YOcPuLvw2gAf+PN3XQj9Mtl
TLSH
T1B3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0ca43239bf5ca148a446d71a096d5de5267e2562c479efe689972a14167608db
MD5 c2e5cbf45030bae9271f3ce039a9bbb0
SHA1 b8f161f39a6e247b8db1911a9cdc579e19f8b49d
SHA512 3bae584fde202926cd2c60c2891d3802f7509b7f1b54aa850ec344dc6c13bdb71a11c8946af7a627ec559134b3de55689c7e52bc0579c0034d0667d7df5d44ac
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UP:GQRQyi36YOcPuLvw2gAf+PN3XQj9Mtl
TLSH
T178667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e536fdbb2173cc37722364891b33e28fe8658f459f0d11c054a2bf612f6133fd
MD5 6d81cf416caeafbc96fec926dba675fb
SHA1 00ffc08874534ecfaa92c3bdf11e28fe034c82e9
SHA512 09ac5f568165cdd0461a18cdf5114898958c9a1e0d6daf864aa19beb9723c2bfd72907332cb31ad73061f0139d3b388d578b740d75f4cf70acca14a165fb54ff
SSDEEP 24576:UwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0EQr4kzQOXnKN/zb:a68Qg55nhxeWu7PNU3/lQrHvMiMtl
TLSH
T197B55A33B2F60099C44DE1769F4A872196D27C718FE0E3DB8551720A1FB2AD47B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 66ddaf1b9014b06a97f1b3ca588cbc2b4538f1290ed83dabcc3813e013f2613b
MD5 1a274db1dc5a08d2b04643f2914da965
SHA1 55946594fb74674666a4cc984ebb0172d61e65df
SHA512 aa40de63623653fe15fa4d24fb624a64e6fdbafb2ef6d0efb8c45e3a0fdd72ebb22e92d4ea9971defaee5a67906ba7283c2d250c13a4ee6b85778d484337cd67
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk995:Xy5112gYy5azzVvD69nLKnhZgQj9Mtl
TLSH
T1CC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7b49ca519817b89de4bf3990f52d6eda65f01e081bf9732dc092cb13da8b4854
MD5 7dbd04fa923b38beba5444c370cc6298
SHA1 0b159ccfa11df314aad488b378cafde89f1cc3af
SHA512 395e672bcb02e825119dac2d467c388891c838f361b8807321578fc2ca3567bd0a39d29f5a0704a45f51e33ae2e1c03d0188c0dd6d833b4380ccf6b59b406565
SSDEEP 49152:pB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glPQrHvMiMtl:/u6JmQxd2dPQj9Mtl
TLSH
T15ED59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6a041640cc42c8dfd704054ad52045f6d221d2e1e3084b4dd7c547cd8eecefe7
MD5 89945e91a985dde701be05297f909e5b
SHA1 4a18a1716c0971700d306d65bc5c123e6debc979
SHA512 61e86c58f1fc6706a32f9f0667e91f1b084658f2bbadec86a8c4e636f1088e35a62b1c77af1b750016d04ac26872e5b183fef267dae8b321b227e0f127b50a23
SSDEEP 49152:e1hpsNoJpF1A6yU44CwH7R4x7QrHvMiMtl:emifPVRaQj9Mtl
TLSH
T10FB5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0f070590c62788733779a96d44a34d7f4072d079d48c0219a61f1a798b1cfe1a
MD5 c710ff15db823348cd91cef023e8c62d
SHA1 3ec16368424716f9ad42f89a4b0bad4be59cad92
SHA512 2840deab8a91e573f41d38b743168e4b295a3275d1b37c9b0f3b409d8af0be4678bc2aa5d4ec9137eab0c570fa535b0722b9e731281b52a1a4ca16cd1d9a93a3
SSDEEP 49152:rSuZQIY0Be2KIRVtOnks6NMHq0QrHvMiMtl:55dKOi610Qj9Mtl
TLSH
T12DC5BF13F2E940E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3d41e2ea80f169af94a5133bd185457f3517aaf33ad4c1279a1cc5029f568213
MD5 c10ab7bd7b5f099a58eb5b0984891f08
SHA1 2589644d597a217ff287bcdcadccc562280638ea
SHA512 81c795946e532ee324f26d64b57ce5d35af6195ac3215a2ee968d7de7f5d270c95ad230b3ef665de58509f4bb826102a926903840aecb1450984b4038b5d5511
SSDEEP 49152:khtSn8EApI0figGgiDn0AP5w/QrHvMiMtl:lX2i/ph2Qj9Mtl
TLSH
