9316b63a2fac6e6b28a6460564d4b11916a3d70e2cbdb2d35601dbba5677f1b7

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Size 17.0MB
Sample260527-r13sysas9v
SHA256 9316b63a2fac6e6b28a6460564d4b11916a3d70e2cbdb2d35601dbba5677f1b7
MD5 ccd0842b85c7cbb002fcd1aed6df9e17
SHA1 bde9815e6b431988bd86a3192a71e71994a1998c
SHA512 ffae76ad1f0b62861044a6ab5c42eddb992fc76f194547e3c071d33696d1293820f0a689da30887abe4c00147c1832041937f7eae5f7fe43fae91ce3f05fd3cd
SSDEEP 393216:BQk8iM4Uwu1xxW/YovvlvmLlweFKTpg9a2J:BQv5hEv6lwBpg02J
TLSH
T101079D033241E0F6C547A1B4794EE77C432596395F214EE7E2D09EFD6DB26E21C32A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2848	alg.exe
2636	DiagnosticsHub.StandardCollector.Service.exe
2264	fxssvc.exe
3152	elevation_service.exe
1028	elevation_service.exe
3488	maintenanceservice.exe
3916	msdtc.exe
100	OSE.EXE
1492	PerceptionSimulationService.exe
440	perfhost.exe
1688	locator.exe
772	SensorDataService.exe
3392	snmptrap.exe
4212	spectrum.exe
1668	ssh-agent.exe
4504	TieringEngineService.exe
4876	AgentService.exe
2464	vds.exe
460	vssvc.exe
1320	wbengine.exe
3920	WmiApSrv.exe
3800	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ecdab9fcf77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ec308d5e6eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0fb41d5e6eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000272f16d6e6eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7dfe8d5e6eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0e82ed5e6eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000871a0cee6eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3967dd5e6eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b5aa1d5e6eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077d7fcd4e6eddc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000414a99cee6eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
2636	DiagnosticsHub.StandardCollector.Service.exe
2636	DiagnosticsHub.StandardCollector.Service.exe
2636	DiagnosticsHub.StandardCollector.Service.exe
2636	DiagnosticsHub.StandardCollector.Service.exe
2636	DiagnosticsHub.StandardCollector.Service.exe
2636	DiagnosticsHub.StandardCollector.Service.exe
2636	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeAuditPrivilege	2264	fxssvc.exe
Token: SeRestorePrivilege	4504	TieringEngineService.exe
Token: SeManageVolumePrivilege	4504	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4876	AgentService.exe
Token: SeBackupPrivilege	460	vssvc.exe
Token: SeRestorePrivilege	460	vssvc.exe
Token: SeAuditPrivilege	460	vssvc.exe
Token: SeBackupPrivilege	1320	wbengine.exe
Token: SeRestorePrivilege	1320	wbengine.exe
Token: SeSecurityPrivilege	1320	wbengine.exe
Token: 33	3800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3800	SearchIndexer.exe
Token: SeDebugPrivilege	4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	4684	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	2636	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 4528	3800	SearchIndexer.exe	114
PID 3800 wrote to memory of 3720	3800	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2848

