994590378bdffd9bbddd35cc6c1ae4198c0200ee8e1182aea3e699d94e14c303

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Size 7.6MB
Sample260511-cc8a7shz7x
SHA256 994590378bdffd9bbddd35cc6c1ae4198c0200ee8e1182aea3e699d94e14c303
MD5 60759f029aaf5df802d1c79c4a495000
SHA1 1a0ef11717d34e13b6f4ac373a3bda18475d73c0
SHA512 197dc0d2b767117c289d78c8ed947469d202626d08430e22d3c6b13b6952a60b88f0bd0d1f1aa24e578d661e3fc61fd2d406411518400eb454386bdf5c7c9ecb
SSDEEP 196608:IES0SZMHk2jrYD6TqJbAvpdXIJUAHSBFtgZyrEoKsaaL:apZp239oIDAEdB
TLSH
T1BA867C22AED45C76F9B30F706E38A79A8D6DB93E0BF1805F6384154D09B0DC1962276F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2216	alg.exe
3472	DiagnosticsHub.StandardCollector.Service.exe
4628	fxssvc.exe
2308	elevation_service.exe
2932	elevation_service.exe
1284	maintenanceservice.exe
3092	msdtc.exe
4008	OSE.EXE
4100	PerceptionSimulationService.exe
2064	perfhost.exe
4752	locator.exe
2948	SensorDataService.exe
2560	snmptrap.exe
3200	spectrum.exe
2640	ssh-agent.exe
4408	TieringEngineService.exe
4952	AgentService.exe
2688	vds.exe
4956	vssvc.exe
3320	wbengine.exe
2712	WmiApSrv.exe
4512	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\de7557b614bf40d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081828884e9e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4a77386e9e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c27fc684e9e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008793227ee9e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b794ba84e9e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
3472	DiagnosticsHub.StandardCollector.Service.exe
3472	DiagnosticsHub.StandardCollector.Service.exe
3472	DiagnosticsHub.StandardCollector.Service.exe
3472	DiagnosticsHub.StandardCollector.Service.exe
3472	DiagnosticsHub.StandardCollector.Service.exe
3472	DiagnosticsHub.StandardCollector.Service.exe
3472	DiagnosticsHub.StandardCollector.Service.exe
2308	elevation_service.exe
2308	elevation_service.exe
2308	elevation_service.exe
2308	elevation_service.exe
2308	elevation_service.exe
2308	elevation_service.exe
2308	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeAuditPrivilege	4628	fxssvc.exe
Token: SeRestorePrivilege	4408	TieringEngineService.exe
Token: SeManageVolumePrivilege	4408	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4952	AgentService.exe
Token: SeBackupPrivilege	4956	vssvc.exe
Token: SeRestorePrivilege	4956	vssvc.exe
Token: SeAuditPrivilege	4956	vssvc.exe
Token: SeBackupPrivilege	3320	wbengine.exe
Token: SeRestorePrivilege	3320	wbengine.exe
Token: SeSecurityPrivilege	3320	wbengine.exe
Token: 33	4512	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeDebugPrivilege	436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeDebugPrivilege	3472	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	2308	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
652	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 652	436	2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe	80
PID 4512 wrote to memory of 568	4512	SearchIndexer.exe	106
PID 4512 wrote to memory of 2264	4512	SearchIndexer.exe	107
PID 4512 wrote to memory of 2360	4512	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436
- C:\Users\Admin\AppData\Local\Temp\2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
  2026-05-11_60759f029aaf5df802d1c79c4a495000_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe RELAUNCHED
  2⤵
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:652