T1A595BE13F2D900E8D05ED175C7468632EA62BC150B39BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 4741a039bf8a87ba6eedff4e1394626e7786c229ae033a4a6c400c4185414d38
MD5 8e92622c1e014c5c5fe7dd9332e6a5d6
SHA1 4441093f9728ca87153dab5106045bfa0a0b0876
SHA512 38f19d2c276840ea308d2ca042d9099c79314549abda1876e57b7377d8b4bf907235b242b12c6ac72b6dc7e5ef70a8060580b7584e0a0f4f6a467e42426b6931
SSDEEP 12288:eY2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:eYQr4kzQOXnKN/zGM7Zl
TLSH
T124752357F74C4082F39B8A73EB11ABC2823D0C42925D59F7D198DD0D4CBF6ADE28A469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 67d9f24e44b4a1a5093d335dd8d640f6745e9c6a2f026d83ea091f51f54d1f2b
MD5 ff9a1a31efed40d2f8d3d881c1cd3f6d
SHA1 14adaeb1534bc4d31947cc9464fd912348eb8fa8
SHA512 837616674cc0325728c7066557e71b4f89ee80a93d800afe74dc80ca4f678072fc3eea4a361e24ef675269678941a1d2a5168be53cd3a464091279b42854a997
SSDEEP 12288:fZ2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:fZQr4kzQOXnKN/zGM7Zl
TLSH
T179752357F74C4082F39F8A33EB11AAC2823D4C42925D59F7D198DD0D4CBF6ADE28A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 0e6b59717ae81c135c79e889db9bb116648c3dc228939efb556b23c41ab31562
MD5 3c6a0031fa784d942b4c2ab536b316b4
SHA1 7bfcbcc2c1eb70ec0115e80e75ed2ea778ccdceb
SHA512 90bb163b3c3acd6816322a1c3fd3e0a0d1f87b16e1bb39228930de4c51cc51d93aaa8389dae908364705807f5314c2c70fa5a7f2d24c9adcd60fc075ddff368c
SSDEEP 12288:sz2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:szQr4kzQOXnKN/zGM7Zl
TLSH
T120752357F74C4082F39B8A33EB119BC2823D0C42A25D59F7D198DD0D4CBF6ADE28A469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 19f664e5a5e7043e7de152abd05daa707d8021e0db5ec6148efaa77f2b312d65
MD5 82212931129b8ba544cc942f6f4f9e2b
SHA1 f9d8aaf4a2b10125eb53227c4204b8b2a9ae78b2
SHA512 9279180f23d216c276f1099e7460a9d81d92d03614ff016a328918283ca0c5bb7c047257761a707546251113e34468a18d97f4eb1e9d9fc31636b38d353200d0
SSDEEP 12288:uVa2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:VQr4kzQOXnKN/zGM7Zl
TLSH
T17D752357774C40C2E1ABCA36DB219682D3797C81933A9AEFC2504D4E0CBB3ECE559B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 a25da8ebaa5141098383ba5b9ad3156cc4d5c53c5a76d48f2e8903bfdc0bc200
MD5 7c41f19eb78e101f4cf12934554a8542
SHA1 afb791e404e1c5de94521d120d10c37882eb66d9
SHA512 ec736d2895e6d632acbeca1c89f8f946c22300d6591a8b93f58ff3e7d79e31f172d151b3864c20b0f6aee4961c5d111a6627cc2ea3a5db5cd49f54447f3b4625
SSDEEP 12288:9i2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:9iQr4kzQOXnKN/zGM7Zl
TLSH
T179752357F74C4082F29F8A33EB119BC2863D0C42A15D59F7D198AD0D4CBF6ADE28A469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 eb96ddc53acdeb39ad11e59e5b249705be7505fa6902b07672dafcef49362d09
MD5 ebeb578f34256ca8bad41be64641d641
SHA1 cfb10eba5c0fad39e0a647bdaed5a9e1c2a9e8c9
SHA512 c026932f8a21141bda5d10991afb491fc246658261546239b9559224c1c0d8c2411ada2288c0641cea5b8f9f9c68bc0cbe73e70951a35868737170268c317227
SSDEEP 12288:xt2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:xtQr4kzQOXnKN/zGM7Zl
TLSH
T103752357F74C4082F39F8A33EB11AAC2823D4C42925D59F7D198DD0D4CBF6ADE28A469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 e2a6c314ed61f1ae80d37a2edda08799ab20ed49088a71aa69175213b33e1629