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3964

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1028

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3916

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:100

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1492

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:440

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:772

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4212

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1668

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2028

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4528
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5faf8161b174b0f3bd6fd130da5b7f06d43a54bfcf3a1d1ca4d7184527ee2355
MD5 1f72a4d9f9575bfd8ba17c71993514be
SHA1 b6c4994925da1a78a20fd4f94ab0bbc7d2c082c7
SHA512 e1e871ef52c6747f44987c33e3a8be2a87015c231f80544517c29bfcf8510208b57cc1294f7b6d3af6b79a7f4b0182b821f330e8dc6529c2279aeb632da2cc60
SSDEEP 49152:sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnnQ/lFTjN4:W3q6HjBzLm
TLSH
T149D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b1468f4de353c041a6bd872d8d698a64abe2acf74c9df7e192cc57c8d87f699b
MD5 abe4249c73c0cb469896ca20a4fea5f5
SHA1 782ccaad7c7eb40ab51de67013a7294cd250d2bc
SHA512 f308df82ea24dcaf5eb64ecf5085791ce862461a118411daf8ed139b7d792c7b6023ab671419f295d94fadcd5aa2ae8e1f092999b3ef93638abdb416dd24954e
SSDEEP 12288:L1XLsswWkxy2lRq2czAMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:xXYfDtczAMnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T17D65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5a7c5890b14c573a0f16daf5fd23272b81390f07bfd615f9e6da478fd492519f
MD5 db2f3d55a5e8ba038b2e2bbe278dcb3b
SHA1 5fac52bf96474e71f3e76eaab24f5486c2e41ad6
SHA512 cc511960b861b95f893de7e5a6336c38507c4f14c757d04e43b279216028cd463c9c998be19a8f79860ef5986c2c761727a0571dfab371469f3dc640a1082ca7
SSDEEP 24576:a0Le5ji0hmxLrMPnQ/tbw/2Mkjy6Fr7g0on:aPji0AlKQ/lFTjN4
TLSH
T16D859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5b02f3d3563392dd2cd59fec25bee85dc6da058fa97fc03c7f3df016a230fa25
MD5 a512f38829f5be0fdc6558a017fe065d
SHA1 95d11ff7a5d4ab56641b417a69a34a292a949836
SHA512 1b1a996c80484907ef1b9292082590fc3fafb5a395fd3204dca786b8d3b38591533509dfa56f8584403674f0ea80af9bc2b3463039d7bff3c6ff6cda21e12cea
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWE6q8wyuJnQ/tbw/2Mkjy6Fr7g0oA://ezSC6vUzPvxHjy2Q/lFTjN4
TLSH
T184755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c22a02542c4a99b1c5c3ae148fed644e8dd8ab7959dc4fa4fe376503bb1fefe3
MD5 2f6faf5e6789145b229da8d536eb358a
SHA1 237135cc01cb5a1cacd3b0d346c63293565b401c
SHA512 7bbaa0b96bec123217717866bb45699df72301009a3faef31ddcf391bbdcc560a03ca27ae9993d6f35da3e0c2bafb66dceb63c2683f56f9525bf44a150ef275a
SSDEEP 24576:DVbqPb88hv/l+6wnQ/tbw/2Mkjy6Fr7g0oh:DVO88hXl+bQ/lFTjN4
TLSH
T1D7559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 eb5413e3e5ee3daaa7a90eb97666af0ab949083d6e22a870a898f559a5cf9f1a
MD5 11f954c510e52165fe493ed154c3f345
SHA1 1b5f8ce36cf6acffb03b9293314a729370707e0c
SHA512 92735376fed2a2c9a64fa51f46dca1d2f55e585900100b5ab0ac96a3e2933494d840b73317c8892da18e516c24dab7c9edb3366080c46d904852084633aa4e78
SSDEEP 12288:izDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:izznQ/tbw/2Mkjy6Fr7g0oD
TLSH
T12C5523696A24F897FF2B06B15CC284826B7B0EC1BFD4E74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 12aff174aec7c6937e64520730f6fd64a1bdc401c7e201349f9487813e6a62f3
MD5 dba878246c2347e13effad12b8439f71
SHA1 230a678a9718c5a764af47fa522ce813ea460716
SHA512 864907b57925aa16dcb4cd17da108108c256ea1eba091e9f835da7c71295e4f0e1447350cdcec31047b7d1950066754e077939563b33df1e7e83a25f99e6a0f1
SSDEEP 12288:EeBNUbTVO86U4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:EJIU4nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1E575CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 362b15668da8f285aa37b3c0e4b5facca0481b1a1f7b70c478021dfed2e5495b
MD5 8bab15b8ca3a3e6ac044d1effff7a981
SHA1 f3afcc8130de8fc6633fea5b2f5f2c318df95e17
SHA512 f21a3e033328067313aab8400456f201f43636b77ffcffcd16e7369028298c63e9557a56f413e50dd7a08c90d09a6bdf9344b1d08f9566364500976016abbab0
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:OQvGAdlCEL8c/yRNw5COLm
TLSH
T104267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5b64584ac35c7fdc10e0c3f92a781b7eccfff4d81ca990832d918eccb7667264
MD5 5390d26b6a2e89661d39e24ef681082c
SHA1 8c2febecf1137b93f665158f0681e537bb25aa95
SHA512 6aaec86abec7cf4cea0d10dcdad11b511b55bb08f16b615d4de401750b9b4cacb2d35bbb895e6b4c4a7e8db010913ddaaa863adee40b9ea87dcf5251a15164b9
SSDEEP 12288:4AwSfxL/2Dc39DLLmt0LDQewsAjaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgE:dQewsAjanQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1C175E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 04aaf935ed574fcbb88b95e1fe73c9751eb00b76f58286826826fbcb63736a32
MD5 a927a1b23eb69344012ae85ac37544d2
SHA1 70d5bc00235d09f61b89d8fca1249a24c9fad6eb
