9316b63a2fac6e6b28a6460564d4b11916a3d70e2cbdb2d35601dbba5677f1b7

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Size 17.0MB
Sample260527-r13sysas9v
SHA256 9316b63a2fac6e6b28a6460564d4b11916a3d70e2cbdb2d35601dbba5677f1b7
MD5 ccd0842b85c7cbb002fcd1aed6df9e17
SHA1 bde9815e6b431988bd86a3192a71e71994a1998c
SHA512 ffae76ad1f0b62861044a6ab5c42eddb992fc76f194547e3c071d33696d1293820f0a689da30887abe4c00147c1832041937f7eae5f7fe43fae91ce3f05fd3cd
SSDEEP 393216:BQk8iM4Uwu1xxW/YovvlvmLlweFKTpg9a2J:BQv5hEv6lwBpg02J
TLSH
T101079D033241E0F6C547A1B4794EE77C432596395F214EE7E2D09EFD6DB26E21C32A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5528	alg.exe
4496	DiagnosticsHub.StandardCollector.Service.exe
5756	fxssvc.exe
4948	elevation_service.exe
660	elevation_service.exe
888	maintenanceservice.exe
6032	msdtc.exe
4800	OSE.EXE
5708	PerceptionSimulationService.exe
2232	perfhost.exe
3240	locator.exe
6000	SensorDataService.exe
4700	snmptrap.exe
5084	spectrum.exe
428	ssh-agent.exe
5324	TieringEngineService.exe
1460	AgentService.exe
1232	vds.exe
1700	vssvc.exe
5572	wbengine.exe
4176	WmiApSrv.exe
5300	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f7750169396076bf.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164640\java.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000afdffcfe6eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000752a8bcfe6eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055d6f8cfe6eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b78d6ecfe6eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4496	DiagnosticsHub.StandardCollector.Service.exe
4496	DiagnosticsHub.StandardCollector.Service.exe
4496	DiagnosticsHub.StandardCollector.Service.exe
4496	DiagnosticsHub.StandardCollector.Service.exe
4496	DiagnosticsHub.StandardCollector.Service.exe
4496	DiagnosticsHub.StandardCollector.Service.exe
4496	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeAuditPrivilege	5756	fxssvc.exe
Token: SeRestorePrivilege	5324	TieringEngineService.exe
Token: SeManageVolumePrivilege	5324	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1460	AgentService.exe
Token: SeBackupPrivilege	1700	vssvc.exe
Token: SeRestorePrivilege	1700	vssvc.exe
Token: SeAuditPrivilege	1700	vssvc.exe
Token: SeBackupPrivilege	5572	wbengine.exe
Token: SeRestorePrivilege	5572	wbengine.exe
Token: SeSecurityPrivilege	5572	wbengine.exe
Token: 33	5300	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5300	SearchIndexer.exe
Token: SeDebugPrivilege	4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	4896	2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeDebugPrivilege	4496	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5300 wrote to memory of 4620	5300	SearchIndexer.exe	104
PID 5300 wrote to memory of 2664	5300	SearchIndexer.exe	105
PID 5300 wrote to memory of 4616	5300	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_ccd0842b85c7cbb002fcd1aed6df9e17_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5528