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2216

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5024

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2932

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1284

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3092

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2064

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4752

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2948

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1440

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2640

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2712

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:568
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2852 2836 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2264
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2884 2880 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 15cc1249760a662489c215af26dfbf5d1d090f9c45bdecbefecaaf25e1933f84
MD5 3b0639c07078eb60101b210aa95e6083
SHA1 6bd9b4372c139af492405e04def1d493355f460d
SHA512 10e90d300ef22249399e80d0f080d229383c537859dec48c725f7e0c46014e076a5b82fbfddc02fd01fd39f9984495529c8f161457c6895b30c672ef26485ab6
SSDEEP 49152:Jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn/Q/lFTjN4:f3q6HjBzLm
TLSH
T170D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e28ea9b116200667e79ce4d326cb9a5d80dbc9eaa5d7fb953a24facdc55468ce
MD5 bd71ec657aaf3f43434c7bc13239b6c5
SHA1 eb1daaa2db122586a6dcbd906a90111e4b48bc87
SHA512 a6bd1aac4f3860352bef6184e6a03468ec25485c20165d747040074cf353f45b5371dc56b158d40e440ea79a58465d03fe22c26de47ee086249b55623503715d
SSDEEP 12288:n1XLsswWkxy2lRq2czAkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:1XYfDtczAEnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T19865F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 42ff04732cbd36e0db14fdc663392c39be1f875b4daf3fec1e13c176cedf74df
MD5 51b002b6c6ef73ffb558d799b868ea4f
SHA1 d705856ac1bfc13d099be52d8b25b69eb8b67c75
SHA512 4fe93a52ae257f479b3afe704116ec1a65fa84426614389be25e433aad9d0d4e145e85ee3b129423c0ee5fda21d3298e8b4e1a52fc75208d63345f6e08d84dd5
SSDEEP 24576:h0Le5ji0hmxLrMnnQ/tbw/2Mkjy6Fr7g0oN:hPji0AluQ/lFTjN4
TLSH
T100859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8ccece21f76f0a4c5aaaa3976fb319e6be02d4bfe427bfc59a31ed719f607f2d
MD5 ca9dcec56cc4d098e020b987155a644c
SHA1 327dba569f8381b7003dc4c64325c58c03836dd0
SHA512 3e11e3f65857d814c84513b55d77d810f49f8c8a736e39cc439c1e2068cd863a8d408e6d61aefa30ac397d6215b27926d1a067ad5d4daf61b534046f23fdcb17
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyudnQ/tbw/2Mkjy6Fr7g0oR:M/ezSC6vUzPvxHjyyQ/lFTjN4
TLSH
T114755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 82cd21a460f363cffc40eefd85e9d4a67d515c56358af24d406af2e32a948c96
MD5 bd9afeb70dd715bf2e6441f289e3468c
SHA1 81b6a79e591e312fd95be08f84149cd914b545b1
SHA512 8028bbd241daaee5b2a111925704d688bcc1a1d27e09de147ef106576af1e85e5a326cd9939cd634163ca94fec2f6fe0e7cf194b64ce1d65cf2ec4556e02f56a
SSDEEP 24576:CVbqPb88hv/l+6QnQ/tbw/2Mkjy6Fr7g0oW:CVO88hXl+LQ/lFTjN4
TLSH
T1E2559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c134be6bf37bf96ee44cb8c8c5d3865538c3ab87f955d1be1ed3f360d7fc5324
MD5 9cf68b5b796da4e7b23d82c019d9dc0c
SHA1 b14012f45cda9068247cdcbc3dbeeecca491f328
SHA512 98d254550131a1068cd67aca6db8bd7afc2e9bb068d1f0b46bd919ea1374242944821d95af9b0ac8e02aaa07d6c0dbd82e81a834b676ef5792956f5e5e2ac67e
SSDEEP 12288:EzzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:EzjnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T19D5523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f6d2e510c83d296077e7e43f1530e11dfe0970bc327d1c275c1ceeaa91fad738
MD5 a76df8f0efb944067f09c21849629733
SHA1 930c0c6fa1a7006c57a6995a7974dc45011c5143
SHA512 e943cd285a646c98304a3e2892f1cf3114a46a2576e59f84ba64ae731a1679f50629e91a7b78cf09a07baeb93eae0581e24dc6592315ec05c39ed31685d964b5
SSDEEP 12288:veBNUbTVO86U4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:vJIU4nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1FD75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 226bfef94989535495a6750f27c165d0a47150d99a48f676a818c81acc43c6a0
MD5 4b6874812497bd8757b8772d52895592
SHA1 656354c6ebe955a4d04a8f479b523b99ff7a768c
SHA512 9dbdc8aff4523b48a4c1490f03793a5edf489f9c737141e6b4497445b7df113f8f899c8d6d43e9af3cd8e0e86bd165b48d7043eba1c4fb311f27825db29cc693
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:tQvGAdlCEL8c/yRNw5CCLm
TLSH
T11E267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 053d63d0620c5cc91bc9b887f66881eabbcfda6d4190d4f8bd6a75ca12780692
MD5 b0aa35ec6257a529d0a3f053f667f7f4
SHA1 aec47e84ae41fb6e0d64568938db8492339d4307