SHA512 01103cb99830bd10a187c2080491bf63d5ecc7f7444a35c279cff16a3a0851784018360de0915e01f85b00a569543aa1152f1594c6b6b2b23db5d152ec31b5bc
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH9L:5UEtQevvqc2W1cpV2EI32
TLSH
T1E5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3d922f857e4dfa014edc6878c4e543b9a3d88e0547ddc6aeb626b359b47e9c87
MD5 30933a4aff384feada679d32b4298e01
SHA1 5c113ec0018855d1d057fa721e5cbec590b05253
SHA512 52cc1ed513e51ba6e5f8b59038599dc5e83ee9e64c80b904c89b8196833481663d2e14e64d16de8f9a0830a1f9e17c3f0b29ddc2586283cbc41d08d2a3a4f387
SSDEEP 49152:8CbRquA/m2yL5zQfFiV+XenmE3/z6Q/lFTjN4:1oqtVjnmKLm
TLSH
T169D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 23bc310bffc634d92549514c881df75afebdf5c799c0cf17f7f7d8b18f0d823f
MD5 7ccccd8df3f53aa0af0745c92079aa0f
SHA1 f3938c57edadc1fb8646b8bfb17732ebdb84ac75
SHA512 2ad51559922de759f1d8624c961784c065ea4b5c335129748b988bb2cc6e3d5f7c8a7a93ea532fd89be0dcbab4f5f39d68413149d682ecbe260538365684d9a4
SSDEEP 24576:DAhGLJIFoiwtA5l7S53FnQ/tbw/2Mkjy6Fr7g0o1:DAMyFoiq51Q/lFTjN4
TLSH
T12535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d7f06431cbd0e98b8fce8d6402cbc419756cc144b056cfc420c14e7f95e0f277
MD5 fc9d6eaa6f89c08421c408c1e92e4bf6
SHA1 2b17356484f5eb2c654e9c09ad5579273a6d62cf
SHA512 4ad551531a8d58d88826d2296cd2192c6bf570e606ba638b7b78a0f7b31d1fcdb965e86666f2e8d80fab358d87f18ab55e0aeae3508b897e2cc09ab829da9151
SSDEEP 12288:hmw5HEjsChN2BFgl0WDm+CZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMh:8wuHOWWnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T15165F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f202fe2ae7892f4376e763d1d0c02624d1282154db88b11451067307a10e8779
MD5 81ed5892b4e760ae941555e559c197c2
SHA1 2bcb8e7b3d69df8bae3ee2b2fd5886332c991ed8
SHA512 2fa16735b280f2bde772b6e28a9f14dc3f414e00b9da91ac4b4a6177b645e27753b6b6fc892c769e6653f66429052e1ce02beff4bf537ca9120d045334703a35
SSDEEP 12288:gXZ1IyqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:oZu3nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1FB55126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c3bfefa47f197e2ca6adde047435f2089f295c3c869118c89dbf83e729f78061
MD5 fdf99e47f3f1dc2f951d5875ffbd1154
SHA1 25696192833915606eb004a76d1ada86ca24016c
SHA512 333e518c0b54aefca5621ea1d3d9c614d88db0cf61252e5660410a7b5e4fb9e653648f6f3b822f8d95c95cbb19a73aee3d4747bd0f2b1170a8006781b7f1849e
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:TQRQyi36YOcPQLvw2gAf+PN3nLm
TLSH
T155667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bb494db41ca13ffe320e68f532cefae7c25bfba6ed410b0081635b84628b7c20
MD5 ef27d2ced96110ab840cab893c820b8a
SHA1 04d63e909de5e1970cdacc3eb53b1a7a0adf4e13
SHA512 9cf495b956b1e49ba382f770787b29062088667c1186c0fbcce246bc944c05474897aa2865dd382d6298c86fdc69acabbace10393498231cee333c9f43b9133d
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:yQRQyi36YOcPQLvw2gAf+PN3nLm
TLSH
T1C5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 53d7f6376db704a71ed1682587d9a399c98dffb649050e11ff083cb68865f52e
MD5 6565308a58ce3c778cf98e3885f51a5e
SHA1 fd9d7c671a00b42ff0b076e5bfd3d0357029f371
SHA512 3a8c63240692f262e9e652fbbf9a2ec0785d13690d931b6da0d37146e977a79a530127ef2283b0c1f91b8a4383b90d1f95cf7a8c64b40d143bafb2fc67e54438
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0nnQ/tbw/2Mkjy6J:Q68Qg55nhheWu7PNU3/KQ/lFTjN4
TLSH
T19EB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 149560d36eb668e674b1bf870e0bacf2df3f089094d94c2e8fcb67119d69d1cd
MD5 f9069bae93aff56a81d20cfcd064fd43
SHA1 c50634cc15cc380acbec992fd39f931a315a3ce8
SHA512 e4069a5432f47a23a9351a1a9737331156aba48007061490e2d6e3d10de2239badc54593e150f1cec54c4349c2f70dd6b1f38775ce7fd176e7ed400313c9dabf
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99o:Hy5112gYy5azzVvL69nLKnhZYLm
TLSH
T1BE167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8a57d532ed555d7ee7dc55d92304ff87145659b96ad45892bbd46ee46dbfeb1d
MD5 1c6d62e002a62210a8a320eca2a28d78
SHA1 a0039082c7fcc76c49dbf8216b8f7e9d2b58e881
SHA512 f97b16a688adceca0432edb0e227d75d2980b3617627f97a82e6690867126ed09bc85e5daf2c3b826097fa7e2c61a9b7ea1cb95ab28001505ff317bc1bd21a46
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl8Q/lFTjN4:3u6JmVxd2dfLm
TLSH
T1E4D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1c4af2ad3fc1730103caa259317958510225dec6598f75de388ea943d696ec1c
MD5 dea4b70e8566b59a113c9234704be778
SHA1 0b36ebc2040148126d3618e13a9d8170cccc66c9
SHA512 052da29f7aaf034d99e3a90ca8cedaeb44bb2269ac585bb49aa0ea8440c6261274401abe131866583eb076e4d3bf640045a292180fd292990b5e45afbba10a20
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4xYQ/lFTjN4:hmifPbRKLm
TLSH
T19AB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6d6136d60318b80ccb1b4102216a826de4ee9ee53139d86f68c6605b67f7d2a4
MD5 d9b2818e7fe816ecd85b9200b62e7764
SHA1 622382abb25fadd1390f122eaa3bfd6bdb69ab86
SHA512 e76e3c07c87510a7f92d7c3c6632db4e4cf65d89d7c99d59ad291c91c4a1ddcb56fe17f7a5af75b01c8be2d4b2540383af6d2d3df22a9eaec87b53d5f1c49f80