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:844

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:660

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:888

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6032

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5708

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2232

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3240

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6000

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5084

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4652

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1232

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5572

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4176

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4620
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2928 2916 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2664
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2952 2948 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6dfef1935ac2b80ccfac860e592033864b9af40b6c2dced977ee65470afc2204
MD5 1d6692d933374e272d4d3e24e8b99294
SHA1 3b8a6100ffa854ea9002711db0af759601d43898
SHA512 30ac768bb61bc06528df862b8a65ad8f3c734922170236f4bf8816c7a41757f8d36497ba100146fe4a392a31a9fad1b28e3eac8158027c3256f589d63c9cb6d8
SSDEEP 49152:Bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnBQ/lFTjN4:H3q6HjBVLm
TLSH
T118D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b69a454f3475a01384d59260c5f7427dafbd4f8475fe52d90d48ceba1fe27e4b
MD5 015fc53372054c012f968a1cfc921760
SHA1 7e9345375085bf76891f8f80e429f45b1d05bfc0
SHA512 ed1770af28f72b45d2b1757ffe1ebaf7403e6eae815951039d3f1892dd8e29632f5d9cfc35354240d45c7a4ac42e28281e29e5dd70bc3559b805d8e0bdfd2a6e
SSDEEP 12288:s1XLsswWkxy2lRq2czAuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:aXYfDtczAunQ/tbw/2Mkjy6Fr7g0o7
TLSH
T15365F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 73c59e01fd6d3ee3c863cf54057f97f85883709f1b957a8650503e7d824675c2
MD5 8f3ff98d3dd41e806f390ef30a75865c
SHA1 ca401c235cdbcfde5e9d680f34da4973fa950b34
SHA512 3341d066b23161459cd7c92ddf1bd9bb4b192bfea2ca01dd0b27323dd1ad9bbc659552a09dc671d72f9ce5f1e5a690f8a60961dec5e22870014515bbcb546f74
SSDEEP 24576:O0Le5ji0hmxLrMJnQ/tbw/2Mkjy6Fr7g0oG:OPji0AlwQ/lFTjN4
TLSH
T191859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9f2b54b16c5ce6e6dc4a0e73d7fb1d511972ffd70af897f3e7f0389d470e6950
MD5 f384147d5559f3838ba855f26751bd39
SHA1 f49c02efcadfacd4db5cef1c497764dd434e3145
SHA512 0309f74d0a1acd52fc5790ed6d8a3f7e805ae763de648229e099023168fa606e0baa1ceb7ee6a71084522230dea18a9572b044a273ba830ef71fc85d7fd1aec1
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWE6q8wyuHnQ/tbw/2Mkjy6Fr7g0oE:w/ezSC6vUzPvxHjykQ/lFTjN4
TLSH
T1AF755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 636270aaa2bdb8eb07eaf978b7ac293cd8a6bfa97f0c204fb55157e21ef772c5
MD5 ff87a55861688aad295edc8457fe9232
SHA1 96dd202904e0fb7bc07faf63459119d9af06c6d4
SHA512 9815afc21af2670d1e78baf0d96fb6cab61206c9e123d4250bde8a41458beccde86238e9928fce3ab2a0cfb725e925d774da67297ccac56ec6713d1a9cdc0c71
SSDEEP 24576:DVbqPb88hv/l+6qnQ/tbw/2Mkjy6Fr7g0oy:DVO88hXl+dQ/lFTjN4
TLSH
T143559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ae99e68891619fb59ea5f72e971c4a6ba551e06970e40c2175dd8c93ab995832
MD5 a91d7bbb0e52720ba99acc1711a96a02
SHA1 4e1c00dda3dcf45e11d06b501bf145cced4c5a22
SHA512 0cf63af45e7c4113427d8e976b611be452d58041dae5bd5fcc8f810aaeb5b6d0227bdc90cbb95dea640a31702742e4bf3fbf549e6c9482610cf68fd99bd053c4
SSDEEP 12288:uz1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:uzVnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1BE5523796A24F897FF2B06B15C8284826B7B0EC1BFD4E74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7adb3a69f3c5962dc7718520481b6b16632b879556a7797d94117e9023d8470e
MD5 d5193ec81f273699df2f8889e0038bab
SHA1 96c9d4304de42970cc169e69515e98b70a0314dd
SHA512 444df49e44a0e0d6cfa90846eb234867429df4803ff66f5112846246fda701c3826847ad53a45d82f18c8c047c118b1e22782262f369a128a4a04a6c2a5c8c87
SSDEEP 12288:EeBNUbTVO86USGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:EJIUSnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1B375CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ee94d9fd8788b730f33620600c6b7928e42dd191949006032117e9935a7c615e
MD5 11bc897fc666aa467b5805cc5e03f8e4
SHA1 0a3f11b2b1fde1eacc09fa7c53d6e618b26d6925
SHA512 cf0e3594b1b10d6042f62acae7ee134b01c22f596df95986b15e01b6305fe0b74d8266047e245ce8bf28293065fe43adcb25dd64126afabf77f7f003ead435f2
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:+QvGAdlCEL8c/yRNw5C8Lm
TLSH
T1F1267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 15a11ad80d41aa95d8c38608df10b4f7a6767a294c8dea859c6b26a7027682a3
MD5 996a4ad6a380e7baaf65a614bdf00d3a
SHA1 2f26db9289287eb2505f99f7717addbb6323c70f
