5e52240e3b26b3c4bad8696fdc6f716cb732bdaefb78ada5eeb86815cbaf6797

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
Size 1.8MB
Sample260603-tfprpsbt5v
SHA256 5e52240e3b26b3c4bad8696fdc6f716cb732bdaefb78ada5eeb86815cbaf6797
MD5 4adcfe2140611d3fbab62af6aca0204c
SHA1 6d82727aa5eae3b60ea8173212becb6777db0085
SHA512 f5bd302d699166d8cdd524a23672078eab714934855f326eff7683484476ddc848dbf232a6ac1a6d2cbdb3ff7ec96b5d3ec4ecd8d27259705c131e78fbe3f870
SSDEEP 49152:nNZCWOLT42KGnjmiK2MtENqZ6mMsiP96/w:NwnLT+Gn6PZyss
TLSH
T128856B0667F94129F1F33B71EEB992645A77BC71AE3AC50E6280025E0DB4E50DA72733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
1392	alg.exe
4088	DiagnosticsHub.StandardCollector.Service.exe
4768	fxssvc.exe
3448	elevation_service.exe
2516	elevation_service.exe
1960	maintenanceservice.exe
1708	msdtc.exe
1956	OSE.EXE
2100	PerceptionSimulationService.exe
796	perfhost.exe
1116	locator.exe
3600	SensorDataService.exe
1772	snmptrap.exe
4432	spectrum.exe
1108	ssh-agent.exe
4568	TieringEngineService.exe
664	AgentService.exe
3952	vds.exe
2260	vssvc.exe
4492	wbengine.exe
920	WmiApSrv.exe
4964	SearchIndexer.exe
1800	AdobeARMHelper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6ad8ee31fe8d2f74.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp	AdobeARM.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e31d512c72f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc1df72d72f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005de2932c72f3dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6a4b72c72f3dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dca0d62c72f3dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1800	AdobeARMHelper.exe
1800	AdobeARMHelper.exe
1800	AdobeARMHelper.exe
1800	AdobeARMHelper.exe
1800	AdobeARMHelper.exe
1800	AdobeARMHelper.exe
1800	AdobeARMHelper.exe
1800	AdobeARMHelper.exe
1800	AdobeARMHelper.exe
1800	AdobeARMHelper.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4624	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
Token: SeAuditPrivilege	4768	fxssvc.exe
Token: SeRestorePrivilege	4568	TieringEngineService.exe
Token: SeManageVolumePrivilege	4568	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	664	AgentService.exe
Token: SeBackupPrivilege	2260	vssvc.exe
Token: SeRestorePrivilege	2260	vssvc.exe
Token: SeAuditPrivilege	2260	vssvc.exe
Token: SeBackupPrivilege	4492	wbengine.exe
Token: SeRestorePrivilege	4492	wbengine.exe
Token: SeSecurityPrivilege	4492	wbengine.exe
Token: 33	4964	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4964	SearchIndexer.exe
Token: SeDebugPrivilege	1392	alg.exe
Token: SeDebugPrivilege	1392	alg.exe
Token: SeDebugPrivilege	1392	alg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4624	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
608	AdobeARM.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2500	4964	SearchIndexer.exe	110
PID 4624 wrote to memory of 3948	4624	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe	111
PID 4964 wrote to memory of 248	4964	SearchIndexer.exe	112
PID 4964 wrote to memory of 3580	4964	SearchIndexer.exe	113
PID 4624 wrote to memory of 1800	4624	2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe	114
PID 1800 wrote to memory of 608	1800	AdobeARMHelper.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_4adcfe2140611d3fbab62af6aca0204c_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  PID:3948
- C:\ProgramData\Adobe\ARM\S\17913\AdobeARMHelper.exe
  "C:\ProgramData\Adobe\ARM\S\17913\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\17913" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\17913" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:608