MD5 6aed693c00935c398385b03b4fccc1a5
SHA1 d960bee97bf6a981bf312d847902daa811130a98
SHA512 cd3a9a86824eb3da41dd0eb071ccbe734b85f30e14b9d884a9f54e9880982e6b1b8667372b0f5b69e7b71e5f9ccfaeaad49130c78585cebef0e156aaa6ecfdcd
SSDEEP 12288:uB2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:uBQr4kzQOXnKN/zGM7Zl
TLSH
T156752367F74C4082F39F8A73EB11AAC2823D0C42915D59B7D198DD4E4CBF1ADE28A469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 7da2fbaf21059810f51a1bc1f5c1435499c809f01b9f7fa4514d2f3e942a1020
MD5 981e108a382cc8156ef62cef7339ba76
SHA1 b7d6278ed4b22b2de41945a3f774334034fed4c9
SHA512 b9df2c9ec131364770f6a4ca1d6e1fa12c5beb5ce10a92c5ed725ce50822f978a45e5f227efba142b2488b951b0a9044b8a7865ae68b31595feed745242f5942
SSDEEP 12288:/iZwbNzzFEoS2cPvy52pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:aZMJzFVSO5Qr4kzQOXnKN/zGM7Zl
TLSH
T11A850195B39008F4ED67823ECE158942D2B27C560770CA5F03E43A5B4F773A15D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 0e8b524524de6247a78d06995957455f6e8d649579f92e44a676194af52b2fe0
MD5 d792672ebcaebf78f6c3af999dacea24
SHA1 4a5481a5a9a2fc8ba6ba1647ffcd1e632e58b21a
SHA512 0cf017571e550437addb72aba3ecf121eea7d8de264c3959be3ce9d61bd77ec480ffc2712012e9877781338d1ff7cdff79e7a808511bc57a6482e70bfb0aab1a
SSDEEP 12288:5k2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:5kQr4kzQOXnKN/zGM7Zl
TLSH
T100752357F74C4082F39F8A33EB119BC2823D0C82A15E59E7D198DD0D4CBF5ADE28A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 778d95e1c1bed419d981684516f4206f54f5a9d30a0d534845cc032b87d821c8
MD5 f1eabe9574eb5c154d4f2a266d78fd48
SHA1 349e99b11150a2c6fd3cb2f544890c3a35711f4c
SHA512 6de6843c04d76087499ef5d5f28a3af3b558f73d5187aaa39bf52df59cc125a8620f22043d56c76ee173daf4554d89efaf237cf37a3e20cf03b58c90d947de9a
SSDEEP 12288:xQ2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:xQQr4kzQOXnKN/zGM7Zl
TLSH
T10C752357F74C4082F35F8A33EB11AAC2823D4C42A15E59F7D198DD4D4CBF6ADE28A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 62f30c30574649cba06ab7be046e6dd27adfdb703c478cd6579beb884357f268
MD5 c02b5b596eaf7fa4a4eea7c110972297
SHA1 45289e0cbfc068daf01ed2a4773271d75a8afaaa
SHA512 86ab61384cdc81f4e86d2dd8da32479d66c1f2f3da97917f50c79a314762de9b7facd533e2f031b2aee0d64e0d4fa02c1faec368bd007f4676b9dd5dd9cd9214
SSDEEP 12288:qyPz5L8F2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:3zyFQr4kzQOXnKN/zGM7Zl
TLSH
T1E5851257739520F9D17B8235C9621A42F376783247248EAF53A44B7A1E372E4DE3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 1e5f3e27cfd2eaaa99d51ca88a60174b91093f596f8036e4c4040bd8190f4669
MD5 d367733d47f07ba2974178db29ecf7e2
SHA1 12be6882b20eaaf00cefd922d565c016ae7baccf
SHA512 a1e42f415ca6056e3f405d67ea5ab0d0ef465493ce9568f3b36b4d44c39910ae7bbf2df059debc6dbfbc02e38a4a782623bf9fba598f35b907621bb1172f185a
SSDEEP 12288:mk2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:mkQr4kzQOXnKN/zGM7Zl
TLSH
T192752357F74C4082F39F8A33EB11ABC2863D4C42A15E59E7D198DD0D4CBF5ADE28A429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 1a09890d23dbf962efcd48db764306f39b065373924b67b125525635cb720d61
MD5 38d58107ae31554f37977e9e0c421c01
