5f3e7ae0381c08813be7332d6d0a6c811c82a1b84dce91a4d8c7272ef427caf9

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Size 32.1MB
Sample260629-fpwpqaey6j
SHA256 5f3e7ae0381c08813be7332d6d0a6c811c82a1b84dce91a4d8c7272ef427caf9
MD5 909456727608d4aec63228f219462b2d
SHA1 2dcda2a92d45331539e66b18e21e87d9ada9e51a
SHA512 215aff96c9233a77530643086ec8b8c34a10ae992128727bb953ec223b4dd11b0dbe0e5e57afaad3a29d5cfb5fd85bb6155d99927f2029b4d229ea2dc69c32a2
SSDEEP 786432:HFoHuxyW2TTAYWgT0K7SXydU0gaZ/ilxEBEW:K36YW20d
TLSH
T12477D093B3858072F4E241BA556ADF774B28A9250B1195C3F3DC3E295A308D27F3B786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3928	alg.exe
2252	DiagnosticsHub.StandardCollector.Service.exe
5516	fxssvc.exe
5048	elevation_service.exe
5084	elevation_service.exe
2392	maintenanceservice.exe
4476	msdtc.exe
2080	OSE.EXE
4632	PerceptionSimulationService.exe
64	perfhost.exe
2092	locator.exe
2284	SensorDataService.exe
688	snmptrap.exe
1628	spectrum.exe
1500	ssh-agent.exe
5196	TieringEngineService.exe
1632	AgentService.exe
2752	vds.exe
544	vssvc.exe
5292	wbengine.exe
6000	WmiApSrv.exe
2056	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8c5c58005a3b5d25.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fab4f8aa8407dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd755aab8407dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b04e8aa8407dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed9d42ab8407dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7a769aa8407dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d91b9eaa8407dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
2252	DiagnosticsHub.StandardCollector.Service.exe
2252	DiagnosticsHub.StandardCollector.Service.exe
2252	DiagnosticsHub.StandardCollector.Service.exe
2252	DiagnosticsHub.StandardCollector.Service.exe
2252	DiagnosticsHub.StandardCollector.Service.exe
2252	DiagnosticsHub.StandardCollector.Service.exe
2252	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeAuditPrivilege	5516	fxssvc.exe
Token: SeRestorePrivilege	5196	TieringEngineService.exe
Token: SeManageVolumePrivilege	5196	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1632	AgentService.exe
Token: SeBackupPrivilege	544	vssvc.exe
Token: SeRestorePrivilege	544	vssvc.exe
Token: SeAuditPrivilege	544	vssvc.exe
Token: SeBackupPrivilege	5292	wbengine.exe
Token: SeRestorePrivilege	5292	wbengine.exe
Token: SeSecurityPrivilege	5292	wbengine.exe
Token: 33	2056	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2056	SearchIndexer.exe
Token: SeDebugPrivilege	6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Token: SeDebugPrivilege	2252	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
6012	2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 5088	2056	SearchIndexer.exe	112
PID 2056 wrote to memory of 1692	2056	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_909456727608d4aec63228f219462b2d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6012