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:240

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2516

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1960

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1708

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:796

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1116

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3600

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1772

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1108

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3952

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2500
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2892 2932 932 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:248
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2656 2924 932 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 90ceaa010a107196467d9e6305c2a6539d2ce95d0d0e759d54fd54f66d4d2514
MD5 1f1bdee9ed8cf6ef1f2ae9dd2cf3b78b
SHA1 db0e455431afbaf5e6a2a273d20cdfc30c3df3e6
SHA512 f18ebce4439935dbdaf4cfef919885ee9b9ce74199d612cca4cbfce22164cd710c4ac0d3d51aab466b221fee44ef8d0796e31bc713b9790dca97e3ff82d4cce7
SSDEEP 49152:mb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnDZ6mMsiP96/w:Y3q6gjBOZyss
TLSH
T156D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 476379d294f2da698d0e2eeab8932f45f1c177317bb26602e4bdcd5597eb2a6d
MD5 b5ed8efc0727a03259bee6bfa6048da6
SHA1 ae9996d5eaf067805c0c652ae0c86fef0440c6c1
SHA512 882b6464dfaab4c7d2c9e7168fff17416b997a504f2e7a4d51aab3b07b8750272b916eb4d528c5107d9d78d9ec7888b4896a9ed8291e53c4e1ea944519b4f146
SSDEEP 12288:e1XLsz7a3xB2lRq2czAPfKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqLD:sXYH0UczAPfo66YT9BK05ncXPFfL6/78
TLSH
T19E05F219B3E409F9EC67813DC9A28501EB73785583A0E78B13F486761F232D55E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 17cccbe02a4f9e2d407769eafb1664681c053d6dbb6526c4a824232d1fca8315
MD5 3e82c3feb58048fe3d10b33e4f662234
SHA1 ac48f87f56a93bef169083a340278a0eb8e6b04a
SHA512 114781f7c660e688daa2f5eae77b3deb0dfbff1a20114d4eb1858397dde10cc570100086d0a70c41caa6d450c582825748be59c859c9c459495466d145600dbd
SSDEEP 24576:r0meREM0ulxOrMTfo66YT9BK05ncXPFfL6/78:r4EM0KowZ6mMsiP96/w
TLSH
T19045AE16F6748735D073C0B9C5D2A68EEE72308657308ACB1296C77C3E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 29fd0508869b4b4b2508d3ab9f85e8a7bc978416d9dce90f2ef0de034781930a
MD5 e403080169bee6213b57633fa7538301
SHA1 ae7568fec35d1dbad53db81c25ec1d553d0641c8
SHA512 37e252544be3511fcb1774790c2cd919e745c796b672e2019e9d06a7c0298111a938e9d072b0a035c3cc7cbda49fc2ce8615e36da1c882676e416514b03b792b
SSDEEP 24576:QwT/ezSC6vUyD/aqgrvW/6q8wyu3fo66YT9BK05ncXPFfL6/78:l/ezSC6vUzPvuHjy6Z6mMsiP96/w
TLSH
T15E755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 d653cfb636b3f6693066837f4acb017f11867c7b021a066499f08d31281b14fa
MD5 3909d52f777684fe12a0dab62da41614
SHA1 25126d2e269f63cca3086f11f11fab0309c66ef7
SHA512 9e5028a87fc35502be88eaadea0a83708a1a728ff5720b1cf3a2eeea8977ae664aea10ce6c50e3104b64814d0d3209dd116936f61a6e849c40d751620b225b00
SSDEEP 24576:CabhPe90Jv/l+d+fo66YT9BK05ncXPFfL6/78:CaE90JXl+CZ6mMsiP96/w
TLSH
T17355AE66F6748331D073C0BAC5D29A9AEE3234424B31CACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 daf070bda3d39541e66e944f9b36394756062f520909fc8e8299a58f03d09d4b
MD5 287787022ddee1a56ece9b0865628ccc
SHA1 7e75d0577a75cbb6a91b9470862be3739cb6f9e1
SHA512 32f11b0c94f7f17b42817496e36478f1d0e063781f7619025f4f970273b32af3a20bd0bc11f20b69982019beaa264850fcf270ac2518ddbab37635ce2c87402d
SSDEEP 12288:+3BfKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:+3Bfo66YT9BK05ncXPFfL6/78
TLSH
T142D4230AC3648F96E21F6831636509469FAA6F2FC0E58F003FB153EA1876153E5B16F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 41ca11e4a1a2dd19a7792d80f64f7050e2eeee50203830bcfe87be1a2780d736
MD5 f3533d41171b51a78430bffcc66aa4a7
SHA1 a52fbffb56387b6ceaf68227588febf3bd23012b
SHA512 012a344910f36745e90d59235cdfbf957cc847cf1b62f50cff82566b05bd900a7eb99660ffb486718513cfd2343a5c244184e1941f76d60521fe88f9f3bae5d8
SSDEEP 12288:WeBNUbTVO86UnfKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:WJIUnfo66YT9BK05ncXPFfL6/78
TLSH
T18415DF2BEE28ECD2C27E9C7857918600D77278318B6293CBE175834EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 de0a9fa1cf6e7144e671f90c452af67c0783626930ada52eac3cfb48b32ed9e8
MD5 2c8bfad44d288fd9c5a5917a5136b58f
SHA1 354d9f480cdc5d2fb4744b937facabaf7d5bff8c
SHA512 fde400b07eec3cb239f8d479515a46e5faf9ad5b4760f12db229e8be06da9d3ebe1bf9ca42976f87ae0a28d4db41778bed47e41c8f628ce71df0923d30c031b7
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJf9DN5JONRV3TH/:5QvGAdlCEL8c/fRN65CnZyss
TLSH
T1EA367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 d39cedc6743d15d6b164dd7ce37c152a7dab7127c0d86b656bfc1494e6f23354
MD5 c251fc1c507a3ca76fbca49f1137523d
SHA1 a62f25f0b61985e42cee2d97e5ea9bbdf18f114e
SHA512 d0b80ab616c2fa095325c1e173c83b6b444af5df02e3af5e939a3d15aef4859e0f0b85c01aa8004e0b1bcd05780b78796d88d909b2972ad76123384d5647b292
SSDEEP 12288:rewSfxL/2Dc3bDLLmt0LDQewsAjNjofKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgW:KmewsAjtofo66YT9BK05ncXPFfL6/78
TLSH
T17515E031FB74D436C27F0DB21B26C706596D7A204BA11AC3F3F88A9E59301D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9585d41a13d7e9f33010de70cacc275d6d2d6c8f6b9543353c6f75efe9df4b84
MD5 6b3cf6a33168b671757db2dbbb1104e9
SHA1 e03849b2855b4d35f8229025e9d54f9a37deb439
SHA512 7a5149106a709186576a458804974bacfb846f0e5d97e36c86f21125cbd97abf5d408da544786bd49160216e2571640add7f869204d32cc4c262d7751fc4c852