SHA512 e57341733789571f727945585f666176b5ee4240d7e93c852cce015e666482aac7aa5dcb430395cf7e76d7784719a16b56d106657023fca94e4f78027d9240c5
SSDEEP 12288:fAwSfxL/2Dc39DLLmt0LDQewsAjgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgd:oQewsAjAnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T16475E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5234dbdb542aaf9abd8921ae05fc764369a7caf62e118ec0cb8f5926892898e3
MD5 c3062b9b07ae9e27ec023c6b42db6935
SHA1 d0b9332e02a8ac832b4243c3d63155a069f28123
SHA512 9ea1b4a5dde3fe15547a07f264ac689982bbdf76d43e87e09a05ad0eee347251042829542e68bc8539c6a7de0533932719fb87e04826ffc098d051a97ea6609b
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHbL:7UEtQevvqc2W1cpV2EI32
TLSH
T1CA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8a41d53f5831a0a676bdc6b56a7e5ebcfe5988f0f892808df49859df84a74923
MD5 44070a877ba8d7e98fcbd048f85f453c
SHA1 ecae6425e3aceb9befc09030ec39a6a1e5f306fd
SHA512 df8ffcd0cb4bb8fa4d1c2ebd77e52788529195fd3945039675127e7779fd2dc547753b7b5e84c65aa2a37a54d8580cfa588d5c25e4bd9908a8541bc67d92d8d7
SSDEEP 49152:0CbRquA/m2yL5zQfFiV+XenmE3/zgQ/lFTjN4:doqtVjnmwLm
TLSH
T1ACD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 03bf1a70f320393d6e37683f861a1b2c75557fb3333bfc4d88e29a9b3c619c69
MD5 471117a5bf267c0eca9dc82cd4395d12
SHA1 59a4595a3b09a27925cf489bf5d4328ccd76712c
SHA512 806006c838839e0a0dfc3ab429a898a8969f5d3a5d59ce6872863ee3d86bda6dbfe0b0471de5e7af217736ff2b47d3fe5d6d9cd16201a0bbc6ef6f0f79c32b18
SSDEEP 24576:9AhGLJIFoiwtA5l7S53bnQ/tbw/2Mkjy6Fr7g0ol:9AMyFoiq5LQ/lFTjN4
TLSH
T16135AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b40cefc85d67a12b965325d6c18533c815946afa27d04af077027383114bffba
MD5 e6d2dccbb2b17a7ed9a562eee48eab85
SHA1 82b05485b45525562c9fba9c42c5239664f3ea5a
SHA512 d8c37145897447358cf5695bfd3ee062206e1a9841a8fb6034f2a47af89e905c03e23c4a1a8f8621d673e1ff082ffd4911a696c24cb2bac68a610dce695de5de
SSDEEP 12288:rmw5HEjsChN2BFgl0WDm+CHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMr:qwuHOWEnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1CF65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 65ed48c8494ffeba0c50ecd0f337fae6ba0785f01cb48c060c036e4efa09e4e7
MD5 c2623859ff70d94aef3bc365b98b6520
SHA1 99991ee65f6fe049b2b01a0d2e0fd4d786643e85
SHA512 b249f2a73db1b352ecd3892a41ac82bfacdc7f36d46901ff1912c66273ebeb6a7db11342f364bbef55c7324fb0daf027f61ebaf26102ea7ded7bdaf1252f8cf0
SSDEEP 12288:NXZ1IywGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:9ZuRnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1DC55126937A4B0FAE6670278CCE28646E7733882677183CF275402695F3B7D11E7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9e12933559ace131fbca2bc7c38838daaa7a82214ce9095a497f87119ae65fea
MD5 b48a0ff1536b9a00943060084e4a288e
SHA1 18540c9779ecbb07ee122797694677b3cf4082db
SHA512 ca79ff33896f9d5b1e37c3ecc6c5da1d28a3ed0752bdce9e1fd9db3f56bd126eb93b75e7c2cf96369c5828cdcf980e4e1a5c7ce4b4d3e4de2df994f6a9a4a7db
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:UQRQyi36YOcPQLvw2gAf+PN3BLm
TLSH
T140667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 84a773f8dcafe88b9fd87baeae35c0f0f079408639454e751ad722b63b174fa6
MD5 76e2ee6627410347c048f37c33f0c257
SHA1 29735482f71e2d27867e31f886df8daa1873177a
SHA512 084cc209dde53c3186328c699657e45b61b7771f005c06a834e8f511b72d950fe216351bd73bdc71b6cabb712b95722d648fd5568308b219c7412b3e9bcbf62e
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:IQRQyi36YOcPQLvw2gAf+PN3BLm
TLSH
T183667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 81808cbb3fef74e21b7e53704ee26ca112c25ef4fa83a51bdef2ce1ef72bd23d
MD5 e4cdf4fe594e194a7cc188b79ad0f693
SHA1 7dd91a7c484d2094b62170f7da026e5f9998beb0
SHA512 923307b0480632869cf2a63a3836eaf8d88e71a089c1329c94b057bd9133ad971d9378fec8ac73e796926b5a6f406c2e24f29504233c33b17b0208d79d0da397
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0BnQ/tbw/2Mkjy6S:268Qg55nhheWu7PNU3/wQ/lFTjN4
TLSH
T19EB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fdcc564433234f197caa304548ad685b2e0d292762a28eed55dd254be6a30f2c
MD5 7a61aa20fd01e38998bb6286d7a006b7
SHA1 cacdfc527d583ab0f81441f4f5c6ff673a24cd09
SHA512 507feef449e775c490bd8bbeaf763d5b1e1c1d893279968a65ffe42e30addf1eaf4f2b24a76071438738a8044eaf042d9b600054b638e3c043621876c9f2fa52
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99G:qy5112gYy5azzVvL69nLKnhZ6Lm
TLSH
T1C6167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d17c2bb71e0bc7a72e6e32d264f1b62d3c9d38e3237c56ba175b49481af639ac
MD5 614a4c83ab4b2988f8c3f849510882f0
SHA1 4b00988c5319dd0140bb4461bc4bb5078209b37a
SHA512 0987b4311afd42a410af27b32e4f9557e51737a86e48f5e70bdf2a8806e67f4dde2f73ab3bda81d49c8ee46858a901033d4a5b1821800eb3fd2d3586c04d4f1b
SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gleQ/lFTjN4:Qu6JmVxd2d5Lm
TLSH
T1A8D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b2296b645d392da13108468aaf8d37db8f7dfc1ff5cb74cc59782304c6578bfe