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHq3Q/lFTjN4:w5dKTi61cLm
TLSH
T1B3C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 43ba6e0842def539e9ce0914fcfb591821e21cafec9fafaf015774fd69cd7846
MD5 a61853d909a159abf193987be3b5c360
SHA1 f45a65377f770180d81b1d4135d964f45f31c1ae
SHA512 091fd8c6dde3ba2d36eb26cab5032ad491f6405c4b3e3fd51bcfccd378944bc7225af9e0100457bff0c1aab7e9a5095e017a6dd0b178e75e401bafbf9de57e50
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wMQ/lFTjN4:3X2iyph2Lm
TLSH
T19695BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 532a2b713aaf604b4e5abc6b3504cbe48dc7819e322bbfe6fe3ad6d4453cc8e5
MD5 0ca97c23946813bc15adc614d64fbb77
SHA1 e83870c5018332d79b5191265590ab78e07edf7c
SHA512 1f9c7b647cfbd2a93d4a5536cc5dad11405945c63d9a41b8e56be169d6ac41ea92da3936196b020e91c21f307da923f75dec651ae27ff8397c4d24bf2231bd1f
SSDEEP 12288:BrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:BbnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T19B5523697965F98BFB1706F18C828182A77F0EC6BFD1938F77482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5bbed009204a8e1c7111d1c0d2080c7f2c576045b26d07e5db3a053eedde785a
MD5 8565363e0e0ec2dbb99bbe91b407396a
SHA1 a7a036086e37051f65173efdfbd86ed1eaa701d9
SHA512 32b36e65b0a70f9017e19b1c9d48509c169794b91f7668956fae305d2e8e4f1bdcdba3958c9aa5dfee47fa158d2c917ce2ee5ddaede7f83671a254dcfa192c1d
SSDEEP 12288:JOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:JOnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1915523797965F98BFB1706F1488281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 598c4955c039c4ab769a59fd127ce06a1dae55c9318a4a71a6ad9ee13ed04629
MD5 645fc398c140553cb348504325243a01
SHA1 62476f91dc81152f84f7c6c5808926f1212af3d8
SHA512 6310839b05cfa6d67f25a72750fdba638dddb11bdaab68b69fab24f8c4165d1e9b70d5e2f3ff4b074c8e31b51c33a8b0661e22e405569689cff53ae86b126267
SSDEEP 12288:hAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:hgnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T14F5523697965F88BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0f784a400ef95eef60aed9cc1cc2ae847ceba335ad0edae7017fdab60030484d
MD5 5383197c61de892c0d2b4caefa3d6fcf
SHA1 cf9d1c588913583f46befb8da4e9694d24080dd6
SHA512 ce5a5cdfe7725fda88c0d0e1f214f0136052392e45e10a2e450dfc79f26e0ddd13e1883f8ae7b4459822c61bd1fd1b1db2240c0585eb2285cc497ba3f8611292
SSDEEP 12288:IVFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:AnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1315523693B69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3d64f753228bfd74d253b2885c7f16c448ac4837647a758b30bc37eea447d37e
MD5 4585f2a4e557f501a292a2c9fe78373f
SHA1 ed7269cfafc20c703ef0eedce9b960724c42f657
SHA512 808866a3f0d01fe4642205f85da8fbd65fe4a99a9abbe3dfe5118142f08f48c2058a48f67d18c23df09b5a40e8d3f17703175ea5911cd0fda1ce388631e076b7
SSDEEP 12288:y9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:ydnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1B35523697965F88BFA1706F14C8381829B7B0EC6BFD1938F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 23a335c93e33bc105ee440beb0aa8d1b4ee6d8f9dff954ac1fcb47c701d3512a
MD5 0a0aeb3942cc4861e867db040b4a75f7
SHA1 7e96845b645b4a97a5519c90b3cb3739e8da304a
SHA512 dbbaa4d2e7fe7593bde864ac128690750378cd58bcfb925a30d2edb9084dcab5532f550649c06800968e206b7b3400b6f7e3888fe6ea491ca9481724d6b0454c
SSDEEP 12288:mCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:mCnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T18F5523697965F98BFB1706F14C828182A73F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0b2b6443c3f66ea3e25e4c31f777ddb7b663e82afd3d5d0f214198f04c35de74
MD5 4e68051e7f50ba1825b83251979dbe40
SHA1 ff09ba48eba9a2473911bf700eed2fa20218a710
SHA512 a1c1481d00f31bb80adc22ecb0a408a2dbe91dd887b866e5248f900716cc4d03e84268a77a5ba059cb8b413dcd280a18be2267eefcad5337d88a3231683eb5f5
SSDEEP 12288:SmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:SGnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1A75523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 9650a86c5fb4b8f1b70eeede23b6530d63f982032cca4b2ab2a5fff252b0001c
MD5 bf54b1a10484d7c678a13bec884d8b7c
SHA1 671bf128febb9e3ecb9951542ac1370ba34b4317
SHA512 dccd987ca0ed8a60dc712f85df0dbab9d335c4e4dbecc697427b134d62b1cec1609787a0da6cc6b45a665d4aa944c03e2bcbfdbbdaccf66ad2565a51e43648ce
SSDEEP 12288:SiZwbDzzFEoS2cPvyuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:1ZM3zFVSOunQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1C87501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 83c2b483b3aad08d6dba64175334fe3597b77408185db6ef77a6463a7fcd60ea
MD5 89e6114e31d92e2b92fbfd937f89233d
SHA1 d5f1b0ea56e0aed0bad95253b9928ad7445f5b23
SHA512 bca6f7f19723ffb3c728367e2e62a46695446175e81e8f5525453228364a84d6d16d0155bf21d7518836214b487ec37ea6c39d5371058965038f50fdb997c1dc
SSDEEP 12288:jnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:jHnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1EC5523697965F88BFB1706F1488281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c3612afec1ebe2bea2cf46b10765f551fee320c20727556d79032971c0d33560