SHA1 0264b1f06b0ddcd922d1317b5121375cb5a9d9e5
SHA512 90ddff90268b0cb3b14344c3657dc2d3f2d83d162f1854f0c313287fca19277ccbdd0500883204fc390c1d16caf03dfa6b55adeb441ecf0b112aafa1547a88ab
SSDEEP 12288:Ok2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:OkQr4kzQOXnKN/zGM7Zl
TLSH
T10F752357F74C4082F39F8A33EB119BC2823D4C82A15E59E7D198DD0D4CBF5ADE28A469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c7434dce172b3acf2466c50495fac0f3a5138120a164cb92f4dac0f21d8401bd
MD5 09a1c11bb9ee04b31860df017bd3ac1a
SHA1 a2d6b809205df6c78d503810751227604f669955
SHA512 738766684926a743564b37ea3f8310bb465f002e28f377a4f8fa9e8f27d2dd88760b7364cbd7f441723d628d8c60ba0368544eeb6d7ca24689751c30075b16ff
SSDEEP 24576:XCUkpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAnQr4kzQOXnKN/zGM7Zl:XCUMPTY+8Wg2lIL8lrIUJLWwiQrHvMic
TLSH
T1C765AE1EA3DC0896D0BBC1358A518A06EB32782A1B32D6CF1160C77D6F67ED95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 b04dd30f46d43d104ce5e683a29377d5031fe367802ef3bf92ba125cfb281d3b
MD5 dcb081fb398da2ddfe76696ef1b99e57
SHA1 c42c2844afcd5da5ffe062b2960b786519d153a0
SHA512 b8428827c3d42ca6b66aa5f8c92c224f3daa80a43cc6e02ee455d782a49c8a9e08935d7eb1914f24262f6bcedc24818ab2d410a5bc9239a713029319a7a10caa
SSDEEP 12288:Nksf02pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:90Qr4kzQOXnKN/zGM7Zl
TLSH
T1ED85F11AD29801D8D16E9236CB525A41F3377C6183E1D3CB92D0F93E0F7A6949DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 e2444b801aec97c9da39a80145076894ee0ec5e638e33a4bdadb93802727c98f
MD5 73a18e3c6bf79bdcc45b53dd949832ce
SHA1 6a4f7818171bc9900e59d57286142e39f849befe
SHA512 d3a7ae7a073d666ba20d0a832c7f5567be432d217a0fdd70b198f7e9da967c5443d40507890d72c808492604567056cbdf9fd8321449b435f561a4d849f245ed
SSDEEP 12288:+T2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:+TQr4kzQOXnKN/zGM7Zl
TLSH
T13A752353E34C8442F2BF8F32EB15D651533E6C41871988E3E0849E8D4C7F5EDE9AA61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 148bcd9bd5ba48f315508d62cc64a268280534af4dd27167cc9bb80cb2b6a764
MD5 555d8f61b2686bcb8c6e2eb6ff9c9c8a
SHA1 330dca2045f8631cbb2ee64df3c8b6b25db57285
SHA512 64479da2a0f4bc59249ba5ba524262fcf107a3bec065a69ecfcf2ab7a11092fd4b50c514fa72e867e6936471d029b67ef067b5cc167daf9804f50d03ff8548ee
SSDEEP 24576:k8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC1Qr4kzQOXnKN/zGM7Zl:NRZwQCyiHiQEaiPnMcQrHvMiMtl
TLSH
T19985BF1E63DC46A5E0BAD278CDA74407E6B278165731A7CF0190C27D1E27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 a34f454e6386559e5a7aacd90b5ad0879c6dbc24d6cf906ed902e14dc9080e13
MD5 f5b2d450c8670e65ae05865c42a11212
SHA1 cfb1e75e5ac5f15d27f2f1424de890087a879d72
SHA512 cf9df274f01f9fa3da59a242c1c43790fef94f352c036f647de610d9ba1cc0be3d648daf1695baeb4cc2b4ae42dd4c4983e5dcf99a809ea4f145a75657076278
SSDEEP 12288:dbxA1U7KD2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:dbxA1UGDQr4kzQOXnKN/zGM7Zl
TLSH
T1DA75126E669C04E1F1BAD53ADA918202D3327C12532597EF50D0C67E0E3BAE8DD36F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5ca9176320a92a3ea91975b6218e96e7db4b1de672f41425151efdbe66e0f62a
MD5 421e69ae3582b4c06200e1cef5de6db9
SHA1 4bfa79f4149a482137ad286b96aeef9bb546117f