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrTdPlbuJHWss:DUEtQevvqc2W1cpV2XrB2Wss
TLSH
T115474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2766142eb127a1bc015f3f8e7d2a2e7d6314a723600009b69895b03e721d3756
MD5 a2ef9a4a0ac39cab2d7613b74ec9f58e
SHA1 f678a04e1bd6abb312b878a04ad7fb71e98e32fc
SHA512 69a39a6b6a9655789c320ad2505bf7c03462f05555972ef9d47faafa62f88c81feb04a2a011ab9157fe523b643af11f5bcea18fa0a0c964fd9fc222883ff86b8
SSDEEP 49152:U0bRquA/m2yL5zMfFiV+XenmE3/zOZ6mMsiP96/w:/oq1VjnmrZyss
TLSH
T12CD58D0976B8C2E4D1F6C77886A2C647F37178154B309BEF5265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0904f8f9c9d8200ae239a9a87716832345630050686e4e57f5943ce8badd25e5
MD5 3358c97dc756cf26e4c4b6623da68806
SHA1 b7959be9b377e48f50486deca8378ee487e00373
SHA512 1f489af6b8ef36fa67e0ddd6992581fee056009b479391b33fabd8916d648df9bc2e7a6eb4923093423d0735d1296214b8b329d30c18a966f4267829488df1fc
SSDEEP 24576:bAhGLvSFoiwtA5l7S53lfo66YT9BK05ncXPFfL6/78:bAM+Foiq5xZ6mMsiP96/w
TLSH
T13A45AE81E7F955D4F5B3AA7899B68571EA76BCAA5E31C20F2160C11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 8faf0707de30ba131d30163aa5d85c22634ebcb6c76f543c68e58d746c3b1653
MD5 587513696379671d248ea5da0ce6ca9a
SHA1 a815ed9ce250c828b5930f01dd46999158be2463
SHA512 3f3bd0512adaa7e157fad0f9124e903fcf541c2378666d2d58b165659fb1dae50aa5eabe813a1f2a3649980bb4c1df666a6730b7c56f161afbe17ac3e1f36072
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+CgfKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprK/:UwusOWLfo66YT9BK05ncXPFfL6/7
TLSH
T19605F14A73A40CF9E567913986578536F7F2B8162A61CB1F2770C35B5F33222AD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 6e225e0f0acdd801a294334dc92e374e68e33c2781ef7fa8fe88d35c34d2cb94
MD5 e6fe08dcefe5a417124201cad74dc27c
SHA1 25b5fad7226d5fdd03975760c55c8b3ad39453f0
SHA512 0354d093446f242e8321afffa0ff7e5f1d9e58a70c32547b94f36573e964cda4096dd0a26ef965300683ca49ce6ff459519147a92a6e279a4e5f347507ffe53d
SSDEEP 12288:PkG1Ib9SfKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:MGukfo66YT9BK05ncXPFfL6/78
TLSH
T19DE4120A23E455FAE167513896E10646D7B2792793B287CF3B7043AA1E236C3AD35733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2afe151999962cbca796c020d86fc0b7b1d81085fe1ab69e78339911cb81f4ce
MD5 259b1cf81219c64ce234723c1ed44563
SHA1 fd0be8bd8d2527c0badf37254923deb55c1fcfdc
SHA512 d85857351baf39b29f5d6e0c73ee77ed8213c698b6d89c1878ae039cdc9468de0125d640435d59c2b4bc86a0e0d393a21653b5e98bd0f7c38570fa56f2c0e23f
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL04fo66YT9BK05ncN:268Qg55nhMeWu7PNU3/dZ6mMsiP96/w
TLSH
T136B55A33B2F200A9C44DE1769F4A872196D27C75CFE0E7DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f15d85cb5e077143fb998ca8e1178a0ed50b5b800d590188c800afe7d4a1a5e3
MD5 13dd01516a93d3bb4b82890839086de7
SHA1 599ffb3ddae3a493d3cc70043d20fb2a48c614db
SHA512 c307f3b741e72fecb30e029916d4de1275c0e0c32c63b04ab45fa81b7b2012ecf8312ebc46f214a875cf3facd7bd85303708ad4497a806a1bbdac3889d1591dd
SSDEEP 49152:MB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glVZ6mMsiP96/w:Gu6JmTxd2dVZyss
TLSH
T124D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 e065a5af2588e313ee8b3ce315ed4e46a4be266a80815765c8ece52ec251daa4
MD5 a9fa2579f868a33a88131822d6f72bf2
SHA1 bd095428b5cf8067c9829c4cf9070e366c706b7d
SHA512 b9d10a35a8f39df5a6f56c9cfdc61661ce967e8384f3f22620730176d4ea57a42d52dc587916f001814e7bd3d83938b794d15a61332f65ad3bb32a806c5c6256
SSDEEP 24576:cCU2ivPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA0fo66YT9BK05ncXPFfL6/78:cCUXPTY+8Wg2lIL8lrIUJLWwNZ6mMsi9
TLSH
T1CE75BF1EA3DC0896D0BB81358A518A06EB72782E1B32D6CF2170C37D6F67AD55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 003a7664516b89499b45a64e3d19ef6f26a226d589018ec146de52aa39e3d185
MD5 1d06b2e8f1b5bb9e957bc4e9450c8a4d
SHA1 17c857b749df2f7141edcd091fdbeeaece4a8dac
SHA512 3992211929d098c2e8cb71255eb8c794ef5b26243702e89dd31335c3bc27c8f7b49a40cb7c27ee75af60d99e5db469665e475c2f60887987c06efd1c6a034f05
SSDEEP 12288:CYsfUfKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:8Ufo66YT9BK05ncXPFfL6/78
TLSH
T1BCF4F10AD39442E9C02F6175C3510A41F7777D2A82E1C78A2BE0F27E1F76291ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 102B
SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
MD5 c42592fd019ec4a186471c670ded3b4f
SHA1 2d5a5b980279b0305441b007778a31c18e84cfb7
SHA512 dc22dbfd7fd36284002bcaa73c2224d42afa850123dedac16c37ac48abddebf6d0c7db1d02793dcc9553d226de60a2cad8075a03be7efb4caa29e92157bb36d5
TLSH
T172B0125313D54C10F4101801CDF444337F2270C0680AC00CC0D1111744F0CC0CE622AF
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 872B
SHA256 90a1dde35399beef1cc9f9e73365a2fb47f9ae9b75a19d5bf975c6714624dfba
MD5 8d38ab936aadd9ebe2dc4062007a2652
SHA1 2822ad8a29fb23246afa822479bdd46abfa1c889
SHA512 8f1b4b73a515d0a1a67e65bd9c689b996313578f508a7d3ada8bca3a7c16acba268fc2e118259f0c6710c41533a5111f46acdd661474b30a308a6e742578933c
TLSH
T123118C831AE91560F5B21F54DFF994735B337CA35C2DC86C90D8520E89E1A80D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 1KB
SHA256 ff421e4fffebebb020987f8d09d8b24212edd2fbfba7fecf7e0a72fd3f63c1c1
MD5 53a04d9a059b5e54426e416417225ef1
SHA1 553a4abde9d66b509a2df1ccb8ab465a8a93065c
SHA512 a9ac1d559a954ba4bcd9ed2c85c2f370033272e20f59b420c3b6f444612201975bb83eb242d820ba5e19ce464271b52b8451ddf3a2d17854a6e272abf5b92e37
TLSH
T124219D832AE91164F5B35F54EFF9947357323CD22D19C86C80D4124E4CF1A90D5B27AB
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.msi