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3928

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3464

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3f4 0x2fc
1⤵
PID:3772

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4476

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2080

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4632

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:64

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2092

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2284

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:688

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1628

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5944

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5196

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5292

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6000

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5088
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 78b707638be13e02275808f1219cdedcbc0d0e0313d2840b0df1e89d17c82409
MD5 dd04b47b640edcf6bda3f26eb5acaf1a
SHA1 8ad63d7fabb19307b14536f7e477873f234f4b7f
SHA512 af05e1d5a16b16f781050c54c0b772fc606bc5d1106a7fb69d45bf5bea016dae27b6bad6a6b71a4e1c57d1979cdeeeeaeec7b39655dcc377b0f4bdbcb2c14f8c
SSDEEP 49152:Db+632BuPkFKRrdE6ohdstBhuXjfS4LWxn2LNiXicJFFRGNzj3:h3q6mjBt7wRGpj3
TLSH
T126D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b5c186e49b608c53ab96d793c7be4d44988f0c8142274f1d5a544cd9580d0fdd
MD5 7ce20f05fc5e63ca468e0392b8852b82
SHA1 c81ce559517345750f0c51f92948ddb0d568e3fd
SHA512 13530cab7144b4065ec7a67766162503f25520ca039b07d6a7d2685f1f7dd54e993440002b4c9ca42072a277b6f6286704ade869ee871782fcc0b660f04b6e71
SSDEEP 24576:nXYfDtczAR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ytckLNiXicJFFRGNzj3
TLSH
T10875012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ef418dca51190d881fdb6772ea025cad90f387c47d257b55a20623e4ed3aa05c
MD5 79a00e842cf054bdcb2d43ed789dcaa4
SHA1 fefa258caa709371ea67122a30f7bbae365bff60
SHA512 0000c7547b53b16c94d1bc00e4dc2b95270257caca47f20bed72a7a28899e5df9c29ba10fe442b8c5a1f9b1bf80d7261ff9baca2074a60b03c480f98053a3d98
SSDEEP 24576:R0Le5ji0hmxhrM+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RPji0AzDLNiXicJFFRGNzj3
TLSH
T13E85AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 afd13d82c2e3b265cf259f6d806b07d653309564c6218fee68c04f77f33add4c
MD5 f19c540df6cd84cdecc5785cc4d7eb93
SHA1 2dc4c1ee2ac5bc17a2d29bceba0f8003e8c6287f
SHA512 cbcfee67847a40d591962f08ba3172564825af34995f741b28be05ee1afdd93496c07724781d07c31af04dc2f1e07620ac92988191836fda753e903e4ced80ba
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWj6q8wyuU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t/ezSC6vUzPv+HjyHLNiXicJFFRGNzj3
TLSH
T1E7756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8d80428c00447d768a8fbae21bd62024b90c67a0dc052d212e4c7fe6fa4dbec6
MD5 4eb758ad42fea4d39d5caf3320070db4
SHA1 90c0b8392a0eef056341067fcbb53dc3610d1217
SHA512 34e33ff26173767ca298f06cfeae12a488c77c8eefa0991c2dee66f4a3a29e0ce557a2004eba07f8b087f838e2c65c009ef20da49f570a676c9c3d3963d0e194
SSDEEP 24576:hVbqPb88hv/l+Bd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hVO88hXl+jLNiXicJFFRGNzj3
TLSH
T1C1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 28376b66bed35e8be8a1dc5540562b54abd89cdc9ac4fa26fbad044e95b79111
MD5 639ee9bdfb91d17c0ead493fe053821c
SHA1 55f4de8ebe05126d5894b75e0dbcdb275b2a4c35
SHA512 973e8ec17fc527a1d4a775eafa580484f7b8b8f7d04511d12f1a63a36cbd8946a89388086a1a081885c0295c3754df80df9549b6996e9ee6494e93a3f6874a01