MD5 51524d3c88c87383f071c18b4e084196
SHA1 22d7d397872240c4fa9c8244ccaba2d0feb9250a
SHA512 f8ef8f63812b361e57bf6f4650a18320eb086e279a4db61034eeec83ea62bfac1a62ba93c9f93d767fb07dd7438671ed680d89b11bb11ad7b073fc90e8d0bbd0
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4xyQ/lFTjN4:amifPbRwLm
TLSH
T1C1B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 61f78b220b32eed0f34703b6f6da04ae0af7a07d6e6910d6135b0e377d461864
MD5 5555e26ea6905a2f88cddd04d2669075
SHA1 dce1070fc1f0cee6cf8f59b00f5dfc38b76a7015
SHA512 40fe163950337c497863a2ad54faaa9eb72db6fa3aea9aeb269c74bc32c6163ad521421298656750a5504028709f3ddccb30e602724375b91c26c70dba06f1dd
SSDEEP 49152:/SuZQIY0Be2KRRVtOnks6NMHqRQ/lFTjN4:F5dKTi612Lm
TLSH
T151C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 69f959c9c4d2bf48af4b0792e8af847650468706b103509d5a366dbcbf16a745
MD5 148da2a0b9ab57f34c386a3bd648d015
SHA1 5e35fa87bde2b9d5e06a2734c112fdd410b1cd7c
SHA512 a8e51727a459a4c2f855e87ccabd20fca0d2a97e3ce94cbe7b2b7649a966b2bd688e6c8b12205b4b28cac23942cc8b26f1bec0f35a12325d9c3cb621754e7eb3
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wuQ/lFTjN4:AX2iyphkLm
TLSH
T14995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 16eb70cefa8ffb6f940a6b0eb4532842152a73e0d2b8a654ad6958c0013ccd24
MD5 825d2cbf6a080f41fd574f2a5bbac33e
SHA1 e7125439700d13715abad1161c99daf8e73de6dc
SHA512 8372a3e3a3ae05812d53708227dd63a746bbad8bbba0a68b5ed0587936a29d227da9a9afad682816fef0e7546dd012e58883b71d82c679d3929c7ed30a39966a
SSDEEP 12288:B9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:BdnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1095523697965F98BFA1706F14C828182A73F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3efe3674e3d07ad895ab98a70bc8f01c349a79b2a740ecddc07e7845de51625a
MD5 d6e19c65424a99a49a416e9ed022a810
SHA1 793fb539801c1a55f099e584370663377edb06db
SHA512 0d75b434701a06ef1d3085cd8b7e29bc3fbb04bbc24dc7f0de483aa54606b4d8cbc8b0feae255364a8d6cc361af514220df72aba84b6ea9ed659a90d6ea38cd4
SSDEEP 12288:7cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:7cnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T14E5523797965F98BFA1706F14C828182A73B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e40970ed101ee7252d6a3e2ed7f05bdbb44f17d604bd9c48e6b07e0f1c0b2125
MD5 dbfbf9d3d6023a4a3ca6849eeba5f784
SHA1 5c6c5f404abd32ed969a26c9116662da3e4da119
SHA512 521d4317872aeb10ee1d62298654d695359f8e2fd314deb75112817d4069f87ef7c40d276cff42f64e5d1b85e51e79a3f5ed4dbd76945ccee53e15eeea46b229
SSDEEP 12288:vaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:vanQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1475523697965F98BFA1706F14C838182977B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 88de195601330d85c7aa86002a64c9261cea559e4c2bff3cb70e97c28409c305
MD5 505e5bb04a3e0130e2cfbbbdd2f7234e
SHA1 cf9799357d130a883713ad6e3c155763b70983df
SHA512 cbe15ad43ac4228b530d330df8f60a74ef22f33f970435e39342d216a1d18d3b8f412ab7d008ab6148c13e32e16fe4d6d019a63978ef0efd96dee9877dc9dc1e
SSDEEP 12288:SVLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:knQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1355523693B69F4C7F92742B4CC928142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3dc7e5e75fcb44f75d90b1bf84d02f5ee75240d60fdf32f3b6b08bdbe163c7f5
MD5 3a71b1cb5dfb001b7ea8b2caf85fc68b
SHA1 df0cccf96cebc9b796d73ee408c9d9e3811c4601
SHA512 8fc1cfb62437a98e37a62bb3efd7246fd8841cfcb2fa0deeabe9baa9710838e7a83e2e1e6f78bea2017a0e337e55d8050f1e5c71a1205991514264e013208283
SSDEEP 12288:4jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:4TnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T12C5523697965F98BFA1706F14C838182A73B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2c6686fd7af37c3651ee88f4567fe8dee1e6983cefe46dd5ce01cadcc2bd79b9
MD5 4c9a5d17bb2df41b20282bbd13577739
SHA1 e7543a6b13844afbe11bf3a919b46e80ecd6bfa6
SHA512 74b949680f33c0dbadd078d0742afabe79e6439c074fbfceb37da1ef32f09e84cf12ecb0640f606817fb2047b989f5c2d3818d9f0121e023676961c41f4f0151
SSDEEP 12288:/IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:/InQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1C75523697965F98BFA2706F14C828182973B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7628a868ab4c91e6f4a0f35bea38404a13b01e7aaa4467edd8f1948dd3943548
MD5 bcff094e3149f39f4825c8d7d25267f9
SHA1 5b67d6af7588c959b42108b3a7a8f932415889ef
SHA512 2d0693885fba7e2fe395a7fd67b31f60bde9a5bd8cf2a94f340453c1a8325dad7fdb93e533538b4c44263f14b5fc1325cbbb1a10b79fcdcacb37ab6726f3c9eb
SSDEEP 12288:HUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:H0nQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1155523797925F98BFB2706F14C828182973B0EC6BFD5A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 df2f80234ced6970bc57098d458822a5a1dcbc5a8399828f2fde534a3ef60f4d