Path C:\ProgramData\Adobe\ARM\S\17913\AdobeARM.msi
Size 1.0MB
SHA256 f3f339de3a391d7f8baf37009ec52a6948d769977e2f407faf46f7064a524638
MD5 9474db895113963c06cf1050a3d5c91d
SHA1 5c599ee58ffb1fac122823e30814702fa38eec2d
SHA512 cb4fc2145582e459af1d8eb0ef3f33a629929eb7e0730a7af15d98b4c5577a5a5b3853c5695bc9e356be96c35a91cec69f57a81322c839a2cd6d73b9958d35af
SSDEEP 24576:5tsYy4SyBEqipH6t3uhK76TwlO/TTj11:5tsYy/yUpaiqhETTz
TLSH
T12935F107B3804236C59A0235544F87724B79FC348B21426B37D9B75D3EB27E0AABB5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\ProgramData\Adobe\ARM\S\17913\AdobeARMHelper.exe
Size 413KB
SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
MD5 522026a14d6bc781d2a15c665e454310
SHA1 9451a39108326ba578793b1feb62f23a02bce916
SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
TLSH
T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 ab82962b753c4f4f6672e88b0dd09c63a3864d62b8e47a4e569c9c09a3de2c4f
MD5 f0698f8eae525b4faa66e241cf1361b5
SHA1 29d6f41a0d3b9d7d4ed902817269e448fa757516
SHA512 97ebd20c0707d1859769d38513a052ba8435358cd836e6a727929ae6e9df5801a2d70b74100e09d7df67d1a8b387221894d8ea0355a7299ac4935a27111de97a
TLSH
T193F0D4175C777EF21982546DA7FACC6538F1545D00804467343935E486677C97247401
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 727B
SHA256 03d207bec5cce43cec0c7a34ef4ccd9cab784ed1c1e2ac5a9527bc0022c8ae00
MD5 7f0bf00fdd9397d786825a10bf97e356
SHA1 7f15e2187fca023f38995c4b4ac0a92d6a3c4dbc
SHA512 4f1a27585f293d2ac4654660104635f1619f6446262e3834fdf8d6f7c3c69a31206117d9417ac9bee12b5be111da2eb87d9dd018c255c015be5824088735d842
TLSH
T1660194171BA48768CC028A28DF0D5B3632058445BEEC2E4956313159F34C3346B83229
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 727B
SHA256 acffd3201f04c45557afd16a57d94d0fbfa1c836a206fc523a9eacf00e94f445
MD5 6a1a65e72284b1fc2681e05908d29e1d
SHA1 5c2c66febb73f45e3f77dac6e633a05ec59b5d4c
SHA512 85e74a3cf77c420b917239f2ffc864bbebc7f55c367c19a37d04c4d0ed04201739096184684f3797bffa1a048becde265feeb35e2e8d7ca144c0b7b967adbb89
TLSH
T152019946970D57C029029D84FA9C11A0F3D9D385FACD4C6A11F2B1C16155F56BB22113
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 4b642558ead3bb575c3ccd601c655effbe506e5434a5afa0c3accab7b7ef1005
MD5 26f2b7b44c8411b5134400f1c1b6e161
SHA1 fc80ba8cce26e54cc754f3feefcb2b062f4f1525
SHA512 1b34c1feb56cc03bd13e1b8a14dc19d7f94c7ce822806ff7d164a33f58bb766b5cba96437096042254db119fc4d717d4524ec63034a543a9ff09edabd24b8bbb
TLSH
T1BB01657788F89B6034420600A7ADF6A03D6CD5A55CD54B0938F0088B629853EFA179B0
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 e9665c0cdb61a8c812c0357aa35f9aecc704f187b3770e83b854ecc667029c7a
MD5 fb40572fb0f75285aec9ab35e439b8d5
SHA1 3a83b48d25de10213629ae16bda855ef0070a34a
SHA512 f6be0efef6024863bab44b3507aa4dab8aafb544db2ec1525714be5cef8c86ede32f04b327e0af125c0bdbc6b802c1a20740e2c004c7945d66df585ad47a7a09
TLSH
T18DE0263427FE502EF1F49B7803D5D1D6EF26F1032C74A2BE1881696DB90AA004DA2C31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 404B
SHA256 7c8691a10c0d714bfae0ca73ef616f3d0458fd8cea642024cb64c97a666f20fd
MD5 71170b50b5598d56a8a09ad3d49d3814
SHA1 b18a0d315196e246fbe50c3a4323c86ccb98a6e0
SHA512 0d3810d56f4007cb61f45e424362798e50acdccb546b49c6ba98304ab0079eeb01bf69feb434964be35fcfd8cb2d5a8099052b27ba4f677353bf7b3cbab15b03
TLSH
T15CE0C63432F8056EF2F2D0380BFAAC2349D9F2030492C26A10806B8EBE12BC00CA1228
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 404B
SHA256 63a6f8416e6a216bc387bd8c07787c1a13f053d12d85c6b841c188a7146441ae
MD5 06f473525fcb37109b4c438ee1863115
SHA1 fa8166f368873ca1f9c0edafdb909c18526f6977
SHA512 336e2eb02d3fb2f6c326543a47626d37243419c52b70de769efc13cd630216a5aca3b2725971407a552a0551a1273d872b9e07f4699af68e51f7acdf9a756068
TLSH
T125E0263033F9455EF4F4E83807F6A912A989F21A2966D2BF0050179AFA21B004CE7A74
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 bc233f5c551b4da86b585add40539bfdeba8e61bcec8ebe28d0eeef75ab23706
MD5 fe34d8569f7c29564fa2a7fb3a18fb27
SHA1 120d0fbc137115978b3c847b3be61c1b1f212c8b
SHA512 60ae343ebb62f14f5b4565082500d4a24e89c542c2919e33b422623cf2ba8508774c834c5ae2a7f185e27c99eb08df99accbabdacda4f07c55e942657701b124
TLSH
T1E0E0D83C55EF651EF050DD3546F9A1766E69F3021454D77911D04709FB47F005C51EB4
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 1KB
SHA256 6711d155b22a1f896e16bf7a2ff944097f1094a40d7a46811e4828f5c62b2f23
MD5 dba3b61095d66427f4494e2e95c86ba7
SHA1 73e8f1146866e96d53260a3860d1ffd95b91612e
SHA512 144db3b39983d0577c06477a6463a12a4da9f409e63a471a6a165aae9b90b60d756b2554d734bbfb82378cf14a45b76db9970af03c86d8b7715b6a79de69e1c3
TLSH
T11521025B53B933B6B126426BF2172ECF450530B022065E38728429D9F29181BCF0773A
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 1KB
SHA256 bcc54373915c8678856dc1d5c809820059d671c1fcb748c558bf231ec6a7b4ff
MD5 c67aa48d566fdbba0a2dd02e8cffaf78
SHA1 61ce3572147bb4f4bb44ce1b586b573504055669
SHA512 7d932972fdebbddddf28c19537bc2d0c0e49441ba9b585e711ed06e571743b7b25a73e5edf130ca5956ebc5fb5ee414d2ab10007a5c3a1538b75c8011b0dce2f
TLSH
T11531245A13BD33B6B126525BF6171ECF550531B022035F38725429D9F29181BCF0773A
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp7D59.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp7D59.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpAA95.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpAA95.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpAB13.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpAB13.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpC2C2.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpC2C2.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpFABF.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpFABF.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\Users\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 6c749a6d14eb8509ad8a92d10f89d3e72228dd87d88c96aec4baf5bf76d71c84