SHA512 741292bce1535e317e2301d176a1c334c271060eeaebd2feb008a427763d177e127fc12ccaceb0461d4039538dec88008ad187762999cf147bc9ed16e2b11f67
SSDEEP 12288:CAwSfxL/2Dc39DLLmt0LDQewsAjeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgV:HQewsAjenQ/tbw/2Mkjy6Fr7g0or
TLSH
T13475E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e645095bbda0ea985e35eb7e1432b2fc16e39c2a32e2562bbdb4a53087ab2afb
MD5 2349d38f876e70cab1b7de1b5d0f8c4e
SHA1 b9dabc78e85aefc23ae719e56eb0c3254c534039
SHA512 2a2bc4d57143bb2f7cb0f50b9cb4f7e79c3cafb30f19861d76fe7070bb48e5ce2fc96c7536223bf70d734fcdf52cdd705b958463d775e785e37eb8227eb1cc58
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHBL:3UEtQevvqc2W1cpV2EI32
TLSH
T19A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 acdf0e3e6ca97dd5784774498ffa06198a31626f7d604a34e07e75e97eaf8d2d
MD5 6f68ff6e80bac5399eb44e02d9c072e0
SHA1 9ffc939b2a42187acf1c73c958d47fd489e733af
SHA512 c9ad5e4d4b47e4033695ac482da8c0aa1e8dd5d3bbd6c75e02c2520b87f770c85c558b5ee8db6df2e45f66c03829be222f0cd6c0423d0fdd95ed2c0d8e4b6b5d
SSDEEP 49152:uCbRquA/m2yL5zQfFiV+XenmE3/z+Q/lFTjN4:DoqtVjnm2Lm
TLSH
T1C7D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cc8b40ae56307b998bf586cd0115364336cc49ede25a839eb5c04213aa59e2df
MD5 a0f1abbd3ffacbb5e444ccb1f2e653a2
SHA1 fdd8675e684cc10f98f507c93c4682b4a727ac8b
SHA512 967ea2d013b20fe520b5daeca008e33de9f6d2a399078d7ae5411785225eae65c0d79cc320c138706c126747af519f315f4368769ea82162171fa67af8a1843b
SSDEEP 24576:0AhGLJIFoiwtA5l7S53xnQ/tbw/2Mkjy6Fr7g0oY:0AMyFoiq5BQ/lFTjN4
TLSH
T12935AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3a8ae9f5e990acba40db34888a6c6948b48c7acb8215e6415ef3d59fe4868cd7
MD5 e4d5d0fa8c66dbe8e292a23c73889eff
SHA1 c563a40c3bf89c1981324839633ce6d29b55d22d
SHA512 951aac5101de2360afb061a9f75a06afe288d713f226384e3b1cc658b5cc81f77b591ec62b6577fd350ec408d6cdb17c330f42c8ffe0143316729b88fdefa250
SSDEEP 12288:Jmw5HEjsChN2BFgl0WDm+CdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMp:EwuHOWSnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T13265F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 45c5b436f3dba5760cd8c9e8b55808043d8892d9aadeb0d0f7d519ba4be644ca
MD5 a9f27d1ffa21e67948ed038ebd3a9ace
SHA1 6c0f7a02a1c23e8cc4878c723a171b7ae736021a
SHA512 ca5755fa2b17b5188d3704d7594264f7410eb1cdb1b4e63a9647a19fc632f8764fbaed891f1b9c23d6288946c1f7f6b2176af4210822da94b1dc3ec346bd7679
SSDEEP 12288:rXZ1IyOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:jZuvnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T15055126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1c0ff31b0ce8329d0a3c4a84fec027446355adccb51be1c3e0e78c49bad58c92
MD5 36c743d03bcd1041c3060e70fcc310a5
SHA1 15325497f04e74a6edb6657116e7002129efc939
SHA512 36de5f738551a4bfc46cedfcd909ea37ff9bcd2aa4d51bd5a3a7c5ddccfd4ecce799f2ff69820c31109f8c51f1db2e88ffcfb5a7329fe811283813bf974a0f8f
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:3QRQyi36YOcPQLvw2gAf+PN3PLm
TLSH
T1F2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3c1ef5feacfe6d297fd4384cb87ad009057201ddc777672d3d37afa76f455839
MD5 71d7b8533a287d2012162c191546bdac
SHA1 42686acda6c391a46d3ecb51af04a134e0665ba5
SHA512 5b6078d3e40bcad5437e729140d2ac7c71dff51eca9f0d071c925b9a5a29f8f9fbcb2490b4a2cc7fb64d18dbc5b966a6ef2d82fd13c5bf4edf297e9d6cce2ee8
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:1QRQyi36YOcPQLvw2gAf+PN3PLm
TLSH
T10F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2c7d5f90c216c4a3c1500d6601f1a282ef180eb2455326d47bbbe23336013ac1
MD5 ccd7aae33bcbdda5e55da50b9bfd1a0b
SHA1 6d152bde4c01ad07500d2a96413b69ed9f5d16c3
SHA512 62c14d19e75b283f0b2fe7ea23574f0002f67421db855372b9ad9406da44d71a4be0478e1277021a42345376bf36ce3063a9068aa526154662eef52fa4d37ac7
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0/nQ/tbw/2Mkjy6Z:568Qg55nhheWu7PNU3/uQ/lFTjN4
TLSH
T12CB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 79fdb72cf48407cb6984f01d61248b5363010c21717427d846403809956ed748
MD5 ce79d68154f430b56e02a62eb70979fc
SHA1 700d340d89505477b0ce38cd2183d669aea30d34
SHA512 94cde56b52af53f851c322522476347026c55789d19c345856223f0d851498989696f9d1146e7bef6abaed53ac2c0fa4756e6091ac983ec4d165fa0a9d988e93
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99c:My5112gYy5azzVvL69nLKnhZILm
TLSH
T190167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 62aa3c8f11fd484592385aef1fb3707c7f3d6e06e4395d126cbba4c246f72fe9
MD5 00ca559b48b80c14b52fb3f98f415d47
SHA1 0981f097a98a4febb9216548535f093c382cc482
SHA512 c72a34cbe886d98f00e78148bfa02d2cb792bfa941834cd922e303d25acaf6980c5fc17460e6306f6ccdeb1882ecea3f676926b7f03fa06c44040c63753c2501
SSDEEP 49152:UB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glUQ/lFTjN4:Ou6JmVxd2dHLm
TLSH