MD5 383b7055fbc07099d0bd50fcf3d49846
SHA1 5d22e23a94faa21bd335fe7d0881beb844b646ad
SHA512 ed8ed5fc4578aca93f986eb5cf5ead696c68770b37f7f515484473b6f7bae42767cac72eacd4750ff568c364c24903869a86748295cfff36f625e0350e3070cb
SSDEEP 12288:ITGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:IDnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T12D5523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 26117c1026620f36185b40424cbe9b9143c5e78f1088ba5daa423424bac021e7
MD5 7202f4850d6e5096cab8ba7068aa5597
SHA1 a56a5173cb8d7fee3d6f9afbe36e7492b7461d7b
SHA512 c7ba7e91b8952b455aae74a3f88b997978f1e211b27ca5033cb53b9b2af1011bb58549d44557ebf16c11096e27fd75a036bd5f44bf604fa9875fe037a75c587c
SSDEEP 12288:yyPz5L8qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:vzyqnQ/tbw/2Mkjy6Fr7g0op
TLSH
T10065021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 64af24fbb2bcc7ba800781c8038f0d6fee2739862a4ca1eb062c9009ff74e459
MD5 41ce2997c9c6e826ed1561c7d1b69afd
SHA1 ca7d67b766859c092b12e2f4c09108e19f82e9d6
SHA512 077d505965b54fb214d667d85fcb17f33a324ad29d7de03bc8806bed868c2917fac5606dfbef8771279eafcb728c1a7bf7913015f52348f0e36adc158435a35f
SSDEEP 12288:1nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:1HnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1B55523697965F88BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 05b13415a203da361803addcc2019bbcbc5ab0bff8206b1e09f11402d98fefb0
MD5 c69161bcb612b91d91270f2e71bd41bd
SHA1 3fb5f629d0d27bbda6cbd2ca47643745b8ed62aa
SHA512 ba4cc0ba05e007c16f2761635d894235e5dc6a8927fb8cba5882bb18bd20d9399c93469951db52ccadef8e7a4bae1d542deb11248632f579f705072cc27844e1
SSDEEP 12288:MnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:MHnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1B15523697965F88BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e5ed80273fc99e25fe58fd2044b920d1a13a7d0bab67f131c20c75ec214a98a0
MD5 4a0abe93e7e92b02deb29628c896644f
SHA1 e662ae785351f64cd3d4e0d043321acffb73650e
SHA512 46d063cb48829c041101a579b4369670ea14e3778958f596c97f0ae23825e44fcda6c870d68facb00497c7fbf1e9dd25542433a8eb8ac6dff1263db2310cb304
SSDEEP 12288:ryPz5L8qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:GzyqnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1DA65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 cd55c323b4c4b9282fd922deb77f6cb759d14917c7848be2ffd0379c92f4c592
MD5 f1bbd6c71c1abe7880f7cba7b0a98bc7
SHA1 11855b00fc53fccca6589521f35e7ad0783e2266
SHA512 923a0755d99ae61ee8712dffe94779bda5be707c30fb0a19ff6555a99848259e13a6aa96312cea17e2c0d82e26716ee436f2400dfcca8d42aaec67c66d200d56
SSDEEP 24576:4cP4mcvIjkGOxhKP2l71nNKbrh/8KB/nQ/tbw/2Mkjy6Fr7g0o8:DP4m4IpOO67W8KZQ/lFTjN4
TLSH
T11E65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0b7d58421c45acd9e7033b66da0f8096d0b6c675789756318863b6134b4db1cd
MD5 e570b44e7e54fe60050b8a03ef9cbb19
SHA1 d20b53ed43f41f928758409d7685a4b55858c24a
SHA512 b62a7571bbc3fea1193c41b3d29d2fe2d09589904049fd2aedc58528063bdc2878a142cc36775a295bd931de254d118b678dca677a08fe396ebe815db9de453b
SSDEEP 12288:yssfXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:k3nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1DF65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8d778d6085cd18362d3f0aadf2eba6a5701e001c9832bc7868f70407e3aa0534
MD5 6c623afe6c8cc46995b4bcb0046e0777
SHA1 3e726175382b0b1362b30bc99359ebce439ed294
SHA512 76c57278d4631bedf9b90cbf246056133747ac2c2ffd053efe05b832ab598489639147a8ccc3172e5f88f3d148972b99b5fc37f4acbe5bd992dc7e6c67a88da2
SSDEEP 12288:r3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:rXnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1DF5523696768F94BFA3B06B05892C151673F0EC5BF90D38FBB08222C957C3D41DA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 425b3fe276372b7a921d9b4b1c36c775d0426370c116cc442832d0e1b6ce5b66
MD5 1f1d7a7fe513b235d6842aef9cb142df
SHA1 c504a3e06399bdf108b1197b190350e3f88466c0
SHA512 95aaf1f2f30371e13ab1c595c877f27930fe7a19c4b825f3ccc7161dabf194e5dc378478b88b4d9317bd6a7a9efbf4ceb30aafb8bcae2c501f15c7311f0ee2ec
SSDEEP 49152:6a0h2GEkuAe73q3pp46zwwQdQ/lFTjN4:6a0hNYG4Jw9Lm
TLSH
T11C859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 f1010e228312d6538d4a51e443e4c614ea68ad0b93821df04de1c2d738f53232
MD5 b32961de76fa4e26420ec50d15ddb960
SHA1 01c4720fc3cf1fb36110208bfd4f15b697f58cc8
SHA512 5182a4574ce1ecfe7b2d70e1412e00dccd53ef92a36dd60a0cce15f846020f566ae7147e882680d1b455672e28a0a2711f5ae892291e219b78e9b045de9c5690
SSDEEP 12288:3hbHjfX+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:3hbHjP+nQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T18055027E26AC30DAF63692BD88928546D7327C552B11A3DF2381423D4F3BBE41D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4104be389a7ba58009db3664ad17c84f8f85efc0781cb690fe93e9f8cd67940d
MD5 11c86c3254b9bffe345acfe20830b6cc
SHA1 d9bbe4eb6c23fdd371fc447b16c4c99967374198