MD5 2844a8481048f0bb67e6483b487929ca
SHA1 43a890001a45181d101911e3936a4395de757b7a
SHA512 f2d4c52085cf79a9105968d4a2128cd0676927950f6d1162a0e2f4a24a6fd09118fe7138823c2f82357772d06bf7a888acd76ca2f2bbf4a9dd88901ac830bebb
SSDEEP 12288:50fKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:50fo66YT9BK05ncXPFfL6/78
TLSH
T1EFD4230AD3A88F9BE02F6831126505055B6E7B2FD7E58B433F6143ED1822593ED70AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a03eceb4ff098adb6784c5a356db439162bf1f9521b9bff46893c43868a6961f
MD5 6b9ef32c4111dc7b2cbf293f9857aa23
SHA1 78151b2360e966a82d4292679be3bb3f284a93ca
SHA512 67bf955f9516c4377065ee1972e4e12d22e59cb747a264db7ece1541a85515151320ed4af12f2c52c26c5ce87dc44424c68967b58be31b9f6b04348042b2b324
SSDEEP 24576:XQRMyNoSFw1d+rC4vrmRcGPiQEaTPnMRTCVfo66YT9BK05ncXPFfL6/78:gRZwQCyiHiQEaTPnMCZ6mMsiP96/w
TLSH
T1BD85BF1E63DC46A5E0BAD278CDA74407E6B27816473197CF1290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 700KB
SHA256 c2570f6be16eb2fbf2222ed1d9e7168c095a857bf93f8f58b18dfd232e3c0dbe
MD5 d71844dd90cdea8736b75ad80d39e7f2
SHA1 ffc44768ec97ea1d48677d0f8d3a02fedb53c411
SHA512 690ad785b8510202a4dd214c8f0051f5b25451d0fa9ee139826ee76e3418c1009fbd65587550302f492061a6b670ef3b6810114806ecaf83b1a5a3d8c298f7dd
SSDEEP 12288:KwxA1U7KwfKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:KwxA1UGwfo66YT9BK05ncXPFfL6/78
TLSH
T1D4E4121E53AC19E5E13BA43986914106D7727D2B53A187DF36E0837E0F27AE1AC31F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4008bb0b4771a98a5cc5daaadd2471382be286f7b079690a27194c6cf8ebea16
MD5 3d1c8a71fbc3cf4ee45aabfcf82e14c1
SHA1 adfbda272dab610fd5a7b1f981aef76bc841ed09
SHA512 d1321b859a0c133e3f0b0e7a32f57347807534b2ac158d93e06b8576a006a5a19b0dba9cb8e0d26eefc184b54d212c3e68596ef8b0e73fcdc2db3200299db60f
SSDEEP 24576:ijsmP0yHaqrVqHra44KDzM+rnEVfo66YT9BK05ncXPFfL6/78:ijRP0yHfVqzlA+rnoZ6mMsiP96/w
TLSH
T13C55AF2EF2B910F9D4AAD136464107B5BB71B82D1F209BC70170C235AF0AEE59E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 6d85b3d1c5c8f4951aad395bcd802f67b8b5e73988e3467cbe52b8c305d59a4e
MD5 b9701570de3dde31c61528dcb00e76bc
SHA1 c7c9545faf9fcd99489082ee2cc3326df6ecddd7
SHA512 2251da767f8d26d065df1fef80aa0f2a75d878def7bee48ef6a8de5371a3eb4120ce6f7691c27780545ebc717fd66c4cde73089933ea1a11f05a25b5cec1b0ba
SSDEEP 12288:0SfKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:0Sfo66YT9BK05ncXPFfL6/78
TLSH
T1C5D4230ED3958F9BD01F6871136105466BAA7B2FD1E64F103FB143BA1822153E9B1AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 962KB
SHA256 6e39f944f23855bea9080be37852b59e958f6e4dbb76248165eb67efd2173f48
MD5 a1cc0585551320e70afe75a78f0a6234
SHA1 e7a314c7511d1a763ed099a4560b7718a4f2565b
SHA512 9efc264485e9a19318d2bdd860e076d52f5e4e28908637d0aab65f636a3833138f3e62aba478b3271d0f828752662d34a0f3e587a94dc4e9443ce5b02a633cac
SSDEEP 12288:3INzA4LWO+vAYFT4fKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:IHLBUT4fo66YT9BK05ncXPFfL6/78
TLSH
T197250105F7A404F9E86BD13CC5628906D7B2785D03A4E7DF17A84B661E133E28E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 85e4a268f74927f5a801a45b540d57c99d56fcc5d6d758aad63f2316dc593e27
MD5 eca878de04da66f4010740fb983f4638
SHA1 f037b8d4b7363c807cf9f82dc4ace78953eb3974
SHA512 1f09c06786c633e0bd464b59f1cf4d1a89fc04443f2b26262a23c08099da3841fa4703fe2f642832ae297f4a66454500802393b91b724bd73e802bb1f6ffee49
SSDEEP 12288:5FIVmzIYNvUyBpxfKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:UTYNHHfo66YT9BK05ncXPFfL6/78
TLSH
T14A05F11F92AC0DE5D53BA1798A828209F2737866535197CF15F083BE0E13EE5BC3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 ce32a4fbd5f2f9a2f16fb3a8e74c1d2ef6445710a5fc0f6e213fc96240c4107c
MD5 726e2bf818156fd55b15b6e78c1707c4
SHA1 c2b8958d757de5a90d97984b86468827e9d04889
SHA512 9db611a13fd354c918f881571840314b548be74668f8b789cc82da725893a4d27a7489706e8ce829676ae1c85103be2f3ab3b338273be69991c93aa6a6ab3409
SSDEEP 24576:kNXoJjNYH84VVSNAApoEO466aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKc:kNXoJJYH84VVS6AmEFJas+cHBjSSKHPs
TLSH
T10865BF5EA2BC04E8D5BBD17DC5C24506F5B278261371CACF026182BA7F17AF1AE35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 080df13327453faa121148be7d88e93cf5e954728ed2b207b6f81db44f1a9114
MD5 bc0a7baa201a9e3ea12a915688a35b23
SHA1 f79bfcc5a17491f6ab344bb598001a4a45b9c2a4
SHA512 bc3a2e796110a43b31dfe90815eb4751ccb674eadaf4dfa1b98425f31c6cd0962afda4e4230c450d23090f079891efaf46f2f06b6cd64e1420780f9a7b253ffa
SSDEEP 24576:vv7Xbxd9Tuycf8M/TYlSux/r2PCQfo66YT9BK05ncXPFfL6/78:vDLL9TuJ0M/TYn2PpZ6mMsiP96/w
TLSH
T191858D5EA3EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 278750baed1e36244b56df346dabb3079187d5876d9862b4f6851d26391666fd
MD5 f5b8320ef5598d480a131ac24f541d82
SHA1 27217f5a4d53a24f0f0a85263b5346539759c175
SHA512 1ed7c86e4da75000667c0801e4cd700625c5d7f19166d893115e6ae48cf0c2f470017db7f55f825422802c287f4d6bfef231a5bd1a3ee742536d4a0706baca68
SSDEEP 24576:XegJgpwJOmPOHWAK28ZguIGyPsxr5Vin10wlfo66YT9BK05ncXPFfL6/78:XngOJOmPOHFBZ6mMsiP96/w
TLSH
T1F955CF2FA7BC05D5E03FD17D8A928906F6B1782603355ACF05A0827E5F1BEE46E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 aba33893c61f35ffbc604d01ed6f144f4bf7056938625302e4657cb2c436a110