T190D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 320e1f3f563fce85ecc95ba21c99ac8c1f344ad3cd341197e79769f30895453b
MD5 1736467689766302542c3bb88b4e8c7e
SHA1 6cddb653050f5f47d9f7e2def8c4a3c780bbd0fd
SHA512 c8fbd38379bf6cdd2b3c547b24b6622ff9989d9e920b005f8ff51fd4112170f3789b53362f90a25344c5509cf1e4be66a99c786246d8eab56ed78b57ec69e817
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4xYQ/lFTjN4:JmifPbR2Lm
TLSH
T1AEB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a0ddd32dc956eb74606190ae9e90ac6e3417018fb35db0cbe76e3bb748060462
MD5 2ed2e8fa666869438deafdb4536d65a7
SHA1 49388ca5acb9832d9866ff9cdb1787825e9a41da
SHA512 fd1530def531ff7c0940fddab12aa3afb39124b180a315a77a2419cc40fc19247f5963ba703d3b7bca1d585a4a0296f0ffcf8af38e90744cfa7c2a68c9d7d963
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqvQ/lFTjN4:S5dKTi61kLm
TLSH
T19CC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5cb8fb88f9cac809b3a53692e26f342288fa3a4e66d9a328a95db62c00ac4160
MD5 34a90af2d7d713eb073ea480f0eba8fa
SHA1 fa784b8bdb3456e0346859bc9831c1c4478bf326
SHA512 3304fb57c51a1451cc22c5af75d69d14a4682f0e5d3baeef56fb6208e1b7be0a0ba0bf7b288f1ce8e9cbf7bf3bda3387c2a940f1297f07ea66c13c0f0438d30f
SSDEEP 49152:7htSn8EApI0figngiDn0AP5wEQ/lFTjN4:aX2iyphKLm
TLSH
T1E695BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cde6729ea56f7956657d3f9f7dd1013b8b16669692ddb102a8887e189fe8d224
MD5 f18f1471b3ee2352c055f2e9dffc4644
SHA1 2bd89a558a5438139a492105b246ab83beff5d28
SHA512 fe04f46dbcb279d2b5fde2949b2dff2f86fb1a0a7ec2dffe21bf323466f49154ed8b11e7344ae5db7afb17c961c3b47a1466a09f038d43293d7a537d1c90ef53
SSDEEP 12288:PbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:PLnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1E35523697965F98BFB1706F18C828182A73F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7a62040aa1e0267684c60b1c4cebd2fe6ead95eb1b49c92d1907a6f2f59848ea
MD5 53633a1204570f49dbbc55cb9ec5a9a6
SHA1 611cdfd2ab13c735007fdf7822bddd559098db4a
SHA512 c4109c52f5d9bb9507fb492a20b2a577d96f2dca89e1b6452aa2f6718fe0b004829bd24de51b3f1af05b4b47394d4afa56ca9bf969d56f1560226a5f85e7bd99
SSDEEP 12288:FqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:FqnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1095523793965F98BFB1706F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 fa26f3a50a01eaf256128fbf2ba712e1f814cb4db1da54424484a6208b30239b
MD5 d381d005622491d89b0a78077613cd90
SHA1 90e7d243c48565001a1539daa3fe6fa6c855aebb
SHA512 009e8bc4105720a39960707a49f46151d982cf6a34196d22af1d4f9039ba48c2e32386886e21e318418fb36dd530b396cf824dc173e10a2e6b65e3e1b836a0ac
SSDEEP 12288:tAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:tgnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1E35523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f2b6f9eff7d2bbff07ebbdb33c0ef634b8742a54ada2e87ba7c4293a221de49e
MD5 18935b005429a2dca9458af51ae3d10c
SHA1 02fd535ae284a7f17d4312d65871aeb667730485
SHA512 b6568bcd285a74e30215a8b2888a2c2f936190227b1654e78ceb97c19ffcec404a432da12b689ad60c65845147811225de7d0dc1050d274a67309f891dc3124c
SSDEEP 12288:8VBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:EnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T16D5523693B69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 67de0743eb63e4075ebd9b740e344671d0a52e77db1b91ec549fba9fd4da1e8a
MD5 cc3c2baa1627190f6557d9770c878763
SHA1 f45fc613f6127eb460f6fc073cef2eedc066560b
SHA512 a84664f3f9067c97f4c544e6fb45bfa31cbf29a2bbfe6758de5cfa3fc6d923ca9516cb2b0a3a19a2757f4aba54da0a6932766dad95058cdce51ab2f41d4d7d19
SSDEEP 12288:o5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:oJnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T18A5523697965F98BFA1706F14C8281829B3B0EC6BFD1A38F7B4C1128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cd42a7bb004841e89a7ffe927b873ee6d7cedbbbceffc28e9184ef49fd26673c
MD5 d16a983995ddf4d3ba3255b652feed50
SHA1 c235ad7bf1cf4785fb8485c812727dacfac81112
SHA512 3a123740d45b7fb5c9eff9d02ea2291ba3feb69779f4dabad3ab1c697a08681c99375bfb56d64b5f51a318a5f76e2b837d9ed97184200776c4f37628a3c1ecd9
SSDEEP 12288:kGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:kmnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1065523797965F98BFB1B06F14C828182973B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e271eeb2ff5d7f7d12eff15498f2ec4925f1ac14ea0e5d0ff3d53c45b314f6a0
MD5 58389ce1c2e949b8792e5e6d180959f6
SHA1 1ee03abefacabd09cb925ea773feefed73d4bea7
SHA512 dabf18a59046f43fd5cd66346e231c0001e9d5be3bc1c57d854cffbc9310a1e1ad502b083dee81fb35f6e680407b1e48d464e3999c2869c74eef25fd11e54006
SSDEEP 12288:3iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:3inQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1ED5523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 81a8be6994a31b91dd6529a650bdb459a011b6dbc0905a9b8050769e28cead6e
