f34ed3572fa8953cc9d3240d8a112f4729b3739c3c35e7968586f5b3bbe5c1e0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
Size 10.1MB
Sample260509-tybb2ady7l
SHA256 f34ed3572fa8953cc9d3240d8a112f4729b3739c3c35e7968586f5b3bbe5c1e0
MD5 deaa6adb27d3ccc08d745104704fbedd
SHA1 f274e6dc7e954767bb4976c352b39545435b6ab1
SHA512 c3f1b891832b86e222612e98259d8c32f3951b9ddedb9eb4bc7ea81fd0b8bad00e977a3476367c8b7a9144886677fad4a2b6f260c2cbf557435f0cb6334e24ca
SSDEEP 196608:rsSXgw0Mi1jSGuqwbwYy3LQj+RIR26SyyU8RVQBWG:rZwwJ4awdMj+RyyaB
TLSH
T14DB69E11B652C526D56202715E7DBBBF546CAB740B3450C7B2DC2E2E2FB09D22A32F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4152	alg.exe
2352	DiagnosticsHub.StandardCollector.Service.exe
3304	fxssvc.exe
5748	elevation_service.exe
1668	elevation_service.exe
3324	maintenanceservice.exe
2900	msdtc.exe
3872	OSE.EXE
5076	PerceptionSimulationService.exe
1160	perfhost.exe
1064	locator.exe
3012	SensorDataService.exe
4912	snmptrap.exe
4972	spectrum.exe
4792	ssh-agent.exe
5532	TieringEngineService.exe
1504	AgentService.exe
4072	vds.exe
3104	vssvc.exe
3748	wbengine.exe
1296	WmiApSrv.exe
6064	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f5328e0f958e99e9.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83296\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e1de8c7d0dfdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6b723c8d0dfdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055a6f1c7d0dfdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f745d0c7d0dfdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006afa83c7d0dfdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f23660c7d0dfdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031a9d2c7d0dfdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002751dc7d0dfdc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
Token: SeAuditPrivilege	3304	fxssvc.exe
Token: SeRestorePrivilege	5532	TieringEngineService.exe
Token: SeManageVolumePrivilege	5532	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1504	AgentService.exe
Token: SeBackupPrivilege	3104	vssvc.exe
Token: SeRestorePrivilege	3104	vssvc.exe
Token: SeAuditPrivilege	3104	vssvc.exe
Token: SeBackupPrivilege	3748	wbengine.exe
Token: SeRestorePrivilege	3748	wbengine.exe
Token: SeSecurityPrivilege	3748	wbengine.exe
Token: 33	6064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
Token: SeDebugPrivilege	3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
Token: SeDebugPrivilege	3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
Token: SeDebugPrivilege	3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
Token: SeDebugPrivilege	3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
Token: SeDebugPrivilege	3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
Token: SeDebugPrivilege	4152	alg.exe
Token: SeDebugPrivilege	4152	alg.exe
Token: SeDebugPrivilege	4152	alg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
3212	2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 3020	6064	SearchIndexer.exe	113
PID 6064 wrote to memory of 3744	6064	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3212