MD5 a49925a22382e504fff2d2895ce9572b
SHA1 3449c146bcde802e68f346ab76fe2cfc2ea468c2
SHA512 0d78d1f679c037cebc36360fba9afccf8cffd9a1240ae3df9ce2cb2e7bb73082d25258e29016fa4f9560eea4847fa0cc51f3ff04a7fc4bfda8399769ae64713e
SSDEEP 24576:6tJnJiTk3R3waE4JrO8fo66YT9BK05ncXPFfL6/78:6tJnJK8R304ljZ6mMsiP96/w
TLSH
T1C915E12DD2A810E8D077C2B4825A1756FF72343D2B216ACB29B4C5353F12FD0AA79F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5b734f3437c02ec7f76e257663117f22f646be4e102676902b5051bb2d11bba7
MD5 3b0e752b2e23f56eaef6ad7057056f08
SHA1 17c8732adfb8e44a0087c8983b93e17fc92b5920
SHA512 564e5a69e0b5506a39ef2caafba1199176c2afa224e1a8d670e47fe5dc49beba797ce6694fdeb2b43637ee18a4d03bede45a6633744f0e7e98548bf038797602
SSDEEP 49152:v9EqCzDScAZmlvTcFg8Ph6QZ6mMsiP96/w:9FZyss
TLSH
T102A55C05F7EB5298E8B3C9F1C96294169B327C509B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 700KB
SHA256 c2ce2f2b5088d3ec3218ae99ad6bbf7d4a0bed71ac4f81b82995f86179a83c50
MD5 daa666dddf4761bd3c43106aa7bdd6f1
SHA1 9289a77e9df096bcab349efd12598520c0d81d4d
SHA512 93ababe5f5be6540dc01a5ac83a7da0083ca69f3dff1ca1a1778660fde04b227d8c05867bb06eccc8024c3c7e58f33448ff17450112b10920dfd11d21f910508
SSDEEP 12288:RlYJeXm5nkEUuE+fKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:RlYJeXm5jUuE+fo66YT9BK05ncXPFfLD
TLSH
T126E4120D67AC65E5D12F903992A20905D3B2B136939147EF3AF0C2BE4E139D36E39F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 6e6fd2df0cacd07d169fe55fbf5f4c072195d5150c0d9743738c17139883cafe
MD5 9efc164d9124e65217dbc768c87f5b62
SHA1 27c4bbb47ba9419da219c3f824b05a74585af30e
SHA512 f981b34d586722854661194251e2a5ff2677bca1c151999742d28e9cd0d701c917779c1fb0d9887587ecf2679c5673eb73857f6ab7e93ab77cfaa1c08e4fb295
SSDEEP 12288:jcW6kyofKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:jRtyofo66YT9BK05ncXPFfL6/78
TLSH
T1ACF41209A3A48AD9E57B5534976201849F757E25CBA087DF3AE0D33F1D327D2A830F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 7fd5b17a271adc08ea73d42dcb5081f075b13845d9964b95ec5b6af0410894cf
MD5 4451be2a9185f0b49667996236b11c69
SHA1 182636fbc27149b16083173d47520fa87299929b
SHA512 b7422446dbd9de115ab8fade2bd41f10b33a53586171b59d2114340de4543a87e5bbd0e014b41dbcaaf36d601181b644ddbddef3acbc7df8e240b807269dd165
SSDEEP 12288:1Oy7fKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:Ay7fo66YT9BK05ncXPFfL6/78
TLSH
T1CCD4230E93658E9AD41B6870532105459BBA3B3BD1E14F2B3FF083BA4D62143A971EF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 519bb3cce0a8c664a6a3c131c4e4bbab0dec7eb46562449ec1b1590d304660a1
MD5 5459ed49f1b82120c7617c7a1a7896eb
SHA1 dc956f53319b8c3581de9af1918f023ae08cbfba
SHA512 d825382eadf546b1ce8233cc78e4e4c91498f0b311d06a8cbff95ab1375cf643ffb5592e90c97b48415faa6e8894d61a6ac0b557b1a6e01c3c140f4887850428
SSDEEP 24576:+C+TyQIu93VAumZrHjmQfo66YT9BK05ncXPFfL6/78:+/TfIq+AmZ6mMsiP96/w
TLSH
T12B558C1DA7E91DCAE276C575C8A34493EA33B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 ca18273b67c4709917a9be86b83198f7624ce3ede9f1e08868ac9a020edd8292
MD5 2701c5eb53563aaa502dbc4290d545ef
SHA1 98f45fdd8538ee0529e9ae33d0b7bf73c98a8eb3
SHA512 47065e8cabc3a1ff05b1fcad2861780b052a054159eedb2af6bf600089a1ee03d19046e50c7d83235c70d751df37e8fa60771708a8b1d9df99f34ed5e6e14e07
SSDEEP 12288:+iyrWOstaa3kcsjfKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:hLQikZjfo66YT9BK05ncXPFfL6/78
TLSH
T1F205F10FB3AA00A6D06BC13C85554146FBB37435935267DF26A0C37A0FA75E6BD38B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f0fc26db2b8674ee66ddb1aeef6c7db369d8a531d3903abfbf4fbfcb9f2d3f9e
MD5 331e3713fd282ac4db36eda033355f4b
SHA1 6c251c905c5f6c0d19e2cd3edd9b0f0f467ee65a
SHA512 194c8f93b9a2eb76fa182556a64b41f705965c25ca90fa870c4a3bfe09872564fc6e3ef61365b0c85fa623655bf7becb68569f93c4f170b359a679d9d5c2f62f
SSDEEP 49152:rpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LhAPaZ6mMsiP9D:ApC7b4+80GTLLZyss
TLSH
T111A57C3DE2B800ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8e1f83c6d507f326a24eeb5965dbbc2e24a84aa2234d639acd0a8f7a7eb7b2a3
MD5 210d06fb1f2642e910318a870eb7fcee
SHA1 073679eca3dcbd2f40c3df70443e0f5f5ac7b096
SHA512 800f839159d43e5873b462fb4daaaf739534e7b79e6adfc85a54b87657f750f80075b2596f4ce4f2453afb9b5bcf5a170fb554259465da2ac888a242dd2173ea
SSDEEP 24576:0SAwJPE1IDAo+4Kt+l4413vUQUfo66YT9BK05ncXPFfL6/78:0qPCIo4Kol4dQyZ6mMsiP96/w
TLSH
T1B055BF1AA7F946E5E17ACBB4D663C601FB723823133163CF5290817E0E169E89E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 980KB
SHA256 e828f58a973b0eccf56e8f0b38f825d8f8cece6e311b4889c2d70754512e19dc
MD5 66e9415742f8e53cb804dc798fb680f2
SHA1 6d370765e5a7c8c5134763c974045a4a8c744dc1
SHA512 5a78cedd8eaa2d2d5ed542392f9c7dc1e96755ec1fdb6e3861119559067fe007c970bc93a7baa6194fd783ec44cc287c1ef299cbce8cae6c64065cafeda3b6f8
SSDEEP 24576:9yLXPLcd94tiwfo66YT9BK05ncXPFfL6/78:9y7PoQtiGZ6mMsiP96/w
TLSH
T14E25E12ED76D08E5E47BC17CD2A38506F67238AE037166CB19E081791F67EE0A939F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 b24c1ae3d5d692efd067ce4b2585f9a8877d90c7642f2f303fe3e21ed308dd01
MD5 df0674020b301fc8ce78f821ff1b8336
SHA1 cbafec5a0a6e21a61600c12cc06e79a6470ed8c2
SHA512 838ba6b7554b0d6f5433cc7c970c8ba7fa39b1ba4672d49fd781fe8dfb668bf2e1a7e46ccd32a8239e94ddbec0b65aaa826cd44645dab1ba637118ad78745b94
SSDEEP 12288:o9lyCj3IkxjbBzrfKH1gEOpEsZNe12tNp9BKGBgoEuznOrTgoKejprKTqL6/78:o2C8qjprfo66YT9BK05ncXPFfL6/78
TLSH
T14EF4120E93E459D9E03B5530D222411586B67E3753E58BEF3AD4C2BB0E326C2D53AF62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-569-0x000001F1F8FF0000-0x000001F1F9000000-memory.dmp