SSDEEP 24576:rGq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nLNiXicJFFRGNzj3
TLSH
T1055523D3468854B1FBFD003A867A5828B5845E2C9A595DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 4e8923f63f67980c78e904e0c5aa64639af7b468a8517b998838eb14bfe4d00e
MD5 ffebc73960d70ae0d46121ca04364d56
SHA1 18e726ae5e86c1ca37a4035ee62e263c82123bac
SHA512 d7a881956af72fe1dd28d89f4dff1b9b1916e15bf9b1fe7ae038958025a8331859b69b1240e237f1ff2c15a7984f18ac5485661dd5bfb4258fef04e40130c5fa
SSDEEP 24576:CJIUF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CJIUFLNiXicJFFRGNzj3
TLSH
T10875CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2e5c341f24f58db9fa475e2d6c87e773c9b3fbd72db9cff97988a7f646d8903f
MD5 5fe561d59dc4ddaccbab17cfa46ded87
SHA1 7d226e26220d618a5bbdabbe7e3c5dab6b771d88
SHA512 2883da704c1d2ee900939c64d07b5ccd9fc4537e6d728a0193317ec9ae55afc09500c24fc467576cb6cb99749bba35aa12046928d83614536601da3ffdfe6b29
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THN:7QvGAdlCEL8c/WRNw5CE7wRGpj3
TLSH
T1BD266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e8a5635bd63913bcee0b2d2ddfffeb2a4751c2944dba56574e56dee1a6f6e68e
MD5 50f818d1934be3ec76edde713fb82e37
SHA1 ce2fe8b6fd99779b9a2781b39c104f1a73f5f08a
SHA512 567cc2a27e3fa3bb26db8a8bf866003805a40df66f43414dccc22b837674428ba49a069b629c73fb2af9c1dac9b7b5a307022da0d39ee15c456cdc0794c71e83
SSDEEP 24576:ZfewsAjz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FljzLNiXicJFFRGNzj3
TLSH
T1CE75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 25e72832b7ad3ff65f9c5fe7be2083903fde2529b963834da4f5a135090053bb
MD5 290f36a4a27e9881ac77433a6eb29571
SHA1 eefda932faaaf58ba7e889a38ef38666055b5777
SHA512 665af431ed6addc3cf50b5c0af3265d3aa6b89da2d7c2df1b2920e4bd0ed7adf1e51a379c4586428b91d21f873466dd717e9666ec0e6b0726339d9d880e17e7d
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHPF9:hUEtQevvqc2W1cpV20I3299
TLSH
T110474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 953c083ba356882cdf9eb20f3d3451acd7aed141ea317b8265919b08ea488e05
MD5 450577f5cee46f0854cfe59e8b15cb4f
SHA1 7c894f0cf8c564ceb5a37f38caf52ce3f161b278
SHA512 6c194c1ee733ae172eb751c5aa29515f421ffcf903c08f8f73381c886e07153ffd9adce15c12ad6a353bfa8ea6be2acaef29dc52a2a2cebe17b51258147f5462
SSDEEP 49152:1CbRquA/m2yL5zLfFiV+XenmE3/zTLNiXicJFFRGNzj3:ioq2Vjnm47wRGpj3
TLSH
T1C2D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 70f37a247b9f8c013e4a6ffbe21c8475690a77779347c756f813269255021777
MD5 13d98a991838794ae3adb14bfc0629b7
SHA1 5c81d5402fa77391b1435ae3ef35b06353d42714
SHA512 100ed4ee3cbaa66c615cf24d62fdaafb06c79d19a1ecb05a370fbec611cb963e422082dbb5d90c5908e550b98fe096de5a9a618b8ef08cae1ad120fff1f6185f
SSDEEP 24576:JAhGL6IFoiwtA5l7S53Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JAM5Foiq5oLNiXicJFFRGNzj3
TLSH
T1D2359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 e379144e6d9b27dcbfd96cd97f3876799b8fe1e454063cc960bb788b9090b554
MD5 bc66c3b47c4ad7284800192095824632
SHA1 4a48da2dd14444400d9f8be8f2b558d9c204e203
SHA512 2ea97df4a5bb33279a70e4831f1fa6581799bdb6fbdbc53098726c60d1b00f54f59248f3f588f0b9ef83db41ef856415771abf78c35cc9946e482c801fda5d14
SSDEEP 24576:iwuROWn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iwSO8LNiXicJFFRGNzj3
TLSH
T17365F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 414e4ef7a91d220d7df011c1ea7195957d603e664806d502338255f149908bb2
MD5 4007239f523639d10863f86d859e5441
SHA1 cfcdf514ccc7479d510038ca21150c3fc955b7cf
SHA512 66c49f96e12d8c47f1d7f81399251e62a46faf0b17bdf20393d3a5624586c15dcd320f70a897d9db2b3512d31c3bfe2d4ce784b96a3b689fa441e47f63c84cc5
SSDEEP 24576:8Zum/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QLNiXicJFFRGNzj3