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5468

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1668

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3324

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3872

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1160

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1064

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3012

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4912

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4972

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4724

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5532

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4072

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3020
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0892d9bd44feb41c0eb527f19d0a16a3abc609731a3af91fd6d7ad6efbd6a0f2
MD5 a90aeee99584fc1c25fbcd7062ca0650
SHA1 963662163611264a8b4e5e968c72111b468eb6cb
SHA512 f4dcdbaf00ab558417b8a8384bbed7a42cb6309855f795638a0e57cf5224e52a037cc1ccfad262f07f1f9933f4b7ab940918f47166269ba2b1ceeb4887cc9980
SSDEEP 49152:yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnnDmg27RnWGj:U3q6sjBgD527BWG
TLSH
T1F0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e7ceefa9d68e6322f75977a2714c24a94036110f5839f4302b83f4564c8ac27d
MD5 3e41a9c7b70c3ecffa8560571d0554b8
SHA1 eaacc8ec95042062e932c4727d00d26ce3ebb34f
SHA512 2da8e41caaeeb964ea7c6d2b8b247ece226c80f32b86679af3bd87d4d5cdf154c663f26d79ea59280e0ee72c42b426c096fefee3873c66ce0d575e87a25bd2b4
SSDEEP 24576:rXYfDtczAAsqjnhMgeiCl7G0nehbGZpbD:utc1Dmg27RnWGj
TLSH
T1B7650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 65b479ccc72fa72c6e26ff2af27c8570b4c38d0b3d428ea110cc95a3594d9705
MD5 8341495fa9381c01a626b9dfd94289a6
SHA1 f841f9373199ca6017e40b4d90f1897ca7367455
SHA512 bc1d830ab419a5736437215cb3263033fc38fccc42dbf6ed29cd82cdbcc11e03868a2ab3a58adf8228d54edafd1011d7f09175873ce0649250b330f8f3e63a85
SSDEEP 24576:L0Le5ji0hmxxrMrsqjnhMgeiCl7G0nehbGZpbD:LPji0AjGDmg27RnWGj
TLSH
T11C859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0c0d703c21b8028f89d7b478c5f9aee8792afefe07727f098044394465f02a67
MD5 7d0c5db395fd3b4ad5b9a1afbc7df928
SHA1 59b1fa7b6699798b6f81d862502ba6fd01f7f447
SHA512 c7e23048d3ee295b005c422c039bad5dd74d8390f64d4d58649511cde5548e91fbddbd418409c44b45f618a7aef0105b9fc3bd7149df912fd986a0af75e02fad
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWn6q8wyuRsqjnhMgeiCl7G0nehbGZpbD:y/ezSC6vUzPveHjyiDmg27RnWGj
TLSH
T199755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bfee986672f8264746813918205f37c77b22a60ba7bc165743e414d3ca2fd6d8
MD5 783bdf97050661007c0427326d3b03a3
SHA1 520fe238b0d98dbb85869eca6efc478b57aba744
SHA512 1d65f19a329a374e78d05a8dc9f5a7af0a1a31f8406dd8a7ad7aec5227ad5031fd67e0dc0ef1692d165575945ad1dc732b9f13304947e34bb0737197b53a4eac
SSDEEP 24576:zVbqPb88hv/l+Y0sqjnhMgeiCl7G0nehbGZpbD:zVO88hXl+tDmg27RnWGj
TLSH
T18F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5fa511d9599f73184f2da830689945c84505c51cce663cdd2269e5fd6c2d785f
MD5 ea4eb813fbe76c9959572a83f76a4a9e
SHA1 271b88129a43b51de922bc04985975b91a5e6650
SHA512 9c7a85c4751841ebfeebdc03c8cfd2bc1075417b35179793715e66b4288b6174e4500fa6ba17220989c7a835070a9f9e55073ca6930f1ef11028d44ab88deaf2
SSDEEP 12288:GLvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GLvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB4523BF865C50CAEB7608B5C3E9F11EAC177E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9305fa6d5d47b8e145305132612cb2e0e5db7dcb9d0d095af2b730f09e2c0566
MD5 2ccf977c687b5bcd6cfd0cd7ea0b9622
SHA1 7dfe3968c87e0d19ff6a78f2c6bad927e48a6cc1
SHA512 9221118dc2641dac1446a2fa730b2b8415f770f87b7c435c0ab1b67ae9ccbf3610b4d24a90d7381c405b82f2e5153e5b4a76b61f3f12f3b69abce07e5feac95a
SSDEEP 12288:VeBNUbTVO86U8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:VJIU8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14265CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 569cd95a9b0c3c5567626d3964e7dad9834fb8f2b6c63bf9ee45cb4de4cccbfa
MD5 91563c1f665656c393df3a58222cede0
SHA1 97a024426a79fa49b9535058eb9ad5928388178a
SHA512 78a63406d291659eae81b56e1cf0943fe93a44ac721aa267c1ba17f3eb1bdde3660e0b56a845023588d42beb6bd0d84f42fe7130f7404dc6d1e3f0aa54add207
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THT:BQvGAdlCEL8c/DRNw5CVD527BWG
TLSH
T1D5266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 472150a316db83842fb7fe0bbf3c58e9ca6b9731308f9816c19e992aed0666ae
MD5 41b0f740879ef9789d82ad4e40c1c7b4
SHA1 85bf93bcaf237cc57babbfadf82b1e6e0107d951