MD5 cdd3280d5c777072284a45d11a3aba5b
SHA1 eaa220b9d178de68ad5edb6c99a43a827b036198
SHA512 469fe82deb2075b22781f0c907fbd3cd40950a753be165b736b0919a74d3f6c21e4930503bc32d1748298a9b1cb4476facaa8db545fa708abfc834c008195872
SSDEEP 12288:OiZwbDzzFEoS2cPvyKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:xZM3zFVSOKnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1B67501A5B35068F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bcd6a7ee5c092ed161a0b40e63ed57973f974413f5f1eaf6c341edcc0f4d6bb7
MD5 942acfdc779c782d5a58459876d319fb
SHA1 0b331e8afdaeec997fca63ab25191cc14c25f8e3
SHA512 ee9053fc1f95591d636e117bfdbc2bb343948d6a467026fce60a17cf23a04472627186762338affd5929dd7ce9c45ca43192d724e8d4a6ccf87309106db234b8
SSDEEP 12288:s/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:sfnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T18A5523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3de1d5caac3feeadcb92e17c3877e9e3deb50655bdc22983a27544701a17fe66
MD5 e6b9696f93a2b46966fbd2c673bdf0bc
SHA1 f8f3c903109f2986d32b89c72212b916fe2e0809
SHA512 0838d0f5e728fae0a8b31c2fa80c01a46e38b72be289a5800e265d6c465cc5549bf2503980a33bc89496aded275cbba65e65c483c1867b51c5c82c86f434e3d8
SSDEEP 12288:VjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:VTnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1055523697964F98BFB1706F14C8281829B3B0EC6BFD1A38F7B4C1129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 71052c75f1571d8777ad9cc9e3209ce101ed1d6f7e01a47c977f96b31c597d4a
MD5 401c52af95bea9b49528263fac282e31
SHA1 0755007cbc09dbdb9c7059fb8df05275e8ca0b82
SHA512 48e7036f36c9882d4c791ea390647489fc4d7dddda6f8beb3a16310a9f2209e00b0c9edc8a56b5958beb748a62f14985451e56780b6d411b2d91ff1ba63358e1
SSDEEP 12288:kyPz5L8OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:9zyOnQ/tbw/2Mkjy6Fr7g0or
TLSH
T11C65021773A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 81a0438553ab0e7a45e7fafb48a5144774fcbf7552eb48d8ed0b3728e4adf57b
MD5 67918146718ef2c551e42092d5fd25a8
SHA1 5afca3bd1cfd8585579c9ab69894cabc47755d5a
SHA512 d3a86ef37ba5c85283b444c090be41254f0efbe58854c6d4d853232102e4c0fc4578936ec34930b9505eb88b5748ef1a0c0ef261083b4251e7c1cbc88e7e7374
SSDEEP 12288:a/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:afnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1535523697964F98BFA1706F14C8281829B3B0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2d80321f47379bd3c5c8fc7bc8d4c3053027d012b8c8b4e0a335ec4d452d079a
MD5 3e5291c92cae29fdf4f719dc4afa82bd
SHA1 894b3704f730390649548feb9201148aea167b4e
SHA512 616fe77f236e2490c1076ed3c36d03490d9a91cc34ab2582d0eddb3e71c92b01480ee06a3dbb4f0fb9fc6d2360a8e0731e36b04e3fa63227d03f5f3191bf6b37
SSDEEP 12288:y/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:yfnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1FD5523697964F98BFA1706F14C8281829B3B0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f10e9895f801e8dd7e931326e94ae374d0687fd1d7763494fb1d2d7d5dac4ee6
MD5 2ffe2151eb1596c4bbf0b0d7581e9dd5
SHA1 83aed5aef74030abbcf085e9bb697c98c27499ba
SHA512 11d8ac1078af280ed3fb3776e067a744e75c12808061242baf027dd738f185ccdf404cff727d0fc4104d18459ce34f056c0e0c035ed0cc0ab843809c47a89b74
SSDEEP 24576:WCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA8nQ/tbw/2Mkjy6Fr7g0oAR:WCUxPTY+8Wg2lIL8lrIUJLWwJQ/lFTjl
TLSH
T16D65AE1EA3EC0896D4BB817589518A06FB72382E1B22D6CF2160C33D6F27BD55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 07eac663cf0b68f9d3e6a4527e8b2481b61445361a207a01537d5a773a5206e7
MD5 2901fe9923a53f0237511dda97b2f0c1
SHA1 044ee434a9bd2a1df45c9b5d3a4d3d4233aee71c
SHA512 c0e7d8c0b2eb5b1f072fd5fc3a575e2376f478df1afc904285dc38318ea93087d81f7bd762e6ec6d03029f50f87ca1896562830ada757378a399f94ef3536d77
SSDEEP 12288:/ssfPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:TvnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T16465F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dc226a41d4619736446192f3b9efb62650babfbfd2381cd27b6e02f8e96bf405
MD5 83414dbd2b7eb602343c0206f10c1db9
SHA1 369d64c3a40792360d7fad3abf8393c05c17cf9f
SHA512 ede5c12d5a790b84ac3d8173dbd27a9074c9f49b3187dc895f95fc592a1b1e7a638eb5f45e6df1d4b3be51cdf93e70b191a37de0c92bad0040496f66abf77177
SSDEEP 12288:GgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:GAnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1185523696668F94BFA3B06B04892C111673F0EC5BF91D3CFBB082269953C3D41EB6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e817a941f09ad6eaf93afe86c936a18ac50e696c33409b646c52577d4d89b761
MD5 c12f6d0a0c8d0ad14b050b23b5899595
SHA1 b5557ec4cfc1303989d8074275c00474ac22f861