MD5 251128c5386be022fb70a3b4d608042c
SHA1 6b8c04d9c4391c99a3eb2477784cdf914fd6a3d6
SHA512 6484e0e76960d48eac4ad23cfb9171af711182ef9fa611acbeec0dd0124ec2d8e97778cf02f59f7f358a6d06320c6d98d96e4f079e1a03a29850196a1e8a2707
SSDEEP 12288:SiZwbDzzFEoS2cPvy8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:1ZM3zFVSO8nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T12C7501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a40d3b56fdbea2ffe628da24ff8f19f63f7eac9aeb11cef636c9976f02a9d29a
MD5 32a90cf1b606e7287f3ecc0c541d08e2
SHA1 29ef83bbb5fb43404c5253880785c19f2cd65266
SHA512 dd7ad4d8563ababfac18f6163e329500338d9ce0ac80da1205bf199d69a76d360ae343d6b75597481b60a0645dcd646809adfba724b38e476f9d4d54c15387dd
SSDEEP 12288:3RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:3hnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T18F5523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4fde7ffae327267bda4c0549a2db2401b4108d30d11d76bc344023f94070d41d
MD5 357e7c0892b9d169c51a6e0fee5807ae
SHA1 d695a6842cd437e39a6043c06a595950f9206629
SHA512 4604cc64c6f961da1acf12f7e4394ca9cb26597456bc0f737d98e6ae34caa384051063b05b644d73b1708f78e44f362ccf1aff32ae917d8d8fcc274aa814f03b
SSDEEP 12288:bFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:blnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1F25523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9538785a5a3846a80162b46447bb3c1833d965b14343a8df860bf6907f69902a
MD5 faa4725a52bfbdffa9c8427515d062f5
SHA1 7a745f6dbf757b4c129a0868e1ed8643fce4cd10
SHA512 02b507958f90030d52d7d111f1f43277b98b6e889f120dc791173976a894a462d112e6e187ab6fb13d7cb427e8c87b6b497f6924d876c93fe62edd696228d928
SSDEEP 12288:hyPz5L8wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:wzyQnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1D765021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fafaaefc96b778209b15afea3aa419cbd7cdfd5a7a53c57aabd26b8e52aa7de4
MD5 38d0b7d507cd593e40b8dfb3bd619b27
SHA1 6500d67508ed95cfcf03879e186ef7901f418add
SHA512 a6093a2ec0921afaf5cff8d14138e62aca20dd93f65482a99800b4f565b8ebffa9ac27c2ab0087d3ba980aa48c390856a93082adf9f63cdf8c1a67b0662e3974
SSDEEP 12288:NRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:NhnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1F45523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0751b082bf6ad25b4bdea5dbad2ed6636cfcdbd4c3c857bdcb474be20dd47842
MD5 d65ff329fce38dfedddb68d152f8eccf
SHA1 88e9b8461cff477d45e2c6db7bc06a11e6ad6e07
SHA512 37ca5a54badd2497a00ae19609afd20e3b4403be013faabfd544b4f524286d942f145d5d58bf8d4868d322abc768d42f800652735eb80bb52ec8909934bac17f
SSDEEP 12288:fRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:fhnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1435523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 6da696cbf8831ff7abb87c54ba5e727e10f7b98cf9a2105eda560a5f116df16f
MD5 25bd31651801de8eb78cac732d913f61
SHA1 44cc7e360c2b3eef43863aa0c9d39251ec464769
SHA512 d7df4b5cc7368c068342a52d986beb6fb7fc9726aa6234120b3e15cc794042685a2e1234c27d34aa41cd80196c92c4985ce4b967788dddc1902cbfd8b3c3b032
SSDEEP 24576:rCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAmnQ/tbw/2Mkjy6Fr7g0oD:rCUxPTY+8Wg2lIL8lrIUJLWwTQ/lFTjG
TLSH
T1BE65BE1EA3EC0896D4BB813589518A06FB72782E1B32D6CF2160C33D6F27AD55E75F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5a0246291a088435e0e2d0bae8f5784108b8af30b42e140fd256ff4f27c53510
MD5 83ee2a69b7495686bd2e73a6764486e3
SHA1 fe6c3865e4dcd37573ac386940b0d3a65c1d23b9
SHA512 2cfe800c8ffb02f18021787390872fbadb37d309db46b95873c5cc0a9b82f631aa62b74cc2c2b1876355f6dcaf5671764e5de7de4b7cf80b82ece109193eeea1
SSDEEP 12288:tssfBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:9RnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T11965F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c17799efe63cf0d138efc5837f2220cbd9a68f4ef6175e52b3e7f39931bf4a19
MD5 f1638d813e2c824c622dfcc95b780597
SHA1 a9651e23e27e5d1def476d14055e6777cc66ab96
SHA512 53568c938b77d93fcc6507d1e57bf2e420ea16ec16b6a021e1277171aa4a46e5eab9b98e45de7a3c7d46f64667a887a15d4f35718df5841ab3d8529bcb800455
SSDEEP 12288:T6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:T6nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1325523696668F94BFA3B06B048928111673F0EC5BF91D3CFBB082269953C3D41EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 00c63c780e7b6d5965c2385f28f9028d9d3de8a4fb1c58f8c94b547051cebfe2
MD5 81d4b626170111c9a89997e5fb06b5a2
SHA1 3468fa763eabb94a7e5e83cb4da1912c4afc46ce
SHA512 fe6f194055973a5d7f4a719e9f3c87a8c208a025f6c1cac3e4024259c26672b35a1a1d4832227079fbb343bafbe9955e9dfd5544e1ffa725288f32a327c78cd8
SSDEEP 24576:o8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCgnQ/tbw/2Mkjy6Fr7g0od:5RZwQCyiHiQEaaPnMpQ/lFTjN4
TLSH
T1D585B01E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 857cb53e39ff2b4495f8899a0a56beafcf6d33e9005661bc5b9a02b334309375