Download

memory/248-567-0x000001F1F8FF0000-0x000001F1F9000000-memory.dmp

Download

memory/248-565-0x000001F1F8FF0000-0x000001F1F9000000-memory.dmp

Download

memory/248-562-0x000001F1F8FF0000-0x000001F1F9000000-memory.dmp

Download

memory/248-566-0x000001F1F8FF0000-0x000001F1F9000000-memory.dmp

Download

memory/248-573-0x000001F1F8FF0000-0x000001F1F9000000-memory.dmp

Download

memory/248-572-0x000001F1F8FF0000-0x000001F1F9000000-memory.dmp

Download

memory/248-571-0x000001F1F8FF0000-0x000001F1F9000000-memory.dmp

Download

memory/248-570-0x000001F1F8FF0000-0x000001F1F9000000-memory.dmp

Download

memory/248-568-0x000001F1F8FF0000-0x000001F1F9000000-memory.dmp

Download

memory/248-564-0x000001F1F8FF0000-0x000001F1F9000000-memory.dmp

Download

memory/248-563-0x000001F1F8FF0000-0x000001F1F9000000-memory.dmp

Download

memory/664-263-0x00007FF6517B0000-0x00007FF651B9F000-memory.dmp

Download

memory/664-260-0x00007FF6517B0000-0x00007FF651B9F000-memory.dmp

Download

memory/664-261-0x000002A14B9D0000-0x000002A14BA36000-memory.dmp

Download

memory/664-256-0x000002A14B9D0000-0x000002A14BA36000-memory.dmp

Download

memory/664-255-0x000002A14B9D0000-0x000002A14BA36000-memory.dmp

Download

memory/796-197-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/796-266-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/796-188-0x00000000008C0000-0x0000000000929000-memory.dmp