SHA512 845d7da0ff20d94e2d7bb81873f7b386c2df09393c2c044951ebf54ae73f2c50873c5fc97cda6a17f826243253b9f6e17fe00b35266a740bb1a706c652e2a576
SSDEEP 24576:E8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC+nQ/tbw/2Mkjy6Fr7g0o1:tRZwQCyiHiQEaaPnMHQ/lFTjN4
TLSH
T1F885BF1E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 6cc3254346e2d67e5d486de8082186285735a0601eb94be7d043c50938c86ea0
MD5 b1a9d72bffffa1852901c97dfae96330
SHA1 754274949103892b7d087309ccb860330b511d42
SHA512 a28e2ffc8284ecbb1a870cd9056a965aaf64a8f5fbd41950c28d26a0aa85b4997bc8499e71217e3e6947fd14f425f718e3d620c6f72f81d6df988124b7b70673
SSDEEP 12288:6bxA1U7KQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:6bxA1UGwnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1E355123E26AC34E6F636917988D28106D3327C56676193DF2684823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 76dbbf8fe80b0f4ef7c051fb230e0194b1a22e81d35629abb70a544a0f7b4167
MD5 01d226e92cdf9fc01814f329d74e42ae
SHA1 19d172a2a020c240f59f4e2570df8671f20b22d9
SHA512 819fcaa3b6d49d12d88d99717cbff96ae23ca2e5d35a9997452177e7a4d018358d51c0c3f0d89abdf854476f26dd8690f38c2119ab1910e39b99e2a9178f64c6
SSDEEP 24576:XjsmP0yHaqrVqHra44KDzMsrnBnQ/tbw/2Mkjy6Fr7g0o4:XjRP0yHfVqzlAsrnBQ/lFTjN4
TLSH
T1BF45AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 e902a995d540c8dd22729e1d9db55a9b45f4d7afec0a4416c5f21bdac6099397
MD5 8ca4d70e51c42afb942e46fe55313a0f
SHA1 3cca0c2c9713c3a31114e3d6fc79c1aa895bedb6
SHA512 dd45ef9bd6ac4b847b95692a2ed9c7c20dc6c157c1a516823d559358aa955208e191ac5c98afa15963d5f1b09a45a92ba89ee2092c09e37df6a656d70384d0aa
SSDEEP 12288:CmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:CGnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1E45523697659F98BFA2B06F548828142673B0EC17FD193CF7B482229967D3D40AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 84f60e793ecdd63304665e799780129f4f7ea2bcc0d453bd3b593af432ffbd3a
MD5 05b8df1b334d45ebca7642adff4d3807
SHA1 a675a2d9ff6521f08b3247df30a5aaac4b4c5413
SHA512 d4d37b97425b55e4632032c96b366ff1261937e86a35619f895d39f10097dfe2bd61b1f97acaf534e9ce98c2123ecbe195f3b3f2e4c0935c4e4cc1147b77072f
SSDEEP 12288:9Ob4A4LWO+vAYFTkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:awLBUTEnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T11B75F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9089cd95f29e2d824c6511c3c336f3ac44137a01535a473bc38ff643b913db55
MD5 a0c1c0ff81ef46e53322e5ae106729fa
SHA1 56c849d97902afc0f662148af583d9f321312ac2
SHA512 d16cb5697245e3f2d8ea00c7deafffa92ccbc5973913882529522e0d44ac6841113dcdf19871ce22777a8597df6738df9328ca948050df45584de1dbdcdbab9f
SSDEEP 12288:G70VmuIYNvUyBprGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:XKYNHVnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T16C65F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c694f728b092e29d6aae09dde15e8ae2b6a3291046c0e84e13919a7eae69543b
MD5 92422c650539199f01080a282b489beb
SHA1 8e1691d492a45a28ca620d86321702d25d2f7c5e
SHA512 44270bd7b6b82865292abbc889da511053af5c799bd8de6f2616bd79abb92a37de1d567ae923a45cad48318d3b88ecf3cc8628c2afc31424433d5b0ea48f9e02
SSDEEP 24576:TnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKi:TnXoJJYH84VVS6AmEcJas+cHBjSSKHP4
TLSH
T1AF65BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d61bc0677dab86734ec77dea184b50da17df46526200e9acd1fe52cfe1ea5fa3
MD5 338346547e26f61c8bdd1a719d31eda7
SHA1 73c9f25225df65806e7a54b6aae9c297d26d8b4f
SHA512 fe1183ec8ab8ef328a3cf983c283f38d65dbad3a1a3870ca57106a20638bf2a3d196eaabb6f234b91255c47d9dfbab84dafb19714fb6f184bf7916945132e06d
SSDEEP 24576:Jv7Xbxd9Tuycf8M/TYlSuxwr2PCDnQ/tbw/2Mkjy6Fr7g0oQ:JDLL9TuJ0M/TYW2PmQ/lFTjN4
TLSH
T14C858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 1775a7364463316f270071af0841eb3df884a62a390e9af1717f323067f884aa
MD5 1453d730664bc80fe8bd663b9e7af89c
SHA1 03a985a55aa2237e5bacf735bc65fba03571d711
SHA512 25c2e35b672582f9f6a9e75f37fc104032a976c68a6d57b6252e89f8b2b817c6f3ee8402683121e4b3b7b75a54b3b0f92dbaf652b2be60eb49dbe8b1204c59aa
SSDEEP 24576:9egJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wEnQ/tbw/2Mkjy6Fr7g0on:9ngOJOmPOHhEQ/lFTjN4
TLSH
T14E55BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 c7b867ce5abdccd4f938c7576fbc2c36cc198270303bf7f42b797dd1b9957910
MD5 69bd06f34974a2d7e111c6853f0633f0
SHA1 19c3e69a8a4de4482b8906dee5f8f08991200be4
SHA512 5ec323a3ca1a3ec5cc729ecdca9788e36c8bd2e0e508f8356154810a19ba8103e6ae21da27477c140ac10d73412ef24e30c301da671117ca5b9738512960d334
SSDEEP 24576:RLJnJiTk3R3waE4JrOmnQ/tbw/2Mkjy6Fr7g0o4:RLJnJK8R304lRQ/lFTjN4
TLSH
T1B675D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FE06A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 de3c0b5dd9b930774853e0312f0e0ecc93df3c42de243c4a7c4c238dbf941595
MD5 447e6abfce1b36f5aea306d3ff3c601c
SHA1 5a535a5c528229d330b406d11f21e179121cc012
