Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/05/2026, 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
Resource
win11-20260130-en
windows11-21h2-x64
18 signatures
150 seconds
General
- Target 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe
- Size 10.1MB
- Sample260509-tybb2ady7l
- SHA256 f34ed3572fa8953cc9d3240d8a112f4729b3739c3c35e7968586f5b3bbe5c1e0
- MD5 deaa6adb27d3ccc08d745104704fbedd
- SHA1 f274e6dc7e954767bb4976c352b39545435b6ab1
- SHA512 c3f1b891832b86e222612e98259d8c32f3951b9ddedb9eb4bc7ea81fd0b8bad00e977a3476367c8b7a9144886677fad4a2b6f260c2cbf557435f0cb6334e24ca
- SSDEEP 196608:rsSXgw0Mi1jSGuqwbwYy3LQj+RIR26SyyU8RVQBWG:rZwwJ4awdMj+RyyaB
- TLSH T14DB69E11B652C526D56202715E7DBBBF546CAB740B3450C7B2DC2E2E2FB09D22A32F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 2280 alg.exe 5312 DiagnosticsHub.StandardCollector.Service.exe 5496 fxssvc.exe 4756 elevation_service.exe 4740 elevation_service.exe 1116 maintenanceservice.exe 3976 msdtc.exe 3532 OSE.EXE 3972 PerceptionSimulationService.exe 1692 perfhost.exe 3168 locator.exe 1776 SensorDataService.exe 2500 snmptrap.exe 2136 spectrum.exe 3740 ssh-agent.exe 5700 TieringEngineService.exe 3812 AgentService.exe 3044 vds.exe 3644 vssvc.exe 3112 wbengine.exe 3692 WmiApSrv.exe 2544 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\e: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe - Drops file in System32 directory 35 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\54f990d3b955e89e.bin alg.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db spectrum.exe File opened for modification C:\Windows\System32\vds.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\System32\alg.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\locator.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9dc96cad0dfdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c1973cad0dfdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000332340cbd0dfdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6b58fcad0dfdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000822602cbd0dfdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020b316c4d0dfdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8290dc4d0dfdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe Token: SeAuditPrivilege 5496 fxssvc.exe Token: SeRestorePrivilege 5700 TieringEngineService.exe Token: SeManageVolumePrivilege 5700 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3812 AgentService.exe Token: SeBackupPrivilege 3644 vssvc.exe Token: SeRestorePrivilege 3644 vssvc.exe Token: SeAuditPrivilege 3644 vssvc.exe Token: SeBackupPrivilege 3112 wbengine.exe Token: SeRestorePrivilege 3112 wbengine.exe Token: SeSecurityPrivilege 3112 wbengine.exe Token: 33 2544 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2544 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2544 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe Token: SeDebugPrivilege 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe Token: SeDebugPrivilege 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe Token: SeDebugPrivilege 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe Token: SeDebugPrivilege 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe Token: SeDebugPrivilege 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe Token: SeDebugPrivilege 2280 alg.exe Token: SeDebugPrivilege 2280 alg.exe Token: SeDebugPrivilege 2280 alg.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe 2488 2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2544 wrote to memory of 3184 2544 SearchIndexer.exe 105 PID 2544 wrote to memory of 5476 2544 SearchIndexer.exe 106 PID 2544 wrote to memory of 4788 2544 SearchIndexer.exe 107 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_deaa6adb27d3ccc08d745104704fbedd_darkgate_elex_expiro_glassworm_luca-stealer_mespinoza_njrat.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2488
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:5312
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2116
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5496
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4756
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4740