SHA512 cf07da4dfd660015c44b1b45a39024eced12a2e30d84cdde7138fe0789297e79612f71b292b95a1d9dd307ba3f0c6707a3f77acb7b8bbd8304b6688ace3d34c3
SSDEEP 24576:i3YgnJcRTk4yti+R5dBR/WnQ/tbw/2Mkjy6Fr7g0om:iIgnaTk46pBR/WQ/lFTjN4
TLSH
T18E45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 5db0a441472149a9191dfa03d138f6e2747af377314260893dd45cc439a1e11a
MD5 28e4fc4608f06e735d6736af61ea851c
SHA1 ab8a2671e27dc6e1d9c590c4dc639ab15d7a0db3
SHA512 b624450dd5bdcfde0bc5b15a666ad65718959d84f449d06ddabc844d381b9ec6cf17f1ecaa02f949aa8fac7453bb2abd94ecef6eb61c75ba6e2469828c17e27f
SSDEEP 12288:rjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:rTnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1135523697614F88BFA2B06F54C838546673B0EC17F9193CF7B482129967D3E41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 93b9679c56467cb1a56a31137663e3f0c17056a84e929ac9ce3b26d8ac9db916
MD5 686ecd4bf87a58f98d14e50937af59f7
SHA1 b4ac4824d13c1d8f5367c5f4d144fc7cc247da4b
SHA512 973320b6c99a5688a774463c9a50e8380c71b9a2d05c6132f02d53ae524699f01a9f59a02093d862c3bd62c7876d73f00512d64bbfeacc9424a01738b6f9fb86
SSDEEP 12288:qOb4A4LWOsvAYFTMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:bwL3UTMnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T17A75F155F7A450F9E92B813CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 229b02f7d4e9175818db46685423c13ffa40f036783a36017e4cb0371a807cbe
MD5 42f4bcc55c73940747cf195a0ac85bc2
SHA1 0648cdcbf1d69410ba58509bf5849d042e3b03a4
SHA512 2cf797c45066d8aaad85a7e277240fcc84f6282125094cf1765cfcb10fc81415a004826c23cb878cfa598a6b2fc4d7b13e3f0c963630569a76ab00dc6b37fae5
SSDEEP 12288:apFtCOYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:HOYnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T13155022D36EC60E6E536527D89838249D37278921B6253DF0780817E5F7BBF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 06a3e48d08925391eaf371ef46a2e2ad500cfa3b63ed74dbbf58765ee553107c
MD5 2166ce7e2d45dda480b8d430aeb5a224
SHA1 4610ea5d95db90fb24b464e6ea1344b85fb3a97e
SHA512 550626d145c9140ed7bcadc059c140ae079b8aed676bfb19dae13f3610cb866be7c94c8a07c46dc4c282ae7a5364077e18ca8fe73c3ab3445550b614cb07db04
SSDEEP 24576:J7NM9YqZqmWMUkPjZM48Mv6bEhsHnQ/tbw/2Mkjy6Fr7g0oP:J7cBWMpPjN8DbEheQ/lFTjN4
TLSH
T151659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d5ea80f4ae52d587fd1ba1fc33c5883b2e5bd8c1d51385ce98b66cc49c8e56f1
MD5 8d0afa730eff480ccd0882f67852a859
SHA1 567d449336b5854f20c17000ff3113a7f85d97bf
SHA512 748a540d797647613dc1a9ed3416b912ce7febd7b311c545bb8102be8d55933c89188e4ac02713627d5af2075919550eda725bfe19b1547cf811618ad0ce4970
SSDEEP 24576:UW6BApg2YuyuNDYTabvcdvNYf8km1BnQ/tbw/2Mkjy6Fr7g0oC:UF2YuHNETovAvNYf8kmnQ/lFTjN4
TLSH
T1EC857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 53aa5af6548a4734b66044ee5f81b006d7e92d6894f3a2e7edf87f76580fefeb
MD5 3f58dfd7ddba4ac374a7572f7af69f42
SHA1 bcbe648228192bf9ccd4a57457ac97cda7b0cdec
SHA512 e7030621a08514b20d79334cf5d037a091fe64a2adcc7f2a142d9015cff1f2518d615643279e5abe2a4a6c22cb401e57f171dd07c82d3d6b0c2a4b49e5bdfbe7
SSDEEP 24576:BAFs06+Omlf3NXEbToUnQ/tbw/2Mkjy6Fr7g0of:WFs060lVXu9Q/lFTjN4
TLSH
T14F65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 cfbea0dabf026a8b1f8c1e1ed9e28d87e8b6377edb26be13c151b87de2b11616
MD5 7ff20b6e8f36f3492fb56204d4393d97
SHA1 02c7dd00a9fc11d5ac2bd8a6e6cafe698e674239
SHA512 3181df61f29dc945aaf37a97cd660cd25ea69b07121a58822a28a0002f72c54a36fcb071ad1bd43fe0358071845eb46e1b90497c2d6dca37fe0813044a6d0d39
SSDEEP 12288:pCJnJ5D3VkrqzxHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:AJnJ5D3Wa9nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T17775D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c0e5d653877ce4db302b536c6ac65ea488a837033873adbf48db83f6706bac9c
MD5 c3723a48524b7941bd2aa9cbd05cd36b
SHA1 352c0f3d231dee0de3ff886df9cf9bd50c653bc6
SHA512 0f5ee33a2e38086241db295ed692eb1b0b8fb3e00bd4f07b139d07af8d22bf985074a98d6f4b60987283274b353c69fbff293e8d57f5c9c1c4a0887154e5f629
SSDEEP 24576:VEPghm6/7IIXdwcXrif7qQncjlP65i3VuWnQ/tbw/2Mkjy6Fr7g0oC:Cg06DIKdwc+eQnSt65aVbQ/lFTjN4
TLSH
T1F3955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 929d23ad4fbfe462e21b49b773cce2d6cf84ec0cf9199f32d519fd0e47990654
MD5 9acf3f075cc6169af83de63161508dcc
SHA1 2f78e171035bd435bdc5f88b2de432e4b8d872d3
SHA512 0db1d8f8e90dd5ba1519580f461c6470051469d910208627d24d6ba3ac5d1f035c8e6587a9973228a7d48ee0f7532dc19d9961e2e350c7369f62bc1aaad33b8c
SSDEEP 12288:2EP3RSZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:1SpnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T14F55126D37ACB0EAE52A517D84918145D373F4A12B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 5aac9f27cd1858834eedd575b98e1ae2700cf1419a7ccb93e1053b19c95b5c88
MD5 15182c2516b04ccccc003a99678857e9
SHA1 7c7c906b2b9f0a900f0e9b5391ec2d9cd6ef5736
SHA512 d43661335dd0f0559b0f4f4c0dd7d4648ded16006c20223c407bb8e3916a31458c45eec825b51e82eb353b7f67acd81d15a477fa0c82d0628a75138d5d64fbac