MD5 86babae7c95e2261e7e35b29f5ccae9a
SHA1 f54c0bc0bf802ac4c2d591371172ccb77b431069
SHA512 97abaa67e1b69102b1f23f984a0424871ca09df4ea4214e7287d20ccc78e1b76f89cfdbd94c8d79595e23485d37215c8f5df4b961ed40d4d067312ea3159a923
SSDEEP 12288:kbxA1U7KKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:kbxA1UGKnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1D255123E26AC24E6F536917D88D28106D3327C56676193DF2684823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 3d3b5070a354bbaded658636972eec797fb00f4b7ca5246ac582acaf963bfed7
MD5 0ae04d4ddb8dacb9ec87e9b1a6c815df
SHA1 70af98bdd76d8a43cea912342979099cb99ac68e
SHA512 eaf3ca3d8f9e4b7ba206de5aa109a9031be7279ec82d39ef7e67b27e1eb95ccf16d765eca65ba84b72deab35fcec6ea9a954e9c7ed58dfffa0870b7eaae3a025
SSDEEP 24576:cjsmP0yHaqrVqHra44KDzMsrnLnQ/tbw/2Mkjy6Fr7g0o1:cjRP0yHfVqzlAsrnLQ/lFTjN4
TLSH
T1E145AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 bff9c2a1d83f4deba88e1e7de2f24b89fb3a5e3bc4826a2da2a2e13d2b0b1522
MD5 d96a99f8a234fa6f16af8e9f82cdd3ce
SHA1 053ef0afed6b6b85b4b3914dd068001cae892f94
SHA512 c1a3e2aba70299427450f96df6fccaa7b7f980d86e72fb92d643b1cd86f9d233cb2c226db143e582c1cbe61541da1ddc3c14508b60799eef215ecb1b9c7b9030
SSDEEP 12288:voGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:vonQ/tbw/2Mkjy6Fr7g0ok
TLSH
T14B55236C7655F98BFA2706F548828142673B0EC17F95A3CF7B482229967D3D40AFB780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 27fc04c0124898be5af6211ed62d7889a6c954a577f0e75ee1614c34797dcadf
MD5 e24d4412edb0ad7724fb50503ed09fd7
SHA1 603fdbea5d0238b90433da91af8e26deefc08d63
SHA512 f245d9336f6b1963779aeed2e0de67662c94fb88bb932ab333855c4b5f33fae5b70ed3ef6d70310b8a3333f52abb8adc63d2224093add40d9d64995419f84b79
SSDEEP 12288:/Ob4A4LWO+vAYFTuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:AwLBUTunQ/tbw/2Mkjy6Fr7g0o2
TLSH
T12F75F155F7A450F9E92B817CC8A28A16E372789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 6efbd9807eb9f1f0a58b5ed323265a71bb8d3055ecf7aa49e657bddc1805f3ed
MD5 1f8ed3ec0d13878466bef2d2e61951b4
SHA1 404f63d6595f923c8e238cac8179873c300c9df3
SHA512 0e14a09bdec595f32120a0dd68266987b1daf45327f98b1f9ae28730797ffbb2cd057298f5dfeb3c8782f6934b01cf8acce7f1e9662d85321e157bb1e26a254f
SSDEEP 12288:g70VmuIYNvUyBptGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:9KYNH/nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T12265F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 322e4bc893c4ef144b7d87882356e9402b793c494b0aebdb61b57f7f37747514
MD5 0a17ba097c2808e1a0be9c5a5cd3b2cc
SHA1 8e82eed952afa06ee7510185d3e6806bfde887cf
SHA512 61b9737f915361d4ea8f4b7c816f17aa6335848ebc66c2271122dc223c8ebf50fcbd07743ae9eb889cb49a7e89601995cf69cd76ecad4278639ec0e75e57b0fd
SSDEEP 24576:JnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK7:JnXoJJYH84VVS6AmEcJas+cHBjSSKHPC
TLSH
T10B65BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 01f2e27a683dbecc53ebb3b21906f405034c5d18278102ce09ec8f96820b3a70
MD5 acc1fc8be39e366032ecef1e2d9f62f7
SHA1 cc14c6f260b45ff78d2b4e02995ad3f79cb09a91
SHA512 cc99ebe5a39ff664db4dc8a0d46330c1f1d270eb1202c6c25b103c8c47c5ea8f43244330d8d15d0c6b2d5d8f317d8e6603b919297bf0e80493218fc7b76982e3
SSDEEP 24576:6v7Xbxd9Tuycf8M/TYlSuxwr2PC1nQ/tbw/2Mkjy6Fr7g0oV:6DLL9TuJ0M/TYW2PIQ/lFTjN4
TLSH
T1F2858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 380f5cadd2cb97479aae35d6e7784de54c3ef134b84a1966ba6a1b695760afbc
MD5 3659e5dec0758b8e9f1de164d8a1909a
SHA1 44c63ce22ed385ed40da4fd543bdf016af21465c
SHA512 fea00d0d12a234558e5e923f94e3d3075ce0cb990f13cabb1a87da5b457bd09e631112c28d4015e5095ba48496ce747336eb388e6201cf0aad6211f98153db37
SSDEEP 24576:negJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wunQ/tbw/2Mkjy6Fr7g0o4:nngOJOmPOHhuQ/lFTjN4
TLSH
T11055BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 7f4277bf7ff733eba8e13a08fbe6ec6dd02b7a940913c4ac833088aed4a942f3
MD5 a15ebc01f5b19dc9c43bc1284944718f
SHA1 490e53b0139eaa74907187c0edbe1af7e6aec8e2
SHA512 6d931eddaf09d7bc7d27617accda0e191ef3ec279a2ae24a9cb39b51804ff1d621020320b976fc639f4930f9ea623d532bfc6f3450a9114c1903d1d5b23e83c8
SSDEEP 24576:OLJnJiTk3R3waE4JrOInQ/tbw/2Mkjy6Fr7g0oo:OLJnJK8R304l7Q/lFTjN4
TLSH
T17A75D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FE06A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d57563ec07a3c3ea96a50a9776a989f8d1645e86d40f7bb5277b809fd23e0371
MD5 f14def28797f5ff480defe0d5bbed99c
SHA1 77e1f59b574a934508aef2902d7b00d9c8a1c5b8
SHA512 4e2c1d55f62cfc6e03a8fea94b978ffb82d42cabe102f53fd01d0cf22c76205f738a2d9f3be4b2928c71a6bc20c1dde772fd0d3c4656836e0dedb6fc027459c5
SSDEEP 24576:WA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6p2nQ/tbw/2Mkjy6Fr7g0oK:R9GqCzDScAZmlvTcFg8Ph60Q/lFTjN4
TLSH
T193955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 12b50e56d775e457783be71088aec795d5475e9cb4befcfa6e5292abd1369093
MD5 0481476db5a5d1ed9fea0c4831db3d2c