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1116
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3976
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3532
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3972
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1692
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3168
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1776
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2500
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2136
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:5360
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3740
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5700
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3812
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3044
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3692
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3184
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2952 2944 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:5476
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2984 2980 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵
- Modifies data under HKEY_USERS
PID:4788
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 985ea130ee9a5882eec218baaf9967ce8bc43048f4b8bb20bee77fcf4f58a92c
- MD5 6b2370e83d77708d80d5888e03d81662
- SHA1 ab56018193ce451d523c66ddad997a916d907a25
- SHA512 5002e1c993a67b7b6362621d118e2721676e2d539f3316ea9da0e305d0ef0b7d361ca11bbd8229f40649896110ecd1f171776c9aa78836dbfcbe72f9047e94a2
- SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnqDmg27RnWGj:43q6sjBJD527BWG
- TLSH T1D3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 5287617fc95382183eeee443086cef6d3ab08773850a07c06d24f2b426f41cf2
- MD5 c12456702f98fb32eb6b44eaeadee308
- SHA1 98f69df04b67a6d810503e4e38b7ef9660642712
- SHA512 6c77e45f2cf54950b0fdbdb3591cd8be445e8456e2ec6bf09a4d220dd3a8fcbdff5032f29cb2016a63ca6be19a946d120c5a792497324a12245bedf290e8cc43
- SSDEEP 24576:NXYfDtczARsqjnhMgeiCl7G0nehbGZpbD:YtcADmg27RnWGj
- TLSH T18865F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 9a7c14b3cdcfc7d60f2df45de4ec07e0ad5290473ed571e51a5f60a55d903599
- MD5 6443960ff2cf3e14af11d7ccb3fe916b
- SHA1 9c5100dd8d9bfa62b7fea8c24f397cc870f0128d
- SHA512 0946d5a3b3c6f40728bf4d72cd14879c35d7565f8f16b407b87be83ce33746d3ce5c4bc7e8bf2a8a14e23da3845fef90bffb2055d6b752a37aef9666bee898dd
- SSDEEP 24576:s0Le5ji0hmxxrMesqjnhMgeiCl7G0nehbGZpbD:sPji0AjfDmg27RnWGj
- TLSH T1DF859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 8c07d9ec605105c4df6f67e952dafc1af892e47f66016505b64f779d0f74df37
- MD5 e584ef5eb31d9effb7e2a76d0c78207a
- SHA1 75a1a07600cd0239b9c4e5825c5389f3149ec4a8
- SHA512 ec0ad780a407f25624aacb9619b19c95316307106509e073472576d80115b7f37ba2a90ffcf5da8ed0047dc4027629a72818eba53a66f1deeda75019f32e4942
- SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWn6q8wyuUsqjnhMgeiCl7G0nehbGZpbD:r/ezSC6vUzPveHjyLDmg27RnWGj
- TLSH T1A0755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 54ec77945fcf1171bc32b4b045f69389cd21dcc872885103780bd4c98997f09b
- MD5 848c73e82cbe960cccb0e3fe59e1fccc
- SHA1 d354b4d0805b137829fbd59d322ffbeb9a5becd9
- SHA512 90fbca91cac18ae44a48db1b14838964d556b1ece2a672e183285b1f862ef62583746109a5003c1ea19133bb7c314cb234aced94bfa222c050b86f16d1022964
- SSDEEP 24576:4VbqPb88hv/l+YFsqjnhMgeiCl7G0nehbGZpbD:4VO88hXl+IDmg27RnWGj
- TLSH T1F3559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 19c6a4642a94563b3e19933764649325c3609754bf098e47ea2e649b2999b34b
- MD5 90d52d528cc7cfc567bbff866b4e8fcd
- SHA1 2ccd31e2bd4cdd0d5667d0e448df4b6b2a66763d
- SHA512 9b8347efc4ccb0c212468daa8143ff841578b1b2032413e90c162b1639c47a3bd6288ab2a8dbd3d63343ce0e788d539ca61578530c77fac9f1a0bb2545775f37
- SSDEEP 12288:5LSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5LSsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1C64523BF964C50DAEB7608B5C3E9F11EAC137E56981008536A637CFEE6B5458CB39023
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 e80f797e55018acfca205a364e3df96d7fe8070115681675f2d6dab17378cfa6
- MD5 9479ae301817ff977a86d68b8c40af05
- SHA1 6a1d9d49a41aa822aa7257883e3c9519c6193f17