SHA512 f94ae95d3a463c8ed137537b08552013721d5371c4be452dea3ef6fc12de65e37aaeb00a8b9fc19888e4808414cb472e30c165c6ed66c3b2490379509688edf2
SSDEEP 24576:OjsmP0yHaqrVqHra44KDzMsrnKQr4kzQOXnKN/zGM7Zl:OjRP0yHfVqzlAsrnKQrHvMiMtl
TLSH
T19645AF2EF2B910F9D4AAD136464107B5AB71782D1F209AC70170C635AF0AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 4ceff1243aefd675c14add7973588b6efd8319a0f6d1477c8c5d495d82669ffd
MD5 e6bc2f2166b6111379cd8770d94a1045
SHA1 2190c7cc2388f05fab4caa00b4c2cfc217fca817
SHA512 9a923f7461116a038765b45998c1cfee41b3a0c41546237993493e5e7454ad24e605f300c14655f43b19d384bee414e8881859cc385dc5010e8bfba839071d0b
SSDEEP 12288:cN2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:cNQr4kzQOXnKN/zGM7Zl
TLSH
T183752356B34C4082F29FCE33EB119A82523D5C41436E5AF3D094ED4E4CBF6EEE2AA515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 ee66736027b475a835fdc0cc830c1f1b96a780b47716f56eba0ebb2bd4957451
MD5 eaf11de2efdcce46f890f8dca89c9b25
SHA1 581f494fd88e4b6be9fe1962e8e20ae587372731
SHA512 d42c220535affd0a40aca2dd6e5170117eb17b3fa17e1a52b4ef91b90e4ea3aca5e3af2402a7405b7a9f875798ac9b81eb035819649302e138f576a8739bfc8e
SSDEEP 12288:SObZA4LWO+vAYFT/2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:DtLBUT/Qr4kzQOXnKN/zGM7Zl
TLSH
T1A995F155F79400F9E96BC13DCA628A12D272785D0364E7EF03A88F590E637E58E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 ac383ce153235e9b111acc2ab9a39efe262be299e0bb512b00e859b20e4f1fe0
MD5 ce67e83e935df5d3ff2747bb80580dce
SHA1 decee37beb041b7f13a7373e19104cd0ed2fca99
SHA512 2f63cef7f45eb537736d9a2e42627b5ef74a5b6d7e2569960653e20c10f822022e1c246d44522aa389fc1219a96d4853db642f647330525245c8c5896cf36b93
SSDEEP 12288:070Vm6IYNvUyBpo2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:BWYNHmQr4kzQOXnKN/zGM7Zl
TLSH
T13D85F12FA29C08E5E57B917ACA828645F2727852131596DF01F0C27E0E27EEDBD3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6695d0f57f0f44b01e6712e2b9dc6e68a83141183ae0b7f65543d87e4cc8f575
MD5 859d8bd8bb1edbb90eb83471625eadb8
SHA1 2a5d6fcd089483cfd305bb325e4e551e1f09fd1a
SHA512 a8d05a3dd298fda68f50117525381bf1a60deceffc78422f254632c40bb15c89a85d011539eb80e1c5a38e6485633a867bd27f8077a6d78966e90e367fc3e679
SSDEEP 24576:8nXoJjNYH84VVSNAApoEOS66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKV:8nXoJJYH84VVS6AmEvJas+cHBjSSKHPF
TLSH
T11665BF6EA2BC04D8D5BBD17DC5C24506F5B178621331CACF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0cc57fbfae0b16e6e1efed6ee31349767291329788a18ba6e9e7da463ae986bd
MD5 cf79af0679536704ce6796dcfe537e0d
SHA1 5570931dbbfb4d6bcbaf6daf46e32697a7cf9c64
SHA512 e3e179973756d9924e3db00686e70a5dc17245a4b638184b15d357e7d56e9a18ea96370ce633f641b07a4954dc8ed087cfc985fc4fb59363ea0ede043dbd2040
SSDEEP 24576:mv7Xbxd9Tuycf8M/TYlSuxrr2PCAQr4kzQOXnKN/zGM7Zl:mDLL9TuJ0M/TYj2PtQrHvMiMtl
TLSH
T183858D5EA3EC42D4E07BDABD85B79146FAB2B855173081CF0291856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 762c9f5fc1984fa3d9407899e2d17571a7b0c49b971aafca942e9ac3d4e9ee2b
MD5 ff062242c6d8fe83dfcc30ffbadc0122
SHA1 920776785dfd2851aa7bd6aad38b2e0e99c8f46a
SHA512 ad99cd01e4f6eab529f7074e279450912ad913ff911dffd7d5c60becb8f850b9b9fb4a3f12c44b6eeeadcd6cafb610bb5bb45b27995ba7851d0ec3febfedd101