SHA512 5c985f718136ca594c26339006a9dd673e85f1a89b7a8535db4ef5d3a56b1874d6d68dd55c491e0871d948a369f1114fe9030862a9be9509e9dd23d303ebdb66
SSDEEP 12288:WAwSfxL/2Dc3RDLLmt0LDQewsAjyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:r0ewsAjysqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d1cd09978e075150536479d65a7f7f55f7856bd22fef41238c10c7a1606f2698
MD5 fdc336f5837ffc13016536ad88f488ac
SHA1 5ad65b5ceaa0a8baa10a3c54f8af88ad19281286
SHA512 56167a5d7d8da3c394f67813a4288ef1da4f6cecd81c7c17044a63f6dae48c1b2ccb6e0ef6689df81d13ec9285fcc0ebaa977d427e4dab160254284ea1537821
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHeVQBWG:YUEtQevvqc2W1cpV2tI32RB
TLSH
T152474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8f85f82ea8ab491680b910c7fdcccc43ddb571221dcd617ac848499d6452baa3
MD5 15edaecaf5721a4d34d9ce92b2cdb8db
SHA1 a55de5e08dea39396a84be35584d9c3cd1f4a174
SHA512 679839afc292ac4315f5ad2a5be8a93b08b177a97c8ac58037f9c04a17969f9b89ae5f81ddb5f2e81ff907db7b0034aa1bf72f80dd6c024d6d6333555661bda5
SSDEEP 49152:rCbRquA/m2yL5zTfFiV+XenmE3/zWDmg27RnWGj:0oquVjnmBD527BWG
TLSH
T190D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7e994fa80daa3061fb79a7769aa35ffa99e1779a245c5cc167c927501d62e217
MD5 421fccf9f81b4d1b2741c5ac269b487b
SHA1 08aa659d2bbb32d2aab8375bbb8180834a25298a
SHA512 74065a732e50d242b51c1d3c8c32dbbe3d25981482a59ba0aebff7e1e95e79cc3eaff8be050b97bfe3c8c27d5258066ce1c2bcf3013939751106a403ff9edd85
SSDEEP 24576:lAhGL3IFoiwtA5l7S539sqjnhMgeiCl7G0nehbGZpbD:lAMUFoiq5xDmg27RnWGj
TLSH
T19B359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 07f3799143339445bb26941847905041930f5696430f98b6b6011cd62b6fa5ad
MD5 e4459175160b99d2c47b38a1afd442e1
SHA1 68cf555f2dd0f7e6fa0e33f8be7cf6c7bd46a5df
SHA512 711224e1d4575fb8666e9c3428044d80e827b995517e969efdeb819cf35b0963ec80a2acbc4c3e168e6c7f49b005c95a78ad77acf26c9e13e2eef357a62137d1
SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+CxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:qwu4OWusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B265F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 05775ced0b389d3a60da417186379cf12b0551e3dcccf6b053afcd3c307b8afb
MD5 7fe93d0e883a39f36e3efa154f48d320
SHA1 1d2891d5415fae40d920771a20df0fad1f9674f1
SHA512 8aa315437dc9c70c160de88adf05732f9e4d11b54d1838e6585b275c62cd4cc342745e9e9b5dc7e7e8a9d83ea5fa06c7c609f44032a7a52a3bfff427d25daf06
SSDEEP 12288:ceZ1IyiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FZuTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A5512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a0c54eae7f66682d38d16db7d239cdc2ad379140493c3512f24e66066ff31972
MD5 131a257c505d0b12e72eb502dddd09fe
SHA1 4e40a9b0f0940288f9defc04e6a080b83adb3eab
SHA512 7b9352fe8e53bf681d2a4c1da25bd31247f8cc7844723af546dc133551d339b598b0c3e6319688c2fb26afa69c20b55728cdc49b7ab96b69162aea2aa7807418
SSDEEP 98304:LQRQyi36YOcPbLvw2gAf+PN3UD527BWG:6QyiKa/X+PNkVQBWG
TLSH
T1DB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 10f0901c12e3bd6ac6e21f657422841020dd32b8a8f6f986190ee425f5c98365
MD5 0f3243242a13d75c864e3eecec2722ca
SHA1 d7cdec74a08b740b3e3e481d9f11dfe54210bb33
SHA512 9d38eb2a80b93403748def8f87ddc6d36644f77a621644f0a3e3e0a2b6c7e9231ecd69072f167f74f98c8dee055a5ef8fc98bbc9957dbe13639c32e344b9e095
SSDEEP 98304:yQRQyi36YOcPbLvw2gAf+PN3UD527BWG:pQyiKa/X+PNkVQBWG
TLSH
T1E0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 12db1dc4d7ab52bd11da62d0ff0da2efd69dd3fd7d0114fddb990cec83f4089c
MD5 2ab81161acd852dad9254c319f9386c9
SHA1 0784a13a3c2abd8f925c80e23c4af3d2c595939f
SHA512 13cdcc6f00824f7fac67385bd89cf82a440bd7f11ced2d36251c15ff6e8f484f5aab896be02d3ea43d63ee5ea1e8304c7599dcefd1e22274750e57952a4f50aa
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0jsqjnhMgeiCl7Ge:268Qg55nhceWu7PNU3/GDmg27RnWGj
TLSH
T180B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ee0343cfb59e794a2a20e5caab03265bad3a3328fe018f45384f6d3a8b36c1e8
MD5 c8d27b07fe91228fecfd037cd67bed3b
SHA1 a6bf322402a6bf8cad297cf6e80d2f10438fb27e
SHA512 6ff085b9c5f567b74fa37e73a7d43b501aa5517cf189209cc9cf7d1fd6c93d969df2abf70eade06305a0dac5a2eac32d1f1d71d7d20f0d28d8bdb090e934de3a
SSDEEP 98304:Zy5112gYy5azzVvt69nLKnhZTD527BWG:0LIHEWhpVQBWG
TLSH
T13C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 64f06139608f2b2d2d58616a20f48cb94d7ccca96a4eb50283ac005e102a35cd
MD5 92e03fb8c1cdd691513e82e64eb431fc
SHA1 5e667dc9ec4211eb57e37b855b288914e506d342
SHA512 6962ad82efab6b9de722b3c30a1c2bd3e721d2fc38e7c7affdb533f3d398cdb7ee4819e0875fc90f2fe80637de661f30ab1c527e085c0ef2ca772ca978d62688
SSDEEP 49152:OB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glMDmg27RnWGj:cu6Jmdxd2dMD527BWG
TLSH