- SHA512 d86f076341f09735778a8699098f6bfaf0bb56caa05fdcf23bbc7e37636bffa458ee8b900df6c3b46d22d0317ebd56fd2d914e1feb326f3a7d405c93d3462854
- SSDEEP 12288:8eBNUbTVO86UdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:8JIUdsqjnhMgeiCl7G0nehbGZpbD
- TLSH T11865CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 9cbd91dd8219dc8fe91271f698810c80d116f22b807df17468a9d93d4f2d4133
- MD5 ac984d874ccf490ce5465cc2a61156ca
- SHA1 ab9c05bd2cda569c455208d458c4fba81d6b0213
- SHA512 82c6a8845b53e93ee85223f97caa8d01ffc9f0726fe879c24a1f388d87769433b7c922b3f0751f8c0845e3eefc37b9fe08818baba330d06b3608066033c42818
- SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THk:OQvGAdlCEL8c/DRNw5CgD527BWG
- TLSH T1CA266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 e4768d000ad46480109391ebf18d6d555ca856d9b52acfcb38a4eab53b2f2369
- MD5 f2057ce972f1c3a01068f4f187ae5d57
- SHA1 9c23388ed01909df069e685399a4f093d0e38446
- SHA512 10663581ea00feb0c9301e300cd2e80af816b88a20ffc9d828008f0e840cd29c3d5dffed9f2111c577ceda37ad6988379b47455039d200544d9363809ee928d6
- SSDEEP 12288:6AwSfxL/2Dc3RDLLmt0LDQewsAjbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:P0ewsAjbsqjnhMgeiCl7G0nehbGZpbD
- TLSH T18D75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 4a2182d7fbdd1d6523ac471e4c1ee1b2e920d673ff322e4188ae5bf46a4a4342
- MD5 be527fb426118f2a4c21d418576bac48
- SHA1 a027d51dfc87cc4b0ca584f823cce837a28cbe61
- SHA512 5e8ec22ed5c87aa03a255cb41c5335a7710f7fb2a1aea553bed1f0cf31d9072cc0dc66c16c66d941b627bbb1662b4f68a19eb6f17c67cd7158f2878f2d9524cd
- SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHHVQBWG:IUEtQevvqc2W1cpV2tI32eB
- TLSH T1F1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 5082ad604b96b6f8bbc9e253d817907ee85ea1368d16e2e1e45f3fe43213f7eb
- MD5 b4e2918c1bb03c2b05036adfdf333b73
- SHA1 cb3827f927bcf81f39b4d9f999ac55ad00acbe30
- SHA512 864a50e2ed092c7ce02d3b6c582e50fbe157ab3f82b8c89e89d6a36fbc43a6f4ab467a163bd56054854db9b4900bee870b5ebcdd4a716314490a1a6d74effe19
- SSDEEP 49152:GCbRquA/m2yL5zTfFiV+XenmE3/zvDmg27RnWGj:roquVjnmsD527BWG
- TLSH T1A0D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 d01568f478739e4d9fa77c5eb4fd35edc83ee0e11c186b37eaa7333710e0fd3e
- MD5 b20ea1139b65c14f38f0186703594041
- SHA1 5f553233183422f9b2a0f24f03301cb76e015bb9
- SHA512 fef0c12542e60ac00d75eea8f5b40d668e6a382c48ffb27629ef7e15b624ef28f0874fae388685c10f1b2a63c062dbb508f4bedc8baf496a2a7dc694850b5f0a
- SSDEEP 24576:qAhGL3IFoiwtA5l7S53QsqjnhMgeiCl7G0nehbGZpbD:qAMUFoiq5cDmg27RnWGj
- TLSH T1AB359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 478a3fe3752b213096e2b0ea7f5d092330d943537fd43ed7836adebc68c7d33b
- MD5 ddd1c11800cdc5a51661b8235262a66a
- SHA1 b69e76228a560f7308f2f342412c8863fcbca795
- SHA512 57b221afe7dabae93cec4151a70977bc8b08a1a1ae3fd24e5bdda8b0d8f2f95b4dcead1977f6b2e38ec13d4ab8b04277df60f927720b5640f23296d0775b0ec5
- SSDEEP 12288:Vmw5HEjsChNVBFgl0WDm+C0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Qwu4OWXsqjnhMgeiCl7G0nehbGZpbD
- TLSH T15F65F14A72A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 eefaf2f6419c0c6d1bb5e59b83269d2888e5e80300af9f7a5d6d4d9dc29f077a
- MD5 fcc5600d861d10b626923cde5da0918a
- SHA1 8b47c7c962ad3951f257d4a9d91f2e69f4450f80
- SHA512 d64eeb638fc4a6b9079165c376eb87295a6553719a80dfaff69d98cb247b8effa7cb9f02f1c7c4454c2adec72f683d57232218524c30506889daac9b934710e3
- SSDEEP 12288:UeZ1IyLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tZuWsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1955512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 7b912405b706d55cff38018e0edcf696b6ded47422a7e2996fe6fc03a7ca14e4
- MD5 7ec94e70ba20dd0a6eefd9a127e60af0
- SHA1 95df1df057ced0018f8cf397e655a311011fb15d
- SHA512 f4a48bc07acfde9224afa11bd702d3c47eb23b5d734321803d2cbbe6bfd42c0d1219c1c65964f7a81b83359f536ec77b88ae17840312a23b75e8ee1e63eba4dd
- SSDEEP 98304:cQRQyi36YOcPbLvw2gAf+PN3tD527BWG:DQyiKa/X+PN9VQBWG
- TLSH T192667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 f2d728b24d2fd92d440c48f6bbccc9eb777b994d55cf9a037053ae4f458e4571
- MD5 d71e960051e2c5c830376041eb57a19d
- SHA1 6f18d096274b63d7e5bdd79ac100e01c0452dd80
- SHA512 35c19dc0b0eb20c0e7f80ef2107b316007f05db23b1a4bb35733c1e881993991726ef2b36076a83b1e1eef150e5a0237f2bda054cb0d8d30b5a9b3e75c640f44