SHA512 b2036fc3588251bdfa85abf9e4a2098c50ca118c61c1d1610ae3ac42e44157486e4a13201944c62e37c3188c86d510a0fbc8dcc99dbbbed0bbf84de03bd75fc9
SSDEEP 24576:HA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6psnQ/tbw/2Mkjy6Fr7g0o4:g9GqCzDScAZmlvTcFg8Ph6iQ/lFTjN4
TLSH
T1E2955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 d4cfae1d3771bcac012fc8a117aa1a7a25ff9e208c0eceef04278c5a8858a354
MD5 fb275185725f61cc96d4e0d561278f12
SHA1 5d77e37f82163eddea920bc2339d75b8674f0c91
SHA512 7b037d997a1fe3e257bb339c4cc10753fec53ab3cb9b1829f2935119f43934beecfe031126c530909624ac4d9215ad15cce38ffa06f8049be721c9aa13928c00
SSDEEP 24576:0lYJeXm5jUuE0nQ/tbw/2Mkjy6Fr7g0ot:0lYJeXmRUuE0Q/lFTjN4
TLSH
T1F455126D36ACB0E6E22F41B988924545E372B4A1274163EF62D0C17D8F7B7E51E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 3edfb2d4483ab7609b6f61c8df07d8a371333c138b1cf95bff574e4122836cee
MD5 db4ef073ae8d2981f79eefa6487c3ca0
SHA1 762d33009ec61e69f00f03a175447610fddeb3ff
SHA512 ab25e61e2705c828224a4fb866b93b8a7be05948d391aef2c0099939500b91411b965418ae210804eee275b0ae6984d1c1843b92d0410b68393aa00ab33c020f
SSDEEP 12288:GFu6kyRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:GUtyhnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1AA65121833A4B4D9FA7A06788DA381819F3A7C50AF5093DF66C0E23E5F3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 6b8cf2ef58435381ea2b83248b115eb45a7f66ee41f464b0aea538e187fb22d0
MD5 9235802b4af6bf14216538f3b3767d8a
SHA1 09079a7d02b6271b12cb8d857d00c56e81a4ee30
SHA512 dcc1031c134c81be7fe4607ae516572520c1db0c44f7d41c5f12b85531845459828537333643d8fca4830ab3fc0e5e2024be53a3401152c3d6e7b0a8ac33623e
SSDEEP 12288:4PkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:IEnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1BA55236C2664F49BFE2706F448524142A73B1ED17F91A7EF3684A139CB7D3D01AB6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 bb2c0ebca4091098902e4c9d2be38d1bfc571ebc455fff76ce36839de085c0af
MD5 692adac6a3332bb99de43e56eebf0396
SHA1 f8380fbb7726b38c57e7f6f6057e74c16fcbcfa8
SHA512 073ff0809acfd61745caa363cdc374951d7a7f02d23d14d04e0e5f06d5156fb0765498e9c37502a99d30c8f6470bc540dec4ab2ac701429a42aaecad000693fc
SSDEEP 24576:ZC+TyQIu93VAumZr7jmPnQ/tbw/2Mkjy6Fr7g0oq:Z/TfIq+YPQ/lFTjN4
TLSH
T16F558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 1248872e85ce319c88638b9f9aa16ee9d327edf47914b0b6500c322e11d9c7b0
MD5 3d1a9b08e6059886144d57bbf0a87bff
SHA1 eacc8736ba667ab08c6225983179f3229db89497
SHA512 5899c53b850a842b140968f07ac8d91e1372fda1106ea26f58db3b319327de3f2adb1bee386cc69195a89d7ff0b1d9c56ed446201f11cfda7468a568fd5edfda
SSDEEP 12288:lcyrWOstaa3kcsIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:QLQikZInQ/tbw/2Mkjy6Fr7g0o0
TLSH
T10D65F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d30b3fb862aec9efcadb9a2bb37cad2304135b5eb20a7ec537ab511880d9cda0
MD5 e0591b47a3c705bd7aadcdb3209456ab
SHA1 0b21a6fa92e429e1ef5cddd54a1e7638b9936d46
SHA512 4c13f11b2d5404f03b67d7152c0ecf3e1b82cd34b741a9c25eb358031bf79244ec6426ce2926ad0acb88aba2dddc4f05b821e9f0fc10cd82594b1fa52dcc42ef
SSDEEP 49152:ipJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPhQ/lFTjN4:fpC7b4+80GTkVLm
TLSH
T12CA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c464266e468cf4e32ce5126a893e13f5df8ec5beb204f12a6278c0a32b57ab9b
MD5 37a4578a1dccbe136861dacaa76bf11b
SHA1 1f3a15de4f2f60ed4922cdb4661d43555cc3bcd6
SHA512 c687416db662cd02a09d3cce475195852f6cd2779992a40ddd47a5ca76ac38433abbdde15a0f1404fd796c4da8c3e122e23a99c28546fcbb71d030b5b1e4b267
SSDEEP 24576:ESAwJPE1IDAo+4Kt+l44135UQpnQ/tbw/2Mkjy6Fr7g0o+:EqPCIo4Kol4/QpQ/lFTjN4
TLSH
T1A255B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 d360f037d37835bfcd14a2e4072fa3c58fa18971ad24083d39bc0ddb42e462dc
MD5 519a3f6cc90835bbaa47b541cd4cc103
SHA1 eea79b622c02df9da797121dcba282374a41e5d5
SHA512 59d4c183218837b09ace092fba898e4cab8131870323a313f740d1aed241b604d9c2f44b0b0b4529401ef6c26dd6051f2b1ae4db1e10fb902979c9e845986a51
SSDEEP 24576:YyLXPLcf94tZnQ/tbw/2Mkjy6Fr7g0oU:Yy7PoetZQ/lFTjN4
TLSH
T13575E03EE66C08E5E53AC27CC6A38506F672389D037166CB1A9491791F7BFF46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 7ce690c4c1b6534aaa363126fd94bc927b808b4ba52ec1b1a0b10fefda1a371d
MD5 38281a3323a94ceaf2d8faa2f176cf8c
SHA1 16b3ac1358c253484f3e620407d02b8354933fb0
SHA512 5537433b64cc23b05ffe71ddeebeba6018d6c7b5e079aa529ed3888561af05ec4483cb5f7178ac4de6cbeb26754eb9de2cf876105f82608c478a4e43225ba8d7
SSDEEP 12288:x9lyvj3IkxjbBzYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:xWv8qjpYnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T18B65125E26A4B4D9F53A0274D863811692727CB227A4ABEF76C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-127-0x0000000000400000-0x0000000000BA7000-memory.dmp