T1FDD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 161497ee0a7aff90f53cf483e6f5a87e361e8a22353172855dc1fb2edb132a95
MD5 3fb1adf6cc86d05eaedfc25b0154c3b0
SHA1 d69d78fa90ab2afad299416ce488e7c6efefa71a
SHA512 03779fbb6a43dc5a6e56650f50c630c068abb609c8757544638481638601c3f06fdfd4494248087160fa7a8b45c0ac01f2b65dc97e06049de93f64d87eeb636c
SSDEEP 49152:v1hpsNoJpF1A63U44CwH7R4xIDmg27RnWGj:vmifPWRBD527BWG
TLSH
T1FFB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e731afdd1b6856a230b151720dab40d3dcb37827cf80cad54bef0c681885a5f8
MD5 d52a5881863407e522b31e12023feddb
SHA1 c6a75882db33aa499f0f6fb6eb932ba67f319b2f
SHA512 f7babb7da8993eb30ead783da5597d81ba1425fa0653b4bb3e5828aa568d5563a3bfbb3fa838231e11b3c349cdfc0c1cd5f05c6d432b3b416072472158093963
SSDEEP 49152:ISuZQIY0Be2KcRVtOnks6NMHqXDmg27RnWGj:S5dKii61XD527BWG
TLSH
T1E8C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ff4023d280962f3c9527e054df578612d9fa9f7e14181e6ab47534a072697432
MD5 4a088cd2693d78fce623183ab6275eeb
SHA1 2ae585a41cdad3f51ee67c6bceb3f972f32df030
SHA512 a0aba6a01bdbafaa58fccef093ed4f38ad23530a9df2ee2b870efcca5dc61ff53c9c591a1f8dd30eea4482d783fc7259cd654435619f43ba3e4e5d052e144d61
SSDEEP 49152:YhtSn8EApI0fig3giDn0AP5w8Dmg27RnWGj:JX2imphdD527BWG
TLSH
T14D95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ec0bbf486f9bcaa45e4d1091aa146d63ddfc6137a754a478ec0864dfcab21431
MD5 6173edaaf2631a96e4cc729d50189604
SHA1 15e92ab137c3f1a5478070fbeffe08e6136a9819
SHA512 dfd00dbc588c06548a8bdea7969269459d5385b3439f73bf53ce5f37b116be6c10d493fab5f40abf108e0fa286dac5991dc0d15676fa086f5a0f579303678546
SSDEEP 12288:A3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1694523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a297da4f5045016adfb78bde73b7972f5011720b2045feb242783fea72531275
MD5 f825dd8650ac9df9f89ef30990af7920
SHA1 581bf5088dea999ebebc3d38e1fcb63f18f3c202
SHA512 83d0f92bc5bd2708fa2297969c9105dd984a728f892f894ba31841a235df9a74fc4bc368c726fbd492a3a61e48334dcc6694ebbf3dbb80db2a50146184769201
SSDEEP 12288:QmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1774523BF965C41CBE52644B5C3E5F10DAC073E5BA92004937AA77CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5fd24232858ea5053fd2c8bb443a2b2e005c7a29f73dcdfc0193037124a1d8a9
MD5 082e0d7fca85a97999ea0b0f588f0668
SHA1 bcc89c800253cfc952623bc24f7b7ac1d8d9a812
SHA512 3db5fbec51fbeaaa8a44eb8b9529d81216f1e42001716233b699081b450f9e1d189ed22da0b8a20b0639a090dc4b808ccdece68cf2bd4af30b709717fbcccdd0
SSDEEP 12288:sEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A64523BE965C41CBE52648B5C3E5F10DAC073E5BE9200483BA977CBDFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9e0f3565000eda9ffefc49cc54a5b00ac4feee2cda96319e5444e92016a74cb5
MD5 7f0ced8fb54268ae438de0849135bbb5
SHA1 baa677d113f138802df6c14dbada82b849c48cd7
SHA512 097e8468b24125d395e941cbd8310fa20bdeeba2008ab158cb80cc795b0775da5dfa0b259bf414c66341c3980455af4b358c0e581157613e271365fcb111a0d2
SSDEEP 12288:SVdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15845236B675C00C6D83285B4C2F5E11DE8277D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b2a476770c0d7d0f4c47a0beb4fc2fb5c311257b734b187dd942282c1f90131e
MD5 274a55dc83bf8d8ceea718afb38f8c2f
SHA1 7b8cd023586fa10f2543a19697dce4ed689dc42c
SHA512 6056292d8a188aaf32c6676b60c8980588946114066c3a7762a33872abd3ad25b9e823a45241167b0cdd9725cec9e4cd86686c598e4c2ba107bd7dc9455b6531
SSDEEP 12288:cVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F4523BF965C41CBE52648B5C3E6F14DAC073E5BE92004837A9B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 720cc547695bbf5e872e235c4cbfc175d44c342d52b38f2255e7d80181d05615
MD5 7ce2f45bcf0fe36c48643fa80193f06a
SHA1 14c1c4ac8a19d03c21efe8195256db4214d04677
SHA512 09e9a7e103b6b7f646b96951b218f7f5501b599f662855135398e8dcba9c6d928faec7e0a88e97ce71342f3b8163d2f50cd5caa6be66204bdceeed3648066afe
SSDEEP 12288:76Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:76sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BE965C41CBE52644B5C3E5F10DAC073E5BE92004937AA77CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5913d146847c198bede16af5d605de47f9a7af7c0660bec8936a539d3d7be0e9
MD5 20d7222697a4f0d5bab3cf0ecbe14ed6
SHA1 f1f256a066618761a6f8564db7bc87d94771f9a6
SHA512 5d82934223d6916d90aa48af9450a9c2b4b49144cb86d957449568e65ec6f2b57a9a6d194debbaafb7e9601ef7ad446e71364b0721f037c1a6f6022c7e1e2ccd
SSDEEP 12288:W+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:W+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF4523BE965C41CBE52644B5C3E5F11DAC073E6BE92004837A67BCB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a5a22c52b65dcff9c636c8a2c4f38b32838b9a9185087a5da5e51058f8f3d70c