- SSDEEP 98304:UQRQyi36YOcPbLvw2gAf+PN3tD527BWG:7QyiKa/X+PN9VQBWG
- TLSH T194667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 c9b42cb9c979c73eff615548eb3d3f1b2656ba90bdd0ad4c0ab5f603707541af
- MD5 ae1ba11c8cb306a7269c75e5929a2b17
- SHA1 1e590d43b3dd9b05a6b1aeb2fbf6d1a40e3b62c7
- SHA512 9a1a95c458f1a65a238139e959b62737493fdf9d6ff60b78e56e51fd27e2c788a2465f3c6ffb1b13b2e9efc48c7fc136385cbf1634ca8a1bd4e8a5b66ac17efe
- SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0msqjnhMgeiCl7Ge:w68Qg55nhceWu7PNU3/fDmg27RnWGj
- TLSH T13FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 c54555831c9b57591f93d84d2d96d0288bf108553e6acd621234ef3ab08c289b
- MD5 b4d9c716f57cdf89670d6c46e429c430
- SHA1 05433affbadabedf7eab04f9aa971e16bc2c2e02
- SHA512 337220263563c577ef41397e3917f211b9d36deb81e587d2656355632838dc2cbf26f6eaabf1cedae6c7d898ec9bb7bea6598eb20668ce00a46a66ee242d36ca
- SSDEEP 98304:Fy5112gYy5azzVvt69nLKnhZWD527BWG:oLIHEWhEVQBWG
- TLSH T118167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 fc2a26f06b7ef7cc71eaa93c0ce5629b4e31266ec72221fa88d2151c77f559de
- MD5 829cd964ffc1841d8ce4a12fb9112048
- SHA1 d0385e8c260ae20fd4f3e466ff7d7ca7bfdee59f
- SHA512 3e27b82f8ba29ed34b30d354e377653fcfe2480ad64bfd498e8ea058f578f5ec4825c053e525d31ae5a51958650b1e4b874a2245f6aaa0e2a55d42e15b5c6817
- SSDEEP 49152:aB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl1Dmg27RnWGj:Iu6Jmdxd2d1D527BWG
- TLSH T194D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 719c03dd2190d72cbaaabb0efee46e48a7881fc87d84ab5af591387bfe9bed7a
- MD5 b4512d9964e9f1c339547118d3391a84
- SHA1 6cf66b54c5dbe3b59167ada49a54fd2d41e865c2
- SHA512 0ac9704132b457cdb88c9fa7b5055917c69ec5538ed86a4ac3f3a639692d64d7c8d6d455f0cfaecf827ad48ca50c3b068ee06dd9557e6b72e1d03e3f2efca6e5
- SSDEEP 49152:d1hpsNoJpF1A63U44CwH7R4xhDmg27RnWGj:dmifPWRsD527BWG
- TLSH T10AB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 9925265d478fd6e4996a714bfb96c3b84bf2ea4799b6f039efe3f9a7d3fbb481
- MD5 7dd135fce534ee91a3fa6d421d893ba6
- SHA1 1e54d756f85f5068b9282e3910487ad456005df3
- SHA512 d35fb0cce42e1bc150a10c163506426025d8761790104ab7f0e863990b79c8f06407aae47901cb7e40cadb2f14ca9bb08bae6614ec1b5ae559d6266a9b90dc66
- SSDEEP 49152:SSuZQIY0Be2KcRVtOnks6NMHqaDmg27RnWGj:M5dKii61aD527BWG
- TLSH T187C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 cf02f1761240ab2e211d6ddab304679f54931c34402f27fa0c0198cc175fd95a
- MD5 6286de561f9eb0ab0f885f7656147159
- SHA1 1b8749ffd56ddbc392036e0fc907afdbd10851f3
- SHA512 47cb2c24d130b91fbe0a7353e995d08af041675a7f1b5ac99118c4d04942912c3c87843d8aae96c87a6ecb684617ba32a17f59a616a2c616421aa8a51cb8de98
- SSDEEP 49152:qDhtSn8EApI0fig3giDn0AP5wlDmg27RnWGj:qiX2imph4D527BWG
- TLSH T11A95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 5561606edc899d49904281dd74ec2f10da15c922985b52d975a7c61f6a04cc8b
- MD5 d60442880a93b7ce713b20f9206f7cbb
- SHA1 3576dc0bdcc74dfadf12b2a69d9fc7a51e7cdebd
- SHA512 bc90efa6697400b6ce8f47fbf62ee504bdf8563677b3a614e69f81f059e1511ab3a0a43a1ce7030594a45e244407cfe6390101cc6ad7929464169148892c9e55
- SSDEEP 12288:AKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AKsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1C94523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A5B7CBAFBB14984B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 e33902f71a609c92f790fec341ca52284a370f3aeefc4e5f1a3e50fe5b9a7016
- MD5 207b54ad364f4d528c827ff83edfa336
- SHA1 f2b484473bac7f5a3b5f23d6e815dc389927baff
- SHA512 5e950704ccfa0aa415963cc0542da4e0ca6f9f904ace9edba7757cd5355a413337d6107082495d47c9137936bc36f02f362da877ad00536d9f8c961c3d174918
- SSDEEP 12288:e/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:e/sqjnhMgeiCl7G0nehbGZpbD
- TLSH T13E4523BE965C41CBE52644B5C3E5F10DAC073E5BE92004937AAB7CBAF7B14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 6e6da13ca77572d0814d48b7487b8f790f5ec994844c8e605a1e11a4b389b1ff
- MD5 5959cb261a79578cf1a22810d94add22
- SHA1 c68d62dc6aea44a89a42522d3f12a41de4d06c30
- SHA512 69fbe1f9676f557d6822a4b92fe3360cc5ca843fa3ee0d4e48b17b40b10d41f5eadfb40661a54be38cc3be60736c7c67a31c84350a85b9023f395ad6d4b89eb0