SSDEEP 24576:YegJgpwJOmPOHWAKJ8ZguIGyPsxr5Vin10w/Qr4kzQOXnKN/zGM7Zl:YngOJOmPOHE/QrHvMiMtl
TLSH
T10755BF3FA7BC05D5E07EC17DCA928916F6B1782603255ACF0160827E5F1BEE46E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 127ab7545561b8e88b352e44d63d3ece6494412d8f3aebab69555804af91cc93
MD5 363590bde6bfc4113ec6322b3d520775
SHA1 e58d9bdaeda0dd309ce05146a2d5731f9bc8e9a1
SHA512 75e0ad316e1bbb90b2089ca733a063bcbc7f61b73f2ef15063b25a0ded0ce8db6ad46f3d70235586d7fff50e9157f3af57c75916778435b70813357b20c7ccff
SSDEEP 24576:XLJnJiTk3R3waE4JrOtQr4kzQOXnKN/zGM7Zl:XLJnJK8R304laQrHvMiMtl
TLSH
T17F95E13DD2A810E8D0B7C2B4825A1B56FF31346C2B2569CB59B4D5353F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a3e4451ab9adf01ef5cd6b2fa33750805e1e28e1b50f5db61687855f064694cf
MD5 426caa3aa7e0de821cfb3ba5f0c7b19d
SHA1 29153e3fccb6789e87ffcb1734cb3fdc08e8faec
SHA512 05c5fc5528bbcdbfdccd6d45db56e301baa31941f1aca5734c61a654661dc570f45369fe1e2b295dd058a7f192c766e68307d2aef39a54f33e96a8c34fd7ac50
SSDEEP 49152:c9mqCzDScAZmlvTcFg8Ph6BQrHvMiMtl:eGQj9Mtl
TLSH
T171955D05F7EB5198E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 988844d6bca924cdedc65d3c7a8b4ee7dde5eecf13b1df2991ee5d09298f8a65
MD5 81c5c50dc3f385dab97e1fd73f8cdc51
SHA1 da8634c928a913087f78d6141dd2f7cf9b553133
SHA512 4775c17742bf8aa6592303f37f63b8331e753010e9fc3b2708cd851ec7530807cc7f8c49bfcbb0ab79ce63c03618a79c7c1fc16a2d636df685ae3f35152c9fba
SSDEEP 12288:dlYJeXm5nkEUuEv2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:dlYJeXm5jUuEvQr4kzQOXnKN/zGM7Zl
TLSH
T19075125E779C20E1E26FC53ADA928A40D332B461131157FF81E0C57E4D7BAE9AE39E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.7MB
SHA256 a8ef9dde5b1ee107b40f6ebb86c7874ef8e3e91bf316d6729f1ded3a21d64d18
MD5 10425285ffa96938176a160616ae55d4
SHA1 d427baa9d6680adfbf50c83ed263dc480b883c25
SHA512 aabe00314d3032431952f2aa89039ed915586690937a717635f557d50d621ed441410db1ec3c29149a30c87ce64806a57f7d5c42e690c497d1a15142e526ea8e
SSDEEP 12288:wmu6kyq2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:w7tyqQr4kzQOXnKN/zGM7Zl
TLSH
T145851205738840D4E2BA4A35DF638281DB39BC109B2587EF90D0EA2F4D7B7D8E975B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 be1f987835c786fabbdee463f322728a8871141b201e0d2c6b24bbf691d5761b
MD5 8f9cdd607b96a1a9a408de7f7b0bdd7f
SHA1 34c77b765b1d9947ec523832729dfe1d010f3be5
SHA512 578b444ad9838800c18aa5ef7e307f6743390ad4bda46413b73b6ed658fad797cda88ca207e9cb960f4301a8af67bb169c9030b0c847fb7f8d80777917c17515
SSDEEP 12288:TP/2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:r/Qr4kzQOXnKN/zGM7Zl
TLSH
T1BD75236EA34C4085E25B8A32EB215BC2923D7C50531968FB90E4ED6D8CBF1EDE1A6D05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d2f0f7fa2d20695e96da0df0fd3578896229b2e591689606e0f2fb23064d505d
MD5 b6cb90483e782da7801586884b6d168b
SHA1 aaa7a37b1038e70dc6be9fa57294d16adc95b27d
SHA512 07fb1634111d0063249dff6880bf7445aacf567bae2c86ac0c499ec8c3e84ba02f1c472567b7d5dbc9576411df6f239fa362542c18be275adc208531317f21e3
SSDEEP 24576:mC+TyQIu93VAumZr7jmUQr4kzQOXnKN/zGM7Zl:m/TfIq+YUQrHvMiMtl
TLSH