MD5 6a13bb3f8678f4ec72f4cf4d1f96a91c
SHA1 1651ed524e55a6dbecfa3df84a713bb800c895e9
SHA512 a49e69dc10622a8c607089eca3edd9dcbcacfb979268c54ce449ac40456c5e314130b9a4d23751cc23aab2944e18f0cd6b222313729ab2fc7fa7f6b2da36a5de
SSDEEP 24576:xZMRzFVSOGsqjnhMgeiCl7G0nehbGZpbD:xZMRzf+Dmg27RnWGj
TLSH
T14F6501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 95800fb4f6af0a8eab4d36353dba8ffd294acc2c52c59026e6ebbcc94e25cade
MD5 a158a6ad8304c616bd32ed2d9d31048e
SHA1 76909f5c362aaa943f449d471e863bdb6aaf4df9
SHA512 7dafab025547029e11a71cabeab5eea7854daf6413ef3a4bfe5026b63667299ce745c698f6f33bfb8111593ea28161f6a82e7e1786ec7bc740b902ad230669f0
SSDEEP 12288:gDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C74523BF965C41CAE52608B5C3E5F15DAC073E5BA9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0b1e6e8d7d7bb528b553e4b8a32ad5956b62452b71cb317b0820812d2fc506ef
MD5 6518c4a4aed9476dc08aab0d5a261447
SHA1 40239801fc25cb8a0724329ae64ad0685211f2b4
SHA512 451048087ee83e514c4227632d9b44d08b06510f38a403cd2c19f0c1d78b18cc5a8447b597dfd7ee80b9ccdc860cce7ab3ddba701140b07900afee24bda8bbf6
SSDEEP 12288:zfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BF965C41CAE52644B5C3E5F11DAC073E6BE92004837A6B7CB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 76c38952e4cbd5c0a7db1698f3c46b261760ed7433e0ea44d883c0b216788029
MD5 e78c439e20ff545d66fbdd9a73648c89
SHA1 125b9d9bb704304258f4ab1b031b2d1e414b1d06
SHA512 b67bcd5e56aedbe326776bd040c7ec43909c56c13579dd674eb1785432deffa2d00a9e900471995a5c3f8e1f2905f34aac0d55da7460738ac20b42bf21b05288
SSDEEP 12288:2yPz5L8iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LzyisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d10e41bad952378dedbcb4ff5aad8e116f6f209f08493fdc8be30e02c94104e9
MD5 fa97042eab2faebba49c14ae5309e757
SHA1 545c9524fd06f13c8e087737ff7c3eb23cdcdf8f
SHA512 2a4824264de75b49383e167313e315ace1c1423a91db627ed7dc739f2533537341d88f94dfa4b021cab1243319c77cde88b5ebf13f3fa7bcdff9d9380638b048
SSDEEP 12288:eDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 aaddf98c157c03d1b5b6e5a04ac169de099b1dc059e85721fd0ac8ccead46ccc
MD5 8b090b903331f8c9e7dc78dab54db3b6
SHA1 7f04cf7e75d0ee054451c99b9064dad99e2827f1
SHA512 c9767008dcc8506d4550f30ba3b83ce23a4b4798f3468d1899c37b04f41eba8e8736bb35db32b89d09ea2ec63c785e6970a9e622f4bb1566612d5349064c7b23
SSDEEP 12288:8DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 08207504d1cec8492eb2910449391daf8c2be4f3349058504aa66d1a118a5905
MD5 28c9ca08a8bc7d2d1d2d1f9b53910f50
SHA1 aa9d9c0365c43d3a9ae845f3af50769421b1b0f1
SHA512 420afd33616d98ea131cf7d83f163008f19c7937bf7efec038b2c4fb41b0239c93109bf363de74a350d1a3ec327d26b7d0d5cf5a0ba9b1dd0c28313185b0e62c
SSDEEP 12288:5yPz5L8iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4zyisqjnhMgeiCl7G0nehbGZpbD
TLSH
T13555125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b9e510591e5ca3b2541ff8d2e8ada1e4e280cd7f9e7b8df3283e40d1570caec7
MD5 6df68e3dddf54e04460516fdf1d00670
SHA1 5c0281b002a356e1cea2f42b41391bb75ca19eea
SHA512 fc74a147685aafab7a723a9884ab7f28c0e9dcf0f4e9940445ebc5ae7ac8798387aba488493223bbb4d8befff67c29b7abf4564bf8dca5cc634ae026075fe85d
SSDEEP 24576:YcP4mcvIjkGOxhKP2l71SNKbrh/8KB7sqjnhMgeiCl7G0nehbGZpbD:jP4m4IpOO67N8KVDmg27RnWGj
TLSH
T14665BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0d6a85e70cc2fbf42644d9a61557ae1105d86d2a2f5f0d047d2ad28d4e83e6c6
MD5 cba272f3ba507f419fe4c98da9cc5ead
SHA1 a44f536170e74ac7d91aee083d540daf397018a0
SHA512 ddb178121e0d0e1d2009b8bb6dae9194d999ce5e4b7dd2cee6051e36871f0f57c1d662765b44ae3a9638822833b5355e7f74d40f145a92b04a757bf593f34063
SSDEEP 12288:HbsfTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13E55015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b48874c5f77fdc2d497eb5bff18f3bad5664cd97597e6de18940fb48fa9cb50a
MD5 49c5e64d4323880d1b05cc1e65167c63
SHA1 c8c2885b9f4b59b456fccb0b4380fe15ac82d83f
SHA512 156144505164b93c36ac0554c86407d260e3bb2a6b865bafea76f26d7fdd5833a07cf95f663b791419d2dca05fedfef65f8538c30e4247c8e6db56fa37b479e0
SSDEEP 12288:+zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F145237FD34C518BE57659B082E9E12D781B3E669E204483BA437CFDB6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d76d72881479670cbf935e330caa173c30f8b696f6782dd3273e5777c431cc42
MD5 18979934f472f67101f79ced0767955a
SHA1 1712ad9f568faa3c9db41c337aca14ddb0dfc96e
SHA512 74d553a56f1ce6b5b028e04e08fbfcc3797b6d5674422e813d9512c7699ad4574374734a9509185e1f96be7456a4ea9808a1cc79ac26e5f9c270552ee79b5ba1
SSDEEP 49152:Wa0h2GEkuAe73q3pp46zwwQJDmg27RnWGj:Wa0hNYG4JweD527BWG
TLSH
T15F85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 30697974a42b09d80441e4649aedf08b84c252f91a4bb526c3599923ce5e68c3