- SSDEEP 12288:nVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nVsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E14523BE965C41CBE52648B5C3E5F14DAC073E5BE92004937A9B7CBAFBB14584B38423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 0c5f5ba7191ecddefe1cf81662ecd031f3061a103a61acfe046694928635ba9a
- MD5 91b5564bbc786e057cd1b3659673295c
- SHA1 c7fbeaa247cb1c7c6d61c1fcd7a71eeb83b74635
- SHA512 e87487de67cf05760b6452045e428f0266816d4682b8e9db6d1a24c9b385c9318b381cbe6e3fa58c47318dde41d5da4a3607d24ee247201d408f023746e680fa
- SSDEEP 12288:lVwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1AA45236B675C00C6D83285B5C2F5E11DE8237D56EB30059B6B532CBE9FB12944F38A22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 f18ae6cc159b18ca884cbe07497a3817ed2df031d96cad6d3b224c19add9ccfb
- MD5 8d7c8345fa18b7aeddcdbe07f0b2a75f
- SHA1 84786d694c23251634a9bfe1db1aa00e569b65b5
- SHA512 077427ecb3c9e0da444b864cdf86302404e5696bfd8c9391c920250f9818f5fa4c9578a00761343f157a8dd1672130e14aa1b6f991eeb22f7bbe80d3a087cf55
- SSDEEP 12288:Y4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y4sqjnhMgeiCl7G0nehbGZpbD
- TLSH T14E4523BF965C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CB9FBB24584B38422
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 942277d94cd9efd6824da52d7cd54c1e6764ab71c00959f7d63e817fa26e70fe
- MD5 cd166abc2d96c287d6f1697d95adca24
- SHA1 41498590400ed79bba9b096dbba75dd864fec8f3
- SHA512 2dc78e116c5f9414d608f12323a0b59ffa395bc2fcada6f28e41a2e1f50849963f60a04750fe00b9e03040a123240e1ecab56ef101ddc48b83466367dfff465c
- SSDEEP 12288:QzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QzsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D74523BE965C41CBE52644B5C3E5F10DAC073E6BE92004937A6B7CBAFBB14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 3e9233a074093b12fb5c976cd21f2ec881b3df35a75b29c59a1e4b6d43c402d7
- MD5 c3c9cfd073faa65b10121bc5d284b465
- SHA1 76535f1ede5597457d33ac4e82713a225f741564
- SHA512 bb53c7f2d49d2bee78d5b5e2edfe94ee1448f6794f9b6606c12443aa968d6da1888bfabb9ff5767594f64e3056e3c8830d8763cf1a97ce5d29df21683da286ce
- SSDEEP 12288:mnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mnsqjnhMgeiCl7G0nehbGZpbD
- TLSH T10C4523BE965C41CAE52644B5C3E5F11DAC073E6BE92004937A6B7CBAF7B14684B38423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 93f7a0fb5680c512860358054cefeaebaca3209dfeb1f9204fd46dabe1ddd6fb
- MD5 a42af757dd39a62143d78d2d3244dae9
- SHA1 e6b7e08969324ca0f6e3091a837dcbdc3f4b496a
- SHA512 905ff6cdcf5213496d21a825108abe4773295908ef27ba2bb37db75aced81e62e9f102d305b619a8fb845aed046798fd2cde9acf4602ea05135241681e345fac
- SSDEEP 24576:9ZMRzFVSOfsqjnhMgeiCl7G0nehbGZpbD:9ZMRzfnDmg27RnWGj
- TLSH T1CE6501A9B39018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 58427759b645130d7be4b808e9d633e4b3e71639f70045ecbb44e772d41bf6a9
- MD5 223f423a59cdf2c0e4b401bae2d63a01
- SHA1 2e43193913971fc321f2e68e0b821241872d61aa
- SHA512 5a957a80a7909c82a10bc7eb0fe0418ed928b63148270d322dc4dc401802f063a8da2ef0144741569e6371972d934d226c63214e14e663fefc682660b2b1ddd4
- SSDEEP 12288:sGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sGsqjnhMgeiCl7G0nehbGZpbD
- TLSH T15D4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CB9FBB14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 c34cd36071010b4e542c7929bd8c1ce0ed6dd463c2c1c5628d60f7d6f9e27d95
- MD5 25f2829200e6cb6571cc061acdabf11f
- SHA1 ea9bb9131c57e130d820ebef0a726a25e9c9da9f
- SHA512 57784d90b1c870ae3e26bc393a272c353eb6febdae17d73df931b74c736280190c056f8f042461b0b76b3bc03b7a605ee5735168c772620fc8566b078ebd63f2
- SSDEEP 12288:rCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rCsqjnhMgeiCl7G0nehbGZpbD
- TLSH T17C4523BFA65C41CAE52604B5C3E5F10DAC173E5BE92004937A6B7CBAFBB14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 bd8e47a15c4397f2c192299aba4349987e090545fa20e1d1b482f1346982990b
- MD5 a007e7c520e263bf9fd5c53d1a0c3ed2
- SHA1 cf8f551e6baa3d10e8cd15d7cb1113b939d6864b
- SHA512 eabd5d27b196712c0c50a26d1437871e6a2c08b9a7673ab5a08265de0dd1f2e93ddd98dddcd70b9d52872f5aef62f562edfbaf47147c70fc1d6bf33801ade993
- SSDEEP 12288:8yPz5L8LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lzyLsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1F055125B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736D04E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 5d304a54d034606b62aad029ce193937c7f3d5575089ce159099d1c7ae7943cf