SSDEEP 12288:GjkyOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:GIyOnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1CB6513187398F4C6EA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 050a5392522f796749b770c1a48da197f2017ebf6cd043c79b328b18dedb6cc3
MD5 bfe9af1e3fa794e6e75925c870539361
SHA1 44fb87047e792904805a7ede3f7f036bf02b0eaa
SHA512 861a643dd499bc8a3371d978eac2660a6d9d0742050bf7cb438e9e48a968cb1735a89061a4d4e3181156d8dca3d109a2f09bd9db8ea6f3c1747ccb1802e39322
SSDEEP 12288:w0oGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:ronQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1CC55236C2625F89BFE2706F448928582973B09D17F9163EF36846239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d323f4156a1078aa2247b1f7533c123fdec920340516114d266492602bcc47d0
MD5 04009c38d24b15d8a8971057a1e47c8c
SHA1 5bc4a9952eaf397399265e3061ae1c8570a34145
SHA512 c2ca421518fcc5a82769839ffd93bc1eb4703e31f6f76404a61850398827d766e9a231a33eeb71b49c229ea7f8d1fae38092431c8f6817e800ad512ac669339e
SSDEEP 24576:sQ9MxZKdcz9dw3vnQ/tbw/2Mkjy6Fr7g0ok:sVKZvQ/lFTjN4
TLSH
T11C558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 c6bc5ce0186051c0be3722a4b08641d190671a363baeb4061677e0ee91037e65
MD5 75ec258f061373a04dadab81cb31b736
SHA1 becc94a386e25c79257dd2f91a111ffe54ebd5f4
SHA512 cb2ca8f097836a7860a9d0d03728f725a39b25ee74608691b572d195f2a1685010cd8db51377f26668aa2cc6d2739d977fbb7f1dd5443fede4d8d47f1c66d6c2
SSDEEP 12288:fyoKo20Rple9paGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:fyocSApanQ/tbw/2Mkjy6Fr7g0o9
TLSH
T18365E01FBB6990A2E136813C88818745E773B4706B6267CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6481521d83f800bb148dc3f6bb5db1543ae4879c972782a6fdb2ade6dfea387d
MD5 29fc5c03ecca4d9d68b72987ef533975
SHA1 4c5905b8911dffe8d8928a6057f6adc3041d18ed
SHA512 1da3a0d9602a36c944ae11b3c3f393888a3207ad07baf4e3904f88237e0703673014a2941960599923befc0da499aad07d72d8379eec4b82d03cb0d374892484
SSDEEP 49152:cWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKaQ/lFTjN4:W0zuNIvLm
TLSH
T19BA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7e4e002fb5800be2e34dbee9129618729d71ad22782f4d077ca93d014f71532f
MD5 93efa7d6c2e204e772ec7ff85c4ed94f
SHA1 6a159cb6940be085cae0bad0c503eba1e754ce1c
SHA512 db2303bc512f7c8f5cd04813e864e1b625ff339c25ec59bc9f3e04dc8e4766e0f0fe6d2ad14b22d30e8f680721976f2e7876a838edab3d5662d6ebb28e0ff4ed
SSDEEP 24576:i1QT7EcpfxR+N5AWAz3ooiYtjMqbpnQ/tbw/2Mkjy6Fr7g0oS:/TDxR+N5YzTfjM4Q/lFTjN4
TLSH
T17555B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 6d934fe52ea3b22f658265d5b0753e52db638fa07e5bc2f1c157e5c9ca7c25a5
MD5 3ebaece0de866e562e39c686dba4a433
SHA1 1928e98e5f7dc2dba7266017844ac94c1327ed29
SHA512 25656f296f6c2745e9eefa0072f54baaa2b435fbc76a84ad6e1b1f462a1981c17e5d5011baf1a0f185f786f2e02d2c9c78d78296819c1e1822aa6b884b914d88
SSDEEP 24576:NTMdOz0FFS+1mSLlnQ/tbw/2Mkjy6Fr7g0or:30K+1mSLlQ/lFTjN4
TLSH
T16A75E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 5be68d344ca8b4987d627d778d13dc528f415a0d7b2feb456cfddaa5ae4e1c52
MD5 ce20a40d00888e1f51546698da6e5222
SHA1 8932132ea10ff38b997b9c455ee26400404b3de7
SHA512 4e0a677b78a09206116dee760f6bc17524e660250072b599a1aaf305ea3033b3bdda6cd44ba5b86c9e1de6a10113bfc5a363d7413207ee1acdfdb0d7f6f09964
SSDEEP 12288:b4TMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:mMnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T17955122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/100-72-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/100-82-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/100-78-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/440-103-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/440-101-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/440-156-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/440-96-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/460-153-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/460-360-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/772-109-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/772-165-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/772-359-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1028-42-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1028-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1028-48-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1028-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1320-361-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1320-157-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1492-92-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1492-84-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/1492-152-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1492-90-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/1668-129-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1668-138-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1668-355-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1668-135-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1688-106-