MD5 3282daceda365c65234f2f5913dc30a6
SHA1 c55cfde38cea4311c824628af7a9e13140143032
SHA512 e6b0a003d9c46b3f7bf3e33ed066d5e36b450cca777b2d576876ab3c4c725dae91ef16e6da79cc654161b56b4baddf60547dbd9735ed5ef21149ef5bc68a92f5
SSDEEP 12288:rhbHjfX2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rhbHjP2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D55127E12AC20C9E57291BD8296D10AD632BC261B2053EF27D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1db47e999182a284dafef18e1722b16b2a499ba84ac6ff1add39b405960957a8
MD5 359032caea664c12cfe0a141aec9964e
SHA1 7836e94bb2d9e741b639f969f2f8ddacee91dd37
SHA512 0c9d25cb9c85b72f8a922d08de8bc823258443d46aca046d0c4f15c7284a3aaa670f0e49acfcc0295a7c9d14f7ccf9391dba2a7d98a920c8ab3557674404fbd9
SSDEEP 24576:S3YgnJcRTk4yti+R5dpR/usqjnhMgeiCl7G0nehbGZpbD:SIgnaTk46ppR/CDmg27RnWGj
TLSH
T14B45BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 6581bb8ce4e1c8b948ed300695393f5dd93100ac1760563baedb154c930b61d6
MD5 000cdcae9e0e0cd6480d519075fa5b43
SHA1 06c31872f27e48bd8a049dd5728c27e3aa9e2160
SHA512 594da3c1d11b255763603a1ec60c18ae8a8b68d936a0e1830c3940fcaaaaa927f42312b2b7b342dce6fcdb3de472d318b56d26c72bee5d26defddc8a21f2a1b8
SSDEEP 12288:ePXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ePsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B4523BE924C51CAD93649F5C3E6E11DA8073E56AB2004D379A77CBDE7B18E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 5b354e5e1fef352be14f11412f57093c51e976c31ec332a93f2318ae669bd72c
MD5 0b54a412d720e9e3fc6d39c347b1767c
SHA1 4c07d8397eb0293dd8c0dd455d56f6081aa5569e
SHA512 8f51f2b654571236bcb2343bfe8293c62ab5b30f80d453fc21e36c4df03b0fff5f201260edb674067683e226019288979bea8136a7855f86e8d66c02470ccda7
SSDEEP 12288:5ObfA4LWOsvAYFTAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:ubL3UTAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T104750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 951eb27de55bce256d2ddd9c331873f376aaf3dd59a927b455b3290b65e75723
MD5 7c9a1cc6d300025cad91e6926876227a
SHA1 b070cedbe679853ff5dac5ee58ba36de21137d5d
SHA512 3eb990d0f026bc4a7a574486ab20f35ed8ef8aabf9c8df67b4767d7efea96dec4a4c37a54ee5cafd665b57c6ff25ec95713e95a5040866cf1cd725a4dc033d91
SSDEEP 12288:FpFtIOcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UOcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11655022E33EC10E9E536917C8692D20DD6327C660B2117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 497dcfd387c28de0f42d4c5777707ef2b97cdf5fa014c1718efd6eddbee4753d
MD5 c810d9c499346725e02c85d79e63d6e8
SHA1 5719dfcb4a6670fed937e943ee68525a9499859d
SHA512 f6c792e516f593953a48ddda80e9c9d9a70799eaa0e4c019a50eca8f2fa8d4f99abdaa8c9e840d7ea5cb4b4a61eb723c0b19c09ae6ce303e3a451b5ed5edd45a
SSDEEP 24576:q7NM9YmZqmWMUkPjZM48Mv6bEhsDsqjnhMgeiCl7G0nehbGZpbD:q7cBWMpPjN8DbEhaDmg27RnWGj
TLSH
T18F659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 7a8ac1d5d9df7a19c1ee3984e18fe05e8902c0c2dc3e43231ac4d75c3f71c618
MD5 2c258b93750aa534c96bb0e921b62ca3
SHA1 cbeeee75e5d23e772250d8dd0397c15f00958813
SHA512 ecad0cca1311b6ba776e0fbbec92aac80799e06497197f3532b01c33cf3bb756d6f111cca33b3b3b21990943a43926177cc194c78dc701364ebd23dd6bb91e33
SSDEEP 24576:+W6BApg2YuyuNDYTabvcRvNYf8km1psqjnhMgeiCl7G0nehbGZpbD:+F2YuHNETovcvNYf8kmnDmg27RnWGj
TLSH
T1DE857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c966a87f1af0a48be3a2168e7dec8e491eed0cb31eb2b6a9e5bda960cf7eb8ea
MD5 a28600b3b8f399d948a3af161791cda7
SHA1 66d4425f3fbd1b610d30eb3232f443dac9b01af6
SHA512 368f64d3640b42c731501c12c5f379c8b57f451dfcc31abd1c2e597bd91c11f15703f9dbacb9371a5ca67d21923d989cd52bde329571c5ee10eedb52e6f405e2
SSDEEP 24576:sAFs06+OmlfkNXEbToIsqjnhMgeiCl7G0nehbGZpbD:BFs060lwXupDmg27RnWGj
TLSH
T1D365AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 2125353a6b3f72cb2251ab64d038651bb06054495fdc562b7a289ae5259ff796
MD5 68e813431c24f558fa50f9dc95134b0a
SHA1 8b01d603d7abb340ddb7a51031010e6a96c2e88a
SHA512 7e5f60c80b563b7eccfd3f218a5552c292e3902c38da9f6edcf7e57ea67c0a9fdbec6d173ee5772701cf6ea71b3104041710f3822eda2a248d02934b042d9fac
SSDEEP 24576:NJnJ5D3Wt1sqjnhMgeiCl7G0nehbGZpbD:NJnJ5DGtpDmg27RnWGj
TLSH
T19775E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 71048b30278ef9f62cb97e389ca5ae3cba4fb6affe63149101247b59b5d9fe29
MD5 8dded8108e5e65b838ab329edcd99da3
SHA1 9e4f68383034197c8b6d7e640ad54f1f96e3409c
SHA512 108060885a307f8d46d14b7ac273ad6ada4ffb7e9d7a343246d8fc75a2cb5e8db033d2fab5cc3985ceba7f9730e341a497b5038939f13f8e57267284c016976c
SSDEEP 24576:gEPohm6/7IIXdwcXrif7qQncjlP65i3VuusqjnhMgeiCl7G0nehbGZpbD:fo06DIKdwc+eQnSt65aVLDmg27RnWGj
TLSH