- MD5 f0ce69165fccab76974f7b5e8c0eb7ae
- SHA1 91ad96d09ccc1e9d67f736dcd5f974059db266da
- SHA512 604111dfd308252b16717c2b6eb02343b8e6e9ec2161d4563276976edc88abe78b92363df0e96d9affe454e504b140e201a474e0ef8b1aedcf4510eb80b208cc
- SSDEEP 12288:EGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EGsqjnhMgeiCl7G0nehbGZpbD
- TLSH T16B4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 71bf9d65a693ceab97517447d0e2e006b19e19480b60d4dc0fb4078c63420077
- MD5 d453bc13e0ee0a1543272c4cf080d4b8
- SHA1 08d77cea4612e11e6d482e96412620c4cb5de8fa
- SHA512 06477c0be1678dfbc54fc5914186c01d2bfd668ccb75ad1585cf5bde817942f6c443dc96d72edbd70042c5f9f1e05a6cbe79a937f38f8b5fd87205aacb0b5f05
- SSDEEP 12288:UGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UGsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1234523BF965C51CAE52608B5C3E5F14DAC073E6BE9200483BA5B7CBDFBB14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 2975f705e22cb91bb5084c082e54cfa123903e9f848958d47f364008e5a22dc8
- MD5 920f0d06fdbf6fd42b43c9b67e4518c2
- SHA1 32c27ed27bbbd5cb9835f25e79c418bdf3f42e3b
- SHA512 1a5612ce04fea8fe1475085726da8510219ca01dac61eb089ec51577b2f3b28cc44f0577be25445b28c3820016fcca93b671f0c4ca33edc195bdd7966aa80240
- SSDEEP 24576:MCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA5sqjnhMgeiCl7G0nehbGZpbD:MCUZPTY+8Wg2lIL8lrIUJLWwkDmg27RN
- TLSH T14F65AE1EA3DC0896D4BB81358A51CA06EB32782E1B2196CF2160C77D6F67ED54E39F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 b418d194e57dd76420fdfbaf61d42478f09e6985d3a39263795370dc028888a3
- MD5 fb3ecadb67b2e5b1a8e503e6b10dc2fb
- SHA1 08e3e78334dbd09d5f50c7e210f97c8d4d3a911b
- SHA512 cb3800ac90ea0da01eb942c154c0a528afb28d99ff970a0143ec8c8d8346739557a5e3197c75f0e861a403f9e19a134a176b7dbd776073a664cc3eef632b87e4
- SSDEEP 12288:vbsfWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CWsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1BB55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 25fb656276da13f43e335ab879231d67ceef4440d189d546ad18ebe434957683
- MD5 8615585b42975f2ac9c24f7dcec52b6f
- SHA1 110525c54986d0340339cc1870cb07144ddd00fa
- SHA512 05c1f5e56743e63444f3190349f93f5ec92df116d6cb6283b16f7ea160ab0e1c82411ad4211311816675b969f94d87638770e3e5817f7d50ae53a44a2b256fe0
- SSDEEP 12288:f1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:f1sqjnhMgeiCl7G0nehbGZpbD
- TLSH T11145237AD34C518AE87609B482EAF12D681B3E669F2004C3B94738FDF6B18D48F38517
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 f5aa29ce1e21e99f2b7843d5883c4c740bb4d9e88d1a0e9384f8eb026b19e6ca
- MD5 08fcc5f10a0810b340b6924693b252fd
- SHA1 73857fd0f33a5c0379679dd2b773b7c60ac4a1cd
- SHA512 f3d992bfefa61e238aa9575a954df254022f97821f7cc4d76983616f0e295f6b585d4fce033e89074a652cfb47b487173dacbc1bba24d8057b345811ea5aa1c2
- SSDEEP 24576:K8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC7sqjnhMgeiCl7G0nehbGZpbD:7RZwQCyiHiQEaiPnMSDmg27RnWGj
- TLSH T1B185B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 b3e4ad91e32ec44e47b89dfc9001d15d2c791ca5e809bc488100849d3ff4b561
- MD5 612505a7de6d436cdee2d2ed4a1e8ba0
- SHA1 39efc4d69e2244f95ef0ce86b6a2c848a95d259f
- SHA512 07c6981d6bbf564bb60d54595e4659465456cce9c40d846e320ada61e4bfd288a80fda9def018415e6c2bba42189b3b2a434e5a679e15594dc9b3f957e3d6d45
- SSDEEP 12288:YbxA1U7KlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YbxA1UGlsqjnhMgeiCl7G0nehbGZpbD
- TLSH T10655123E62AC20E5E176957D86D2C10AD7327C26672053DF21D282BE5F37EE84D39E42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 e4385a2209a5bf1f7c888a31a0d543e1af7afffc8328f97ecc27d30c61a4ae9c
- MD5 427b873572a6bb950a88e7bd3fb5bcba
- SHA1 cd0cf45933c7cd46224fe281a3da447b094e2228
- SHA512 e49ae68ac4e548eda5d2909e2fc4629493a9f46ec6a7a000628675cd868a0e5a651ca25e560123210e0c4cfb7478b2e1cec64d5a26b314ff57f95a1b78e03d89
- SSDEEP 24576:ujsmP0yHaqrVqHra44KDzMsrngsqjnhMgeiCl7G0nehbGZpbD:ujRP0yHfVqzlAsrncDmg27RnWGj
- TLSH T17945AF2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 29c1bafdd4b43ff2a656ac81a24ffd6c877dfe06490c5cef56bb307cb0f736cf
- MD5 f54aff87549e323e6de4e8a5bb69f148
- SHA1 d66c295a58b4391bbd25c97c4b2eaf1c7f351dbf
- SHA512 ba82b987ae664fdb0b95c27868528c8343ae27fa3e05de5bab74f3195bdd23401462e09e8f91a1f4b9929b9b4971a858482c267e21333ec8ae160ffbd535e883