Download

memory/436-7-0x0000000000400000-0x0000000000BA7000-memory.dmp

Download

memory/436-0-0x00000000010C0000-0x0000000001126000-memory.dmp

Download

memory/436-5-0x00000000010C0000-0x0000000001126000-memory.dmp

Download

memory/436-420-0x0000000000400000-0x0000000000BA7000-memory.dmp

Download

memory/568-384-0x0000022615660000-0x00000226156BD000-memory.dmp

Download

memory/652-30-0x0000000000400000-0x0000000000BA7000-memory.dmp

Download

memory/652-153-0x0000000000400000-0x0000000000BA7000-memory.dmp

Download

memory/652-410-0x0000000000400000-0x0000000000BA7000-memory.dmp

Download

memory/652-14-0x00000000010F0000-0x0000000001156000-memory.dmp

Download

memory/652-9-0x00000000010F0000-0x0000000001156000-memory.dmp

Download

memory/1284-67-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1284-71-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1284-85-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1284-61-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2064-108-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/2064-103-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/2064-150-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2064-378-0x0000000000950000-0x00000000009CB000-memory.dmp

Download

memory/2216-33-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2264-468-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-463-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-456-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-458-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-459-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-460-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-461-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-462-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-464-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-465-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-466-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-467-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-469-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-470-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-472-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-473-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-474-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-475-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-476-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-477-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-478-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-479-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-480-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-481-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-471-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2264-457-0x000001D356C00000-0x000001D356C10000-memory.dmp

Download

memory/2308-46-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2308-168-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2308-372-0x0000000000730000-0x000000000078D000-memory.dmp

Download

memory/2308-38-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2308-44-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2560-146-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/2640-151-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2640-135-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/2640-381-0x0000000000E40000-0x0000000000E9D000-memory.dmp

Download

memory/2640-141-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/2688-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2688-369-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2712-169-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/2712-380-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/2932-375-0x0000000000DE0000-0x0000000000E3D000-memory.dmp

Download

memory/2932-57-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2932-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2932-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2932-180-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2948-130-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2948-374-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3092-87-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/3200-147-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3200-125-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3200-379-0x0000000000C80000-0x0000000000CDD000-memory.dmp

Download

memory/3200-367-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3200-119-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3320-373-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3320-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3472-27-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3472-21-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3472-371-0x0000000000C30000-0x0000000000C8D000-memory.dmp

Download

memory/3472-32-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4008-83-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4008-86-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4008-376-0x0000000000D30000-0x0000000000D8D000-memory.dmp

Download

memory/4008-77-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4100-92-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4100-98-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4100-377-0x0000000000C30000-0x0000000000C8D000-memory.dmp

Download

memory/4100-128-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4408-368-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4408-148-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4512-383-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4512-201-0x0000000001FC0000-0x0000000001FD0000-memory.dmp

Download

memory/4512-185-0x0000000001D10000-0x0000000001D20000-memory.dmp

Download

memory/4512-181-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4512-172-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4512-178-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4512-382-0x0000000000DF0000-0x0000000000E4D000-memory.dmp

Download

memory/4512-223-0x00000000021F0000-0x00000000021F8000-memory.dmp

Download

memory/4628-47-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4628-35-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4752-129-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4952-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4952-156-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4956-370-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4956-161-0x0000000140000000-0x00000001401F6000-memory.dmp

Download