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1688-160-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2264-27-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2264-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2464-358-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2464-149-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2636-21-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2636-23-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2636-15-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2848-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3152-124-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3152-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3152-38-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3152-31-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3392-113-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3392-308-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3488-59-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/3488-61-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3488-53-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/3488-64-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/3488-66-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3720-380-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-383-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-384-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-397-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-396-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-395-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-394-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-393-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-392-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-391-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-390-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-389-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-388-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-387-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-386-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-385-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-398-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-399-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-400-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-401-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-403-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-402-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-404-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-405-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-382-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-375-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-378-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-381-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-379-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-377-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-373-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-376-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-374-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-372-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-370-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-371-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-369-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-368-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-367-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3720-366-0x00000276BAB70000-0x00000276BAB80000-memory.dmp

Download

memory/3800-166-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3800-209-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3800-363-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3800-191-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3800-175-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3916-144-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3916-68-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3920-161-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3920-362-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4212-329-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4212-116-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4212-125-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4212-122-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4504-357-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4504-141-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4684-81-0x0000000000400000-0x0000000001531000-memory.dmp

Download

memory/4684-5-0x0000000003360000-0x00000000033C6000-memory.dmp

Download

memory/4684-12-0x0000000000400000-0x0000000001531000-memory.dmp

Download

memory/4684-0-0x0000000003360000-0x00000000033C6000-memory.dmp

Download

memory/4876-147-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4876-145-0x0000000140000000-0x00000001401C0000-memory.dmp

Download