- SSDEEP 12288:fTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fTsqjnhMgeiCl7G0nehbGZpbD
- TLSH T17F4523BE924C51CAE93649B5C3E5E10DA8073E66AB2004D379A77CFEE7B54D84B38413
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 21e33e712ea46f97bdca7c20ffb7cba71acee101ffcc1ca07779cebc246f4bcb
- MD5 b00fe7799b201b2038f500ee6c454a91
- SHA1 3e517c3e20764d2c93e333cfa496b929440cf5ef
- SHA512 b0f68aed764af557e4e0e2c06ad3b83a408334308be5e6ab9b29a41eb2f2f83b88121eb5adc8ce0f751e4caefaf71b70c3f8b3312980c56643702a5335cd68ec
- SSDEEP 12288:lObfA4LWO+vAYFTRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:ibLBUTRsqjnhMgeiCl7G0nehbGZpbD
- TLSH T100750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 264310b19c6ff83b135832664ee0cd419e0fab2aeb29bbb38bf8b045199681c4
- MD5 5b07b94060360d23bc90735068b6d31c
- SHA1 da2252f74b9ae289b7fc2a5db6e9f20c70eb2ab6
- SHA512 72a9fe85d1eaf30c8390ceb5a17479a4721d5e9404b4bcd291f1adc6512f44ac069af6c8780a766ee75d78c8a8984a48346009e85278a4dc77b70a1745a14388
- SSDEEP 12288:A70Vm9IYNvUyBpaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9Da:dpYNH8sqjnhMgeiCl7G0nehbGZpbD
- TLSH T11565E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 ba652bb1f8f04e0419409417cf28d77ccf09aa779e9c9ece913b37f0df57a82f
- MD5 d69189b982a0ff2ba5bb3d1e0f4d5ff4
- SHA1 b5df0ec7c669c6563b9e0f999a9c9c34720c6c0d
- SHA512 734d39dcf36cccce4daafc84a4f53fd641090f0c9d0630056e2f9c64938067198a4669768341ad26341ec7152acae94911d5646384573177e21fc029747ed2d1
- SSDEEP 24576:onXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK0:onXoJJYH84VVS6AmEOJas+cHBjSSKHPq
- TLSH T1AB65BF6EA2BC04D8D5BBD17DC5C29506F5B278621331C6CF026182BA7F27AF45E39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 4226ed89e7b5be238ee3a473be95a8db3d37803d363a1c898fa6898bba4fac0f
- MD5 abdfafd1fba86b8a0c6315e5d1607d01
- SHA1 270237032a076be124a9773e360e963d078515c2
- SHA512 3bca2b6c8e321774a2a8fc8830a69e6af3c0d90f2210468950a6e06760ac433f6822d200766b7002718d24ab754bb87740fdb140e6d94111a13a81e938947d79
- SSDEEP 24576:ev7Xbxd9Tuycf8M/TYlSuxrr2PCysqjnhMgeiCl7G0nehbGZpbD:eDLL9TuJ0M/TYj2P3Dmg27RnWGj
- TLSH T11A858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 b89fb3537095b92d382d648783bcbf7c12a6550f6ac9144f9e70c3d029901817
- MD5 77a71ed6d351c9f4f594e2c805306839
- SHA1 1feed466ab0edc6cdddbe0eca7da6899ba34bb53
- SHA512 348956e1679f34e4bd738f9f59d7a4948e0ce9de1b84607e8f52cae7467d3c53e02c7a35a5ad743c70a951c5acd8ad333b4de717a77edb8d91f27c97942ea2fc
- SSDEEP 24576:yegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wRsqjnhMgeiCl7G0nehbGZpbD:yngOJOmPOHzlDmg27RnWGj
- TLSH T1E355CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 6c25d96ae9a7509984bc6a1721c7ac18f305c15693b93202e866fb77dee03507
- MD5 0d91b66c69e5526b59678f68f58854aa
- SHA1 dff6456d03f0c5bf4f2873d82c4161497d31bcf5
- SHA512 c75ffaf61a5b6e1554a904e9f7490dc1623d1020966ebefaa81bece74ec505888813a407f5452e5723c9e43cc7d28fef81c6317fec30e0d28e5e5423f31788df
- SSDEEP 24576:uLJnJiTk3R3waE4JrOzsqjnhMgeiCl7G0nehbGZpbD:uLJnJK8R304lsDmg27RnWGj
- TLSH T11675E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 d7ae5d1625658b8bff05e4b2fce3b4939b50ac620af5118f3677e707c4813bb3
- MD5 87aace40dd9995578d83c36d2eacacb9
- SHA1 c7fbe8c89c554719f5d8551e2117f0d220634789
- SHA512 7033f8cfd5fe548681f1b79e7133eeeac881622056d66c42bdfccb91fbb9e47c2b87bbd941db1eaa1dc3c20d05ae2bd5f146933f53eb59f1c6b5369c3b14b4ff
- SSDEEP 49152:m9mqCzDScAZmlvTcFg8Ph67Dmg27RnWGj:oID527BWG
- TLSH T10F955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 d2ee9ae799eefc1ff4e44c4b696f0948fde6a41e153e5c5bca4b21e8b79effd8
- MD5 7daaa2c8b8393921153a16b76c614586
- SHA1 7cc48ccaf1b332b1b0197052100cdf7d37edb07f
- SHA512 f65b2551542800e682b61cc5ea8206cd707d4730018f2d2bf977cfead8421e3fd5db948778aa2e23fe019862e8684f724c68f9a0a2da0b86d5d2fbb6c08b6fe7
- SSDEEP 24576:AlYJeXm5jUuEBsqjnhMgeiCl7G0nehbGZpbD:AlYJeXmRUuEVDmg27RnWGj
- TLSH T18155126E669C30E5E13A8079C2E2C508E633B876671017EF55E0D5BE9F679E40F38E41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 ee0c7b2808b1b35b14d22bad15300674aa05c53e982cf58979fe781dc13fdfd3
- MD5 f7bf663d646f1286702f095f5ba39bfb
- SHA1 e506fa0b3a1f317b21e9e45ae076debc68d7face