Download

memory/796-193-0x00000000008C0000-0x0000000000929000-memory.dmp

Download

memory/920-290-0x00000246038A0000-0x0000024603906000-memory.dmp

Download

memory/920-289-0x00000246038A0000-0x0000024603906000-memory.dmp

Download

memory/920-292-0x00007FF65EC40000-0x00007FF65ED6E000-memory.dmp

Download

memory/920-376-0x00007FF65EC40000-0x00007FF65ED6E000-memory.dmp

Download

memory/1108-238-0x000001F79ABA0000-0x000001F79AC06000-memory.dmp

Download

memory/1108-239-0x00007FF777A10000-0x00007FF777BFF000-memory.dmp

Download

memory/1108-299-0x00007FF777A10000-0x00007FF777BFF000-memory.dmp

Download

memory/1108-237-0x000001F79ABA0000-0x000001F79AC06000-memory.dmp

Download

memory/1116-268-0x00007FF6FD8D0000-0x00007FF6FD97A000-memory.dmp

Download

memory/1116-202-0x000001BEDCBC0000-0x000001BEDCC26000-memory.dmp

Download

memory/1116-201-0x00007FF6FD8D0000-0x00007FF6FD97A000-memory.dmp

Download

memory/1116-203-0x000001BEDCBC0000-0x000001BEDCC26000-memory.dmp

Download

memory/1392-17-0x00007FF733740000-0x00007FF733826000-memory.dmp

Download

memory/1392-164-0x00007FF733740000-0x00007FF733826000-memory.dmp

Download

memory/1392-18-0x00000162AAEF0000-0x00000162AAF56000-memory.dmp

Download

memory/1392-15-0x00000162AAEF0000-0x00000162AAF56000-memory.dmp

Download

memory/1708-251-0x00007FF7F36B0000-0x00007FF7F37C6000-memory.dmp

Download

memory/1708-165-0x00007FF7F36B0000-0x00007FF7F37C6000-memory.dmp

Download

memory/1708-159-0x000001DB363F0000-0x000001DB36456000-memory.dmp

Download

memory/1708-160-0x000001DB363F0000-0x000001DB36456000-memory.dmp

Download

memory/1772-219-0x00000243CFEA0000-0x00000243CFF06000-memory.dmp

Download

memory/1772-221-0x00007FF736A30000-0x00007FF736AE0000-memory.dmp

Download

memory/1772-220-0x00000243CFEA0000-0x00000243CFF06000-memory.dmp

Download

memory/1772-278-0x00007FF736A30000-0x00007FF736AE0000-memory.dmp

Download

memory/1956-174-0x000002270F3A0000-0x000002270F406000-memory.dmp

Download

memory/1956-172-0x000002270F1A0000-0x000002270F242000-memory.dmp

Download

memory/1956-173-0x000002270F3A0000-0x000002270F406000-memory.dmp

Download

memory/1960-147-0x00007FF7A92F0000-0x00007FF7A9458000-memory.dmp

Download

memory/1960-148-0x0000017EDCAC0000-0x0000017EDCB26000-memory.dmp

Download

memory/1960-149-0x0000017EDCAC0000-0x0000017EDCB26000-memory.dmp

Download

memory/1960-154-0x0000017EDCAC0000-0x0000017EDCB26000-memory.dmp

Download

memory/1960-156-0x00007FF7A92F0000-0x00007FF7A9458000-memory.dmp

Download

memory/2100-180-0x00007FF617B10000-0x00007FF617C56000-memory.dmp

Download

memory/2100-182-0x0000024FD8EC0000-0x0000024FD8F26000-memory.dmp

Download

memory/2100-181-0x0000024FD8EC0000-0x0000024FD8F26000-memory.dmp

Download

memory/2100-254-0x00007FF617B10000-0x00007FF617C56000-memory.dmp

Download

memory/2260-374-0x00007FF62CDB0000-0x00007FF62D27A000-memory.dmp

Download

memory/2260-272-0x000002E4D9410000-0x000002E4D9476000-memory.dmp

Download

memory/2260-277-0x00007FF62CDB0000-0x00007FF62D27A000-memory.dmp

Download

memory/2260-271-0x000002E4D9410000-0x000002E4D9476000-memory.dmp

Download

memory/2516-140-0x000001E1A6F20000-0x000001E1A6F86000-memory.dmp

Download

memory/2516-141-0x000001E1A6F20000-0x000001E1A6F86000-memory.dmp

Download

memory/2516-139-0x000001E1A6B40000-0x000001E1A6BE2000-memory.dmp

Download

memory/3448-132-0x000002106F2F0000-0x000002106F356000-memory.dmp

Download

memory/3448-131-0x000002106F120000-0x000002106F1C2000-memory.dmp

Download

memory/3448-133-0x000002106F2F0000-0x000002106F356000-memory.dmp

Download

memory/3600-314-0x00000224CA480000-0x00000224CA4E6000-memory.dmp

Download

memory/3600-321-0x00007FF69F700000-0x00007FF69FB2B000-memory.dmp

Download

memory/3600-211-0x00007FF69F700000-0x00007FF69FB2B000-memory.dmp

Download

memory/3600-210-0x00000224CA480000-0x00000224CA4E6000-memory.dmp

Download

memory/3600-209-0x00000224CA480000-0x00000224CA4E6000-memory.dmp

Download

memory/3600-273-0x00007FF69F700000-0x00007FF69FB2B000-memory.dmp

Download

memory/3952-267-0x00007FF731CB0000-0x00007FF731F6D000-memory.dmp

Download

memory/3952-369-0x00007FF731CB0000-0x00007FF731F6D000-memory.dmp

Download

memory/4088-27-0x00000181D6A20000-0x00000181D6A86000-memory.dmp

Download

memory/4088-200-0x00007FF743AE0000-0x00007FF743BC6000-memory.dmp

Download

memory/4088-26-0x00007FF743AE0000-0x00007FF743BC6000-memory.dmp

Download

memory/4088-29-0x00000181D6A20000-0x00000181D6A86000-memory.dmp

Download

memory/4088-28-0x00000181D6A20000-0x00000181D6A86000-memory.dmp

Download

memory/4432-229-0x00007FF715D70000-0x00007FF716033000-memory.dmp

Download

memory/4432-227-0x000001F7C5740000-0x000001F7C57A6000-memory.dmp

Download

memory/4432-228-0x000001F7C5740000-0x000001F7C57A6000-memory.dmp

Download

memory/4432-291-0x00007FF715D70000-0x00007FF716033000-memory.dmp

Download

memory/4492-375-0x00007FF6DAD00000-0x00007FF6DB22A000-memory.dmp

Download

memory/4492-281-0x000002AEB9000000-0x000002AEB9066000-memory.dmp

Download

memory/4492-283-0x00007FF6DAD00000-0x00007FF6DB22A000-memory.dmp

Download

memory/4492-282-0x000002AEB9000000-0x000002AEB9066000-memory.dmp

Download

memory/4568-246-0x00000298F7180000-0x00000298F71E6000-memory.dmp

Download

memory/4568-322-0x00007FF687E80000-0x00007FF688011000-memory.dmp

Download

memory/4568-247-0x00007FF687E80000-0x00007FF688011000-memory.dmp

Download

memory/4568-245-0x00000298F7180000-0x00000298F71E6000-memory.dmp

Download

memory/4624-7-0x0000000003270000-0x00000000032D9000-memory.dmp

Download

memory/4624-0-0x0000000003270000-0x00000000032D9000-memory.dmp

Download

memory/4624-5-0x00000000030A0000-0x0000000003139000-memory.dmp

Download

memory/4768-128-0x00007FF756D90000-0x00007FF75701A000-memory.dmp

Download

memory/4768-126-0x0000027493810000-0x0000027493876000-memory.dmp

Download

memory/4768-121-0x0000027493810000-0x0000027493876000-memory.dmp

Download

memory/4768-122-0x0000027493810000-0x0000027493876000-memory.dmp

Download

memory/4768-120-0x00007FF756D90000-0x00007FF75701A000-memory.dmp

Download

memory/4964-379-0x00007FF624570000-0x00007FF6248AE000-memory.dmp

Download

memory/4964-327-0x0000022E58060000-0x0000022E580C6000-memory.dmp

Download

memory/4964-326-0x0000022E58060000-0x0000022E580C6000-memory.dmp

Download

memory/4964-325-0x00007FF624570000-0x00007FF6248AE000-memory.dmp

Download

memory/4964-332-0x0000022E58FE0000-0x0000022E58FF0000-memory.dmp

Download

memory/4964-347-0x0000022E59200000-0x0000022E59210000-memory.dmp

Download

memory/4964-363-0x0000022E617C0000-0x0000022E617C8000-memory.dmp

Download