SHA1 f84147c54f49c65624c08aafae28bb13acc39adb
SHA512 735dad6c04fc5d526aa71e1605aa65cc1873f6b68e6e8eca7f080db1318ba3d2d4e7e47866ccaf2a81949a13d5ab16779784475ab2fbdc8d7d9ebaa087c02d0e
SSDEEP 24576:OlYJeXm5jUuE+nQ/tbw/2Mkjy6Fr7g0o4:OlYJeXmRUuE+Q/lFTjN4
TLSH
T12355126D366CB0E6E22F41B988928545E372B4A1274163EF62D0C13D8F7B7E51E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 473c814da64cc7b3863fa38b40b0ccf7c48f615ade846815045033f423a3c9f5
MD5 ca2db14bc56b7d61a1e85439d51372d3
SHA1 88ae00e6918f807eafd1c8577abd2d28b6f72ff5
SHA512 e8e8e4a4eb6a8b9199166efcb0dd1db1147285aaf28610478ae91a94fad16dd73797431584e6b3594652795d20d555755c752fcfa3706a5a16e65a5f51e8227b
SSDEEP 12288:PFu6ky7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:PUtyrnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1C06512183394B4D9FA7A06788DA381819F3A7C50AF6093DF66C0E23E5F3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 5fdf1882a55c9cbb9e9b1a7cca6db6f92c6aad6b52534ab5dd22a2f617cc2221
MD5 aaf32492280072f20e9e7cf7beffbb40
SHA1 86df6ca9354648bdae662ab2b724b835c7d5aeef
SHA512 0e330564733bb797a476b620c9892bae2f80c4851ffb02c3aa8a4ccade59ebfb149d8730b1bd93470e08342542cf41a48080cb84996addbae53fd2645550036a
SSDEEP 12288:LPuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:zunQ/tbw/2Mkjy6Fr7g0o5
TLSH
T16A55236C2624F49BFE2706F448528542A77B1ED17F91A3EF3684A139CA7D3D016F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 346ef5324b5727ad40cb5f8765d7e97345e9210a48325f74ce2c46068b82a200
MD5 e2b02913c07e0aaddbe5060a21de6c95
SHA1 6e9220057052a5252fe1a55bcab1549b13fdd405
SHA512 8e6997ad2e74e1e7bf5faffdcd2c67af62bfc778db465f925c390f923ca6fd1212ea5fe26fc4211c37f73ef5b85a0130de31fd244acf87037efa483f8b1fb372
SSDEEP 24576:kC+TyQIu93VAumZr7jmxnQ/tbw/2Mkjy6Fr7g0ov:k/TfIq+YxQ/lFTjN4
TLSH
T159558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 b0a1bb54ceada46b335af32553f88d0380eac579868aac1d5dcb21b6fa1e5ed4
MD5 af1777448c444a2d8adf40d488e149d7
SHA1 cf2f43acf38b6913ef12eae41fd17ce1ccda68bd
SHA512 9422364d5d6ea7fd03aec0af52fd41bee1dc571897ff48d6c87dab42b5b6f0fe94b7673a8f5f94e136b75c7413a7b1a6a19feaf4dd2dd0668d3bc32740ec5c53
SSDEEP 12288:zcyrWOstaa3kcsCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:yLQikZCnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T17D65F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9915258907bb8058f01b55e530261aa18c1a18ce381e575b361691ca409629dd
MD5 a27c9954f9f614d4b78e1aec8582cced
SHA1 bb1cc249041ac6c3f1643f99ca475b8b8f3b6981
SHA512 4ba25ecb3debc146343bd2247dff83ffc51f723f27d36afbef891213aed69bbc7e9b8c04121c4fe6f22eacc937030ca4746f0f9f972be0ec26b21eb8f3331639
SSDEEP 49152:ApJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPrQ/lFTjN4:xpC7b4+80GTkPLm
TLSH
T1C1A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 baa7e246df797a199697283cb7a084b3913cdcb23282326306fff5a3cb3b2e16
MD5 f97b08e9838f37c3584c951ba0b98196
SHA1 5dfb433483e46abf4e9668610a5b81ba32f57fbc
SHA512 d9c82a4be0bb577792e6edd2aa02faede8f317a160c18ec1be593ced1d004e36065471ef93925ceabfd11700bb5272315ce42775be669f6c6d28796293bbb99b
SSDEEP 24576:YSAwJPE1IDAo+4Kt+l44135UQznQ/tbw/2Mkjy6Fr7g0ob:YqPCIo4Kol4/QzQ/lFTjN4
TLSH
T14F55B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 c01f966b089e4cbd2a7691a018e5c521dae7a873f204ee0fb7c69c268655e5cd
MD5 6716da3dde70086626ab782ed9026a59
SHA1 25176b05e08c95a49f6921a959a9529310a1c888
SHA512 564e78b4a43806e28786c5c8609d7cc3662ecbabb42c03e06d88b68449f13a765709e103007892030ce9575a0cf9f87415e3e55a24d6071adb1ecf3828b777ef
SSDEEP 24576:vyLXPLcf94tDnQ/tbw/2Mkjy6Fr7g0o0:vy7PoetDQ/lFTjN4
TLSH
T1C475E03EE66C08E5E53AC27CC6A38506F672389D037166CB1A9491791F7BFF46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 8b99565ccbe832c4c0e76eb127de80e3049ac6eee3ba3888ced43f7f109fd375
MD5 934133f956afecf76b2b6c03d9215fb1
SHA1 7530559e4e0b534ef117aa0745acf30a17f5b8c1
SHA512 16e5e3930ed975e70f7087c73d84533aad1b8cc57b47dd39a10520b6e2e3ddb9f3e94ff14ae731f48af0499b030f53e31b446aa0015bf8a011982043f7c2665d
SSDEEP 12288:x9lyvj3IkxjbBzyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:xWv8qjpynQ/tbw/2Mkjy6Fr7g0oU
TLSH
T11E65126E66A4B4D9F53A0274D863811692727CB227A4A7EF36C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/428-336-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/428-143-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/428-140-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/428-134-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/660-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/660-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/660-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/660-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/888-115-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/888-53-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/888-61-0x00000000022B0000-0x0000000002310000-memory.dmp