T194558D1DA7E91DCAE276C675C9A34493E633B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 29f2581ddcde141edb9259408b21e5fb45cfdb2d60733f342d9deeba818bcd2e
MD5 da8de97fb1f20808d1579212b6a12d97
SHA1 d93fd3ab60cce354f3ea0b08edb9a9171f01b253
SHA512 2ecb7f0521236adf337797f7a6adf1dfbfa67df82683b7d92e17c02dd1d0e7ab7fca2702edd64c4a398908cd5c453764691442ef610a8f48f45926e90881b770
SSDEEP 12288:/cyrWOstaa3kcsr2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:GLQikZrQr4kzQOXnKN/zGM7Zl
TLSH
T13B85F00FB3AE00A5E1ABC238C9454242F6737471571267EF42A0CB7D4EAB5E9BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0419a51035ab51e0e8fbc5f307b00c777351052c77a49df81d5d8d59216d9a20
MD5 5c2e60d84780f60b36c4c12af5c300df
SHA1 61c2acaedd13c0ccc3511a98b2acdd5f8feb0243
SHA512 adb33612af593242867d8d6ad2d954e736512c46b0e97c7a71f0f4705458bfc2cc7b44deb46a824f204d0d672775dad04498c5ebb7300e54a05f7cc6d0e8c2dd
SSDEEP 49152:DpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPqQrHvMiMtl:YpC7b4+80GTkJQj9Mtl
TLSH
T1D3A57C3DE2B8006DD9AAC776C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e0578ef281a4f479fdb80e7cd9532de47e4ffae3bd0b0d9a1a0dfdc825eec290
MD5 a78c8d540c3d04db402bb64dda133d6b
SHA1 e53443ce7ac926f6466494e40d09d4f944ca6818
SHA512 9bbbca9c4c28851e7063248999b6de91b70c6a60f89f31783dc73dbc22948b7a58788c690f2c0bb51ed25f874b1d38673516e05d1a14cd984f2f323ad93f774d
SSDEEP 24576:OSAwJPE1IDAo+4Kt+l4413kUQCQr4kzQOXnKN/zGM7Zl:OqPCIo4Kol4WQCQrHvMiMtl
TLSH
T11555B02AA7F946E5E17ACB74D663C601FB727813133163CF8290853E0E169E89E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.9MB
SHA256 8b7443ebbb331728e6a0e44b8e5dbabcc667f000bd37289ded843de23432c231
MD5 2d814e7ff91799797739ae023e7f4371
SHA1 4335050b4e5e3ede7e132b45a6c05188ac677d7d
SHA512 19e93035d24ab6f7ca7bec8d8321988e42b36a16e93100b1e111ba676a17b466553cf0d53573f03d0a23689f052cfd5109c6314c4f87938f9e5d109a99d53ead
SSDEEP 12288:vSsyLCFBoPLCRyF6NQ4ty2pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:jyLXPLcq94tyQr4kzQOXnKN/zGM7Zl
TLSH
T10595E03EE76C04E5E47AC27CD6A38906F672389D033166CB15E095791F6BEF4A939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.7MB
SHA256 c7fc710bfddec14569b170734e7405f6a621c1d348bb51d97869e3dd85f35fde
MD5 36d6160b71a574f90b7e798cc6f69375
SHA1 cb37b9756ffdc9d972c5770e7581b418973f0daa
SHA512 39ee8e6515a4ece760469e213f5604b728b04de7718215ebdf4fab6eb13a56aab1c9ac965bd683648b8f78d8457840ae0df64b3a8995584a18386e9a053a6e75
SSDEEP 12288:b9lyvj3IkxjbBz72pr4kzQR9Dh5K1X1Wj3KDneVm2m42Y4KRfcpM7w6LR:bWv8qjp7Qr4kzQOXnKN/zGM7Zl
TLSH
T1FA85125E639810D4F17A8630EA2282528176BC7213689AFFB0D4D97E4E3A6D8D53FF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-472-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/392-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/392-312-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/392-275-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/392-291-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/392-259-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/392-265-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1316-177-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1316-186-0x0000000140000000-0x00000001402EB000-memory.dmp