TLSH
T17055129622C820F5E6BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0508ca9be1e73d4e632309d7e802c3a3ea3fdae6e68a70cac694494ff0d7760d
MD5 716afcfdc9dcfb394255de01b51913ad
SHA1 a3b29332153077988b9f157b66953001c5a7e4c5
SHA512 6b10844d2fac8b79f623fa8aa08a7f55b1064524bb362917db9fcd4c355f96ff7e8e17a01b550f2892b16f82b2b801ab83eef5175b951b87b1f58b72cc822378
SSDEEP 98304:DQRQyi36YOcPDLvw2gAf+PN357wRGpj3:SQyiKanX+PN9F9
TLSH
T1DE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a7e58126a214de4ab1662093ec94619d369a3f6e6d11dc33aafde5918e6b3ed3
MD5 1dd8db3664bc21fa79fd22617036f7ab
SHA1 a1407bae8c15ec250889291102629e00863339f0
SHA512 3347d4c322637bcd532adbff6d28a830d8662480534e812cf4f92cad2638cd236c273536a51eef8f9a7d031228eb1105e6727a0ae6f82d5ecf6c55a64fd26e6b
SSDEEP 98304:kQRQyi36YOcPDLvw2gAf+PN357wRGpj3:rQyiKanX+PN9F9
TLSH
T12C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6099c5fdbce201b12435ce686b72ffa945a176e3b205bdfdfdf9bfabe3655839
MD5 aa3dfec49df17fe207b0009e903a9fd7
SHA1 dd4d0343199cde1143050aef2c0dd7821719a2ba
SHA512 5623cc1285cee65371b996fc1238ea057316515d213df0a2690232b57b8da86edd41c1b79d836eaa6973f5fcc35816adca2b62b15a830e33b409a9df55d3b3af
SSDEEP 49152:U68Qg55nhkeWu7PNU3/DLNiXicJFFRGNzj3:+thTRc/D7wRGpj3
TLSH
T1BBB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5ffbd051e0e7cbf732645d287511fd1a95501dcb5f57bf730e5b511f8d2ccae4
MD5 8bc2cd8f088762287c09be0b18d1f3de
SHA1 f88a125c07827144caf499caa185945383b0a17f
SHA512 dbd9fc63da408c579d43513abf521a57134478510ae20ceee8b4d02a9f284df436b5b5e37549ca23c6e2d850cfd8b778191f34d5ede8b7e3fbe2b3426635dcb9
SSDEEP 98304:Sy5112gYy5azzVvU69nLKnhZq7wRGpj3:bLIHRWhsF9
TLSH
T125167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 72e365e1c2f7bd9d13d24612d4f2dc2e62f198f3610760a7ac4910e12ffcb21e
MD5 136e3e73dfe398ffa6f3619df550b34f
SHA1 e977f69ad6cc9b40484f3c598a4dcc9035fdfcf7
SHA512 c269df4d5ef07919ca4c9a4a0575f40d6f58103da8f15d9c02dd403a32512151d672d2377dc97e0c67e5e9747132bad4331a23f3714f4607e6317bb0b543c3e9
SSDEEP 49152:vB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glhLNiXicJFFRGNzj3:Ru6JmIxd2dh7wRGpj3
TLSH
T1A3D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f7eabc70a9b3cc794fcd635cc458c5729c78d77ccd4b7329cc1d96925e8b8720
MD5 ccba30d57187d8e7ba427063362a92b1
SHA1 e273db03c1bcc2b25eb63969ed749249a7d8561e
SHA512 24c2d2f9bbd948a47b5db9f03eb9e7905a648a3931533a9fc10c35703f6606f76946bc170151a73edfa9a00bea7d60bfb4a12cd3d0354944f6401015a1b3fb86
SSDEEP 49152:m1hpsNoJpF1A67U44CwH7R4xlLNiXicJFFRGNzj3:mmifPqR47wRGpj3
TLSH
T164B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a6524742766d7a54578c14d87281b07c352e886d21112f3ca1a351ff990851b6
MD5 9ba58990c60701a0b8dc8113c86703af
SHA1 b0613226841c6bbd947ed1a35650a8aa3b9365d6
SHA512 31f7f1002a7046131e2be150bc7cd7dc466238e82757762d7d31cd51ce20c7d8d3a20a17165ba06665e32aebcc1fccd8c12f16158f3de99924366349880c2065
SSDEEP 49152:SSuZQIY0Be2KkRVtOnks6NMHqmLNiXicJFFRGNzj3:M5dKqi61m7wRGpj3
TLSH
T188C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9c7e6bef420692f054451bddc66659fd160e8d767c0d97f04b3b1f6300b81dad
MD5 f329362fba82258c294bbb36b15a95bc
SHA1 e2e14b31172a7e7d13a250c50762582577a1ba25
SHA512 7fb4cfac06a1b74e1995e59ff292ecf0999c52a0e3576e0aaad54f452b91adbc943c107f7123109eb1176e90b4011b21875eaf5de13e3afea10bc3d73c0e7c49
SSDEEP 49152:ChtSn8EApI0figjgiDn0AP5wRLNiXicJFFRGNzj3:jX2iWphc7wRGpj3
TLSH
T12095BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6501e7b67ca8876e2db1dc19348782147120389b52b5e9d23af099c0c8025d3f
MD5 cb43596c4fd82b80faa807a81e9a864f
SHA1 93f8dc71386abf25308c05740e0bf5366fd728c9