Download

memory/888-55-0x00000000022B0000-0x0000000002310000-memory.dmp

Download

memory/888-66-0x00000000022B0000-0x0000000002310000-memory.dmp

Download

memory/1232-155-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1232-366-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1460-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1460-150-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1700-158-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1700-367-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2232-98-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/2232-103-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2232-93-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/2664-404-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-391-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-407-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-408-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-409-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-406-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-405-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-392-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-393-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-394-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-373-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-372-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-374-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-377-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-376-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-375-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-378-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-380-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-381-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-382-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-384-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-386-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-387-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-385-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-383-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-379-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-388-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-389-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-390-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-403-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-402-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-401-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-399-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-398-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-400-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-397-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-396-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/2664-395-0x000002111FC00000-0x000002111FC10000-memory.dmp

Download

memory/3240-127-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4176-370-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/4176-165-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/4496-14-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4496-24-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4496-20-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4700-128-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/4800-80-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4800-78-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4800-72-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4800-161-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4896-27-0x0000000000400000-0x0000000001531000-memory.dmp

Download

memory/4896-100-0x0000000000400000-0x0000000001531000-memory.dmp

Download

memory/4896-125-0x0000000000400000-0x0000000001531000-memory.dmp

Download

memory/4896-5-0x00000000017A0000-0x0000000001806000-memory.dmp

Download

memory/4896-0-0x00000000017A0000-0x0000000001806000-memory.dmp

Download

memory/4896-13-0x0000000000400000-0x0000000001531000-memory.dmp

Download

memory/4948-31-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4948-142-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4948-37-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4948-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5084-123-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5084-242-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5084-126-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5084-117-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5300-218-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5300-202-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5300-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5300-177-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5300-186-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5300-175-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5300-169-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5324-147-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5324-364-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5528-23-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5528-108-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5572-162-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5572-368-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5708-102-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5708-89-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5708-83-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5756-54-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5756-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/6000-129-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/6000-369-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/6032-69-0x0000000140000000-0x0000000140165000-memory.dmp

Download