Download

memory/1316-183-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1316-447-0x0000000140000000-0x00000001402EB000-memory.dmp

Download

memory/1368-123-0x0000000140000000-0x00000001402B3000-memory.dmp

Download

memory/1368-121-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1368-235-0x0000000140000000-0x00000001402B3000-memory.dmp

Download

memory/1368-115-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1704-473-0x0000000000C70000-0x0000000000D90000-memory.dmp

Download

memory/1704-471-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/1704-254-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1704-248-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1704-308-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/2004-152-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2004-391-0x0000000140000000-0x0000000140281000-memory.dmp

Download

memory/2004-160-0x0000000140000000-0x0000000140281000-memory.dmp

Download

memory/2004-158-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2488-244-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2488-311-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2488-238-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2564-33-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2564-32-0x0000000140000000-0x0000000140293000-memory.dmp

Download

memory/2564-24-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3032-126-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/3032-310-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/3244-83-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3244-80-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3244-85-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/3244-79-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/3244-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3260-201-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3260-212-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3260-210-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3260-207-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3380-224-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3380-214-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3380-469-0x00000000006F0000-0x0000000000810000-memory.dmp

Download

memory/3380-220-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3380-464-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3432-58-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3432-37-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3432-36-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3432-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3432-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3628-171-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3628-55-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3628-47-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3628-53-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4188-20-0x0000000140000000-0x0000000140293000-memory.dmp

Download

memory/4188-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4188-11-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4188-114-0x0000000140000000-0x0000000140293000-memory.dmp

Download

memory/4396-169-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4396-430-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4396-172-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4656-190-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4656-462-0x0000000140000000-0x00000001402CC000-memory.dmp

Download

memory/4656-196-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4656-198-0x0000000140000000-0x00000001402CC000-memory.dmp

Download

memory/4940-129-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4940-135-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4940-463-0x0000000000CC0000-0x0000000000DE0000-memory.dmp

Download

memory/4940-137-0x0000000140000000-0x000000014027F000-memory.dmp

Download

memory/4940-321-0x0000000140000000-0x000000014027F000-memory.dmp

Download

memory/4984-78-0x0000000000400000-0x000000000090E000-memory.dmp

Download

memory/4984-5-0x0000000002770000-0x00000000027D7000-memory.dmp

Download

memory/4984-7-0x0000000000400000-0x000000000090E000-memory.dmp

Download

memory/4984-0-0x0000000002770000-0x00000000027D7000-memory.dmp

Download

memory/5540-233-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5540-465-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5540-470-0x0000000000CE0000-0x0000000000E00000-memory.dmp

Download

memory/5540-227-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5540-307-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5616-483-0x000002D0656D0000-0x000002D0656E0000-memory.dmp

Download

memory/5616-480-0x000002D0656D0000-0x000002D0656E0000-memory.dmp

Download

memory/5616-488-0x000002D0656D0000-0x000002D0656E0000-memory.dmp

Download

memory/5616-487-0x000002D0656D0000-0x000002D0656E0000-memory.dmp

Download

memory/5616-489-0x000002D0656D0000-0x000002D0656E0000-memory.dmp

Download

memory/5616-484-0x000002D0656D0000-0x000002D0656E0000-memory.dmp

Download

memory/5616-485-0x000002D0656D0000-0x000002D0656E0000-memory.dmp

Download

memory/5616-482-0x000002D0656D0000-0x000002D0656E0000-memory.dmp

Download

memory/5616-481-0x000002D0656D0000-0x000002D0656E0000-memory.dmp

Download

memory/5616-486-0x000002D0656D0000-0x000002D0656E0000-memory.dmp

Download

memory/5616-490-0x000002D0656D0000-0x000002D0656E0000-memory.dmp

Download

memory/5868-147-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5868-140-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5868-350-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5868-142-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5868-468-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5868-466-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5920-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5920-67-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5920-61-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5920-185-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5924-225-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/5924-103-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5924-111-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/5924-109-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5928-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5928-223-0x0000000140000000-0x00000001402A3000-memory.dmp

Download

memory/5928-96-0x0000000140000000-0x00000001402A3000-memory.dmp

Download

memory/5928-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download