SHA512 cbdf24e62b29ff9aa9f3229de1094bed8c672381226c9dc48bc08c2db5f2ca27ce2937dd425066ca709ab790d285e0e860d508c796d774d27d77ec9ed69fa4bc
SSDEEP 12288:VAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1715523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d48942d5d8fef8248c466d7e825279f954d1ebe3a55c425c8afea5683db52886
MD5 74a93d01c56c56d4c124e1958b6c912f
SHA1 d95fe29fd9fabb446ed36bb43122893ca9061c3a
SHA512 37b60e49d6a1a0214a096c6dfc5babe40526da018ea144212014e34a84de86250711212e61768c41c6c73be865eb31530dc5b090db3fdae39d958e17552cad0e
SSDEEP 12288:4LiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C35523D3548955B1FABC003986754428F5882E2DEB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7629933d2c3b76091ab0def0c0934d015979f1db91dc89dc2ab8c323208e894e
MD5 adfd3c3eea176829c1031e5cfe3dcba5
SHA1 9c8f829efd5e9ad21773a132c8262c43b58dcf7d
SHA512 74230c5909d8b1a946d1a7b9bb3bf2ff97c0c9ccf070119a485dcfe84780c133cc8128f9a7d9f221ce9f2d4112691fc5e44f4498c4b609ff903682043095b134
SSDEEP 12288:GBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16F5523D3548955B1F6FC0039C6754428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1a2855a3980fc651470bb0b68fa70b1bc4af1975aa353e167a26f3b32f1f18f0
MD5 00e28af000ae4f73fab12b66e6571711
SHA1 ff20a6e9ea7887e064ded26f15f2b73808ab4b2d
SHA512 192c4ee6b53eaebd8f87be324d223706b8ecd6c7e3095e824da1d3cb8ddcc1bcf7aee6f925950f08fb6913192c9a77e016e17f7672b6c0b2a285bc142661e5eb
SSDEEP 12288:3VOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C4552393168901F1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A74BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 da5135bf452971d9bddb99b8590b42893b643ef1527bb99d59795cc54440014f
MD5 360b78039805fa19bdafb7e4ea4a9d44
SHA1 e80d672214935371c72067d0a6c0096e11bec30c
SHA512 af6d0b589d4eb622e62333c9f2d28bd2ae3e85493ef4c64ff0864a19e1434541ef5473cd80f1338f8f4502500010d81c885a6cc41fc3e57c933fcabb4a1ebd4b
SSDEEP 12288:pmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D65523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e4a482424d41b329a456bc5b8787f190bd98339d6aba7cc2d21a8b8ff265b50f
MD5 bbe61b565f4f4bc41d1f0f5dfb05996c
SHA1 8a40201807ceac5cfe73b2389b9fee167da55c95
SHA512 1f3b1a20c5b9635fe889eddecfc76a3834575cebffa17422864e1fe5e14a6ac2821c2783221ed29c884b15b7041a63a5e71bc304e3aed5b3e3a04b899738d8bb
SSDEEP 12288:qviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3558955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 db97de3b54a090349f50321c2e307140fdaab36c17db4d4de2d7af4147357574
MD5 3185b85764940cf9ce897960c319e066
SHA1 fa1a8516967eeadeeb82690c0d3a099006bfe1f1
SHA512 f9604b5ad8f7f8b1e40167674e287329797059b08266b1a18ed594263726d9382c49c2f97f7b5071b8e8b56968fbae0de4841df469a7d576fca05ac24a610ef8
SSDEEP 12288:sDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED5523D3548955B1FAFC003986754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 321c7e0ddfbeeb326797148c4a1652e5398abb5847c6ed57a6f2dc69a5cfc755
MD5 ff11742c035bdde6f48ebb1356a92a0f
SHA1 4b6f06ca97cd2b6d966291ec13f575d0cc328890
SHA512 72b3253d3486d959525eda7b0c88ce5268062bacac87ce34602a8edbc0f1d1e2a5fe382fec61acb13d723aeb2c342c17952f4c485bdd7f760c8ed9d80de10615
SSDEEP 24576:cZM3zFVSO//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cZM3zfLLNiXicJFFRGNzj3
TLSH
T1FD750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8d5ac35b2a04db71cd9f135b915c8ebc3135d0e980e346947c0080171c95189f
MD5 d9961528ffca0fbc9259c2653e62f8f8
SHA1 67da6d58355bde52247fe0ac3caefa5027b71a19
SHA512 3bb6fdfaa16d9aea013540d326618d6b38e1ca08b0b62d26a2e18b07f35621b26204d10ab1b726527b9fb8f4f17719e00fd26ada4ccedcbeb948fec288be0f07