- SHA512 96915bee0ab4860aee9e97a18841f67ec0347147cdb0e1cf2f50a55deb479b5a04fa0495ec7ee4cdf80a5dae4d88fb393e367d5b9fbbb84c1c0d3af55d53f50f
- SSDEEP 12288:2mu6kyAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:27tyAsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1DC552219639860D9EA760578C6B3C158DD367C219F2002DF65E2FA3FAF726D48E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 a53329deda199a547eb1880f8a2a91108c977e6194b49117e13b538909e93e29
- MD5 4b50db9056f63256c13ad4a820aa0e35
- SHA1 b2f69b7e1fe76609646dc100833804aa8cc87309
- SHA512 c1ce9b41e7dd0a377fb467e604881102e6abf1daaa9af6f01d7f7b544b1108b49eca1b8c0780b75d2869e2ec8800c3cf11d009ab9f83af3482d40a9f1cce7028
- SSDEEP 12288:APRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ARsqjnhMgeiCl7G0nehbGZpbD
- TLSH T10C4523BE525C61CAD93244B4C2A5E10DA8173E36AB2014E779E3FCB9EBB54D44B38C13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 7a7ef95a7663516835f03d4bfcab7be77d044aecc252077fed9ce6a08c110666
- MD5 c581d7273f0ae885c3f943a0065997a9
- SHA1 77200df9545f16983affbb1c5575ec9bb6e9c6d1
- SHA512 644f4a5ed3e9f27acc780b4162a36c971b9b83d8af4a3325435779f0060e9741e2377bdc72ed9003fce6a7220e7d91501bee4f0c823edda74dbc75e9391b188e
- SSDEEP 24576:BC+TyQIu93VAumZr7jm2sqjnhMgeiCl7G0nehbGZpbD:B/TfIq+Y6Dmg27RnWGj
- TLSH T178558D2DA7E919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 e62de49b05629342f4afbcd70e8dc74196c006696b52434ec4e949fe50ed80c9
- MD5 47984834c93e4742d12e3ba4f4ed2cc1
- SHA1 555b26ab22ce8cb9c88fa947fb92f580326ccedc
- SHA512 dcd0813d8f1d9403e0529b3416575e3746f8af9cca898845823f20b8317080521abf4fe695757c13c8a61d43d30215a7406f2dcc9dd9c2fb6f75eb6668465559
- SSDEEP 12288:ycyrWOstaa3kcstXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:DLQikZtsqjnhMgeiCl7G0nehbGZpbD
- TLSH T12265F11FB3AE0095E0A7817CC8858116FA737835571167DF02A1CBBD5BA75E8BE38B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 297a0b19fb36f86c61ddcda31a0561c928d55e473fd31427ed3f75da3837a5e9
- MD5 7aef2a30a4791421bf3565c6d82505fc
- SHA1 feb225bde54141dfcf5f89a8480fbc355732af69
- SHA512 3d8b62e6303c28d99e70be6d52d586e723b889f70ff412f210aa003b796f18544914866e69ff62a9c09427d55bca036767a081b0fd639bbc7a04913a9f40aa16
- SSDEEP 49152:PpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP8Dmg27RnWm:0pC7b4+80GTkTD527BWG
- TLSH T18BA57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 6d23842627ec37636c07f12fbef10a03ed915ea3e59e7854a5a1a98ddf9ddeef
- MD5 f5f09bcdea89d340b7367adfc887e602
- SHA1 b9e4e9ee2a3be2aed0cd35ff2b649f02d007f401
- SHA512 d7524a8e97f3cab31aeba66f955ae80c3f435b2a87d718560c0b1344eeba27a7f336bf0201766958d1696833121b7c50d57227f18f3796fbc75ba71f6cb889c3
- SSDEEP 24576:eSAwJPE1IDAo+4Kt+l4413JUQYsqjnhMgeiCl7G0nehbGZpbD:eqPCIo4Kol4vQEDmg27RnWGj
- TLSH T11755BF2AA7F956E5E17ACBB4C663C601FB733822133163CF5290857E0E169E85E39F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.6MB
- SHA256 6ee4ff6b06928d6d726bb8d8fdb02eb24cfa095dec147cb1bb257f8315ddc7c5
- MD5 abc4166c47e681be1a927069dba64459
- SHA1 1eaf74074a23da3f8a4a90ecfdc8fd018e3e52f7
- SHA512 10b4d81324e96b1e9fb20ce83f74fe8e8ad557bdab3f7bcac35c5d9c50333bbd383cee374901b04ce13c1ae1e06f51da10e4075449041ac98138a981f3fb7164
- SSDEEP 24576:1yLXPLcw94tIsqjnhMgeiCl7G0nehbGZpbD:1y7PoXt0Dmg27RnWGj
- TLSH T15275D03ED76C04E5E47AC27CC6A3C506F6723CAD033166CB19A095792F6BEE46939B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
- Size 414KB
- SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
- MD5 16b9618962f5623ca791a1366eee5708
- SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
- SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
- SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
- TLSH T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 d195e69a12073ac391c750499fb97174e7122e2936a5f24390557f7ce01dbbb5
- MD5 c597b058c2946b339c5071c7fb339e67
- SHA1 ec78d2c444bfd783e666970dea65b6d2855d424c
- SHA512 30c4c252b51b4cc84b1a4c659cddbd9288ad625db1d100e78fcc85033fe7befaac96d6ebb9aa36680e53a215b67cc8f54e4957f3b683a3934c46078b2ec8ad0a
- SSDEEP 12288:c9lyvj3IkxjbBz9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:cWv8qjp9sqjnhMgeiCl7G0nehbGZpbD
- TLSH T19065126E529820D9E43A4674C2A6D12994337C77173459EF75C5E8BF8B31AC0CA3EF22
- MD5 SHA1 SHA512 SSDEEP TLSH