T113955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 5517098b950fa0b1da159232916a0b212bd196f279fd37b8d4027daa078f631c
MD5 8bd0a3d96c5df374f09ffd315c9ec35e
SHA1 8650f0fab3266a2c5c466cd7f0302cd3cbfe5130
SHA512 1b8925a8d4b9ccc289275c2d3dda7b328f8aa5e5472adf3619cfa08ef971f106965c30daad1b0bca73d24ead9d6bcaaec255d890b3a36fadedca3f1871218687
SSDEEP 12288:0EP3RrxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vrxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF55126E679C60DAD136907D8291C209D773F4716B2127EF26A2C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 9c9f4b857b7f76943d9f6580295153b5bb681b89c76fa9d9dd2d3cf305e39151
MD5 c2845739a8d6950b0173f24f331da3d1
SHA1 01438d02e1814a1eca829a8d06f35806d1b164f1
SHA512 516d8a7c4cce1f04dddc610e4677ecb913bc0b640e4d3598ee0172609665745daba9134ec84b8d6ae66ca58f4b4fba67512e9047acd8eca238710c30db699924
SSDEEP 12288:TjkymXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TIymsqjnhMgeiCl7G0nehbGZpbD
TLSH
T112551219639C60C9EA760578C6B3D1589C36BC319F2042DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 ca5eae809f7f13d150169f74ccf556272f6cbcc8049bd8ea9d0da411b9558fd7
MD5 356e9e6f033eb04f7f26f5c04102ef75
SHA1 69d302a5511c759fb2dc10a192d8df4fa1aae501
SHA512 57e3720fcde0aca93b2a71b5a98905f6eaca4ddcb669cfa1b35286fd0c83c4ec8c20b1ed89b230495d64d5b9b7f794aea0814648ed8a39f43ce790ec9c016fc7
SSDEEP 12288:RFMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1534523BE525C60CAE93245B8C3A5E11DA8133D766B2014E739E3FCBDEBB24D44739812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 95c66109852bfd7e56080e9c2bb31f6ea31548fb84abd33f547c5a9afa13e315
MD5 2bc198494789d7b52557ec043d402b10
SHA1 b70126884bf5067c43d1541a076ea0e346debcb4
SHA512 4e1a2d29f5746a09fab440ca143fb077b03483c8d5132885bfcd350fbca10e17f6b2a847d97a98f3c5f816ca7c60b3a192e38e191bbaea2b038f20d7be4b327b
SSDEEP 24576:qQ9MxZKdcz97w3LsqjnhMgeiCl7G0nehbGZpbD:qVKX/Dmg27RnWGj
TLSH
T18A558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 c9a73aab86739e7dbd53ee5f2aed46087c35e7119bd158ba848bb890424cd916
MD5 0df5b8fe97d09441c410ebac790fb7b1
SHA1 cff712a4948f2ecb52999ec4127cb975e1431152
SHA512 fb881c87c0f1363bd2824d4642aad9e4b47dcaeda7ee991317804b5f7b21b4939cf3e842d217740ebdd970f73fa5362b2e0735c87b7e24aa387b24a1d3735db1
SSDEEP 12288:MyoKo2HRple9pyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:MyocxApysqjnhMgeiCl7G0nehbGZpbD
TLSH
T12665E05FB76D40E2E176813C8985C249E673B4305B2157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 08f872f82ef034952a196a8c8628a9679b9dd313e48cc52f07001cb81ddcef52
MD5 d740a10da836d0b438c3c552aeaef2e9
SHA1 c056b0ccdd8a32b591e647b9291e23336df0ac2f
SHA512 7aed41642696e7216ccb3af616ba7ef7ba0eda5c5daed149ac89cbc08b52eafca4fa18a3e4f5e17b0a37403ad19541513b776fb9f0dce81872d66a478705162a
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK2Dmg27RnWGj:40zuNIyD527BWG
TLSH
T19DA57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 94cdbc7cf7fb35ca14564db3f4c1935a0fa4df180dd7e9856d669267f172a099
MD5 a3d3db46fde4d671efcf39a2042b4e8a
SHA1 3204dab2180604f8b80903aaa051ee3804a0d93b
SHA512 258b4e4fc2d3b418e8eee5265859584c3bdc3523de31bb5f38b20aab480569a81ba29b76c9484cd7883d35e340639315e6d9cc31fdf8e9bf0088c9d2764d711a
SSDEEP 24576:c1QT7EcpfxR+N5AWAz3ooiYujMqbxsqjnhMgeiCl7G0nehbGZpbD:BTDxR+N5YzT4jMoDmg27RnWGj
TLSH
T12C55B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 77191d1ccedcc97763ffce22de9091c5e29ed7afbc46e5a736e61102fb8647fe
MD5 9e0945a520811c15ed39c87c38634830
SHA1 00aef909a4080ba058e985a66a342a492f88f4b6
SHA512 57d02b65bbf9a3070c01d4d52025dd96394c5e9513fdb769bc375f332e4bb2e241d0960f124869fbe05c2b742ff1378dda82cc8fafa7c1420c223cb8cce23033
SSDEEP 24576:2TMdOz0FFS+bmSLdsqjnhMgeiCl7G0nehbGZpbD:S0K+bmSLBDmg27RnWGj
TLSH
T1AE75E17EA36D14E5E47BC17DC653C90AE9733862032166DB0690C0B97FA7EE47A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 31bd2f60e00d43e603fe107062e6b435dd9243c945363451b190143021b6d507
MD5 4ccbf1b46463c5e6f23cdc59d91532a2
SHA1 cf37cea0835320823c549dc9aa66157874989bb5
SHA512 a3d1fddc1bfd6647e453520ff7979a0d50017f1bd2592cc1e60b43925e735c270e177ac2d9f21d95b8505adf737d44eb6d88becdd4bc2d08de6003c79a7c3f22
SSDEEP 12288:m47AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F55126E63EC20D9E4729574C2B6D1099432BC36272015FF39E1D9BE9F729D48A38B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1064-137-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1064-249-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1064-131-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1064-139-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1064-474-0x0000000000BD0000-0x0000000000C7C000-memory.dmp

Download

memory/1160-243-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1160-128-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1296-250-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1296-516-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1296-257-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1296-256-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1504-213-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1504-201-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1504-211-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1504-207-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1504-209-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1668-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1668-71-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1668-455-0x0000000000D60000-0x0000000000E0C000-memory.dmp

Download

memory/1668-68-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1668-178-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2352-376-0x0000000000B60000-0x0000000000C0C000-memory.dmp

Download

memory/2352-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2352-34-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2352-31-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2900-87-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2900-95-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2900-471-0x00000000005F0000-0x000000000069C000-memory.dmp

Download

memory/2900-93-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3012-476-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3012-152-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3012-148-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3012-142-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3012-262-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3012-478-0x0000000000BB0000-0x0000000000C5C000-memory.dmp

Download

memory/3012-479-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3104-226-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3104-234-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3104-232-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3104-475-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3212-33-0x0000000000400000-0x0000000000E7B000-memory.dmp

Download

memory/3212-21-0x0000000000400000-0x0000000000E7B000-memory.dmp

Download

memory/3212-125-0x0000000000400000-0x0000000000E7B000-memory.dmp

Download

memory/3212-5-0x0000000001020000-0x0000000001087000-memory.dmp

Download

memory/3212-16-0x0000000000400000-0x0000000000E7B000-memory.dmp

Download

memory/3212-127-0x0000000000400000-0x0000000000E7B000-memory.dmp

Download

memory/3212-118-0x0000000000400000-0x0000000000E7B000-memory.dmp

Download

memory/3212-0-0x0000000001020000-0x0000000001087000-memory.dmp

Download

memory/3304-39-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3304-49-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3304-44-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3304-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3304-47-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3324-73-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3324-79-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3324-82-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3324-83-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3744-485-0x0000027218E20000-0x0000027218E30000-memory.dmp

Download

memory/3744-484-0x0000027218E20000-0x0000027218E30000-memory.dmp

Download

memory/3744-480-0x0000027218E20000-0x0000027218E30000-memory.dmp

Download

memory/3744-481-0x0000027218E20000-0x0000027218E30000-memory.dmp

Download

memory/3744-482-0x0000027218E20000-0x0000027218E30000-memory.dmp

Download

memory/3744-483-0x0000027218E20000-0x0000027218E30000-memory.dmp

Download

memory/3748-237-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3748-244-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3748-245-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3748-494-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3872-105-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3872-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3872-119-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4072-224-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4072-215-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4072-221-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4152-120-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4152-20-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4152-10-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4152-17-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4152-375-0x0000000000BC0000-0x0000000000C6C000-memory.dmp

Download

memory/4792-185-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4792-187-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4792-179-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4792-433-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4912-329-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4912-154-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4912-160-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4912-162-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4972-165-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4972-377-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4972-174-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4972-171-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5076-115-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/5076-126-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5076-109-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/5468-432-0x0000016EB4E00000-0x0000016EB4EAC000-memory.dmp

Download

memory/5532-456-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5532-196-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5532-198-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5748-173-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5748-57-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5748-59-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5748-51-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6064-277-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/6064-472-0x000000000BCF0000-0x000000000BCF8000-memory.dmp

Download

memory/6064-518-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/6064-309-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/6064-263-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/6064-271-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/6064-269-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/6064-293-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download