SSDEEP 12288:ksiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1685523D3548955B1FAFC0039C6754428F5886E2DEB5619E3E2083D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 603b6526ab0f059d22c8c59955d51a04862dcf69b2da389471b898e6d475879b
MD5 ef50a1144f044cb172edddaf2df7335f
SHA1 6cc1865863c4a30fe41d1d5f3d2518e70e5b4fc9
SHA512 eec5ea3d0cc10457a3ec16556bf43bf6933130922682b4c2bf1229aba8241f7055ff08823a67c616b621a9106d2d09cf431fb73c73ae35ae173141375ef363e9
SSDEEP 12288:XoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C75523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 53caaad44a166546e248d4965d1d2908834deba80618c85018f1e989100fb3f8
MD5 a38216226c961f859610343eb4737531
SHA1 90ebc7e72607460e878be42461035a9f870f3c81
SHA512 19e652e3e5bb1de06f6144a48a9ee388495e046927201a7fe842b10d26c15f52608f535b66f737042d21f6c576de3ef14369673162ea7ac44386edfe662f71db
SSDEEP 24576:Lzyj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LcLNiXicJFFRGNzj3
TLSH
T1A9650147629530F9E17A8139C9620911F3717C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 761a3d7fb5a30d0788f4c7642dc332e02340366dd8446ce0f93d7083b99faa35
MD5 24b5392cbc624841d08a0d0226590e94
SHA1 0f3641d6bdb1230fd82dbc3ab70dc75f3aceaacb
SHA512 888af84eec9b1b7d943dfaacece29b74d5b23a48489698a401025a74f60ebed67f9fc26b15d157f57e39ad56c371dc539791c52623abfcae32e6113c82dbdc91
SSDEEP 12288:ZsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AF5523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d9c9634e55aeaf0650288c2d3e2cd11c07f901e44370039b90685960d2867575
MD5 87258719c2bca1912945b6bb6e67bb56
SHA1 0b3c2f5f1dbbef9cfb2f7a59c540f5427134c6e4
SHA512 a808367e00f020da17cd0c1fe2a54e6d7b7bd01f9d10b9a3ab15b2f12afcdc3d639a2406bf48ca201cd7fce57948b3bcb13e3c3594544eed4dfeb53ef40d0ce3
SSDEEP 12288:LsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1655523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a78a13665a0dabe1bc871a0182756633251373f83f2bc1577c65e65f159b7165
MD5 a944ea345188e59601a727e5eea3189a
SHA1 e30e3da02b69edb4b78395cd4c6501e6f93053bd
SHA512 bdfdf3b7151fd3662586e4063a77fa742b704e996bd3140c6848c6a82c7b125b548b49449148669be802b13ecbbc15025f18a739159f7abfe99f46dae4a59d81
SSDEEP 24576:vzyj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vcLNiXicJFFRGNzj3
TLSH
T114650147629530F9E17A8139C9620911F3757C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 acee3e5977e877f1aaa183ff8d812736ba2d91372cbb85ee9ad7fc894aec0d07
MD5 f3ad221b902dde1d02fa719f05c1a861
SHA1 f8911cabfb872711b5d484e5a704b705b954ba7b
SHA512 cec2f62f0ddf74261057550ef9464b34e2f646b00059d8b3c6fbc06eaa072b1ba66fa2ef5f61a3ddafb4b6d9b1ec5d28633716336c4f8a614d82299039f0d9a9
SSDEEP 24576:icP4mcvIjkGOxhKP2l71nNKbrh/8KBO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NP4m4IpOO67W8KELNiXicJFFRGNzj3
TLSH
T13D65AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d805094dfb454a78223d95588a51bf4027d28df790bc24189ffe2505176a377a
MD5 27bd3cc76775db919f4d1d5feb221336
SHA1 fbd2c1b6805290a4e615496327e5d0a9ebbd1c43
SHA512 6f35b75e03fca994d6bdab20735b64facb94c2a6fd6da612ebdfb26a05e787cf54b7b88633bb7266fb6155c6cb553933be5421f2081a44ed02f5f35d933664bd
SSDEEP 12288:LpsfciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19265F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 df0ac0f263f04ed4a88d3753522deeea34440509c73c1cc970af5001fa885de3
MD5 798c57ee0762fb345fd50c1877e72b31
SHA1 811ab9679811e39c874fea8e2e7d75c3992270bf
SHA512 b0859009206425368a4de0dca0eaf55fc4cbd50569cf8cd32de5df80860048495620f7f499af0c93546811ae5898698abbab569a5911653f832055b6fa0d0a75
SSDEEP 12288:X8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F3552393568C5962FAFD103945368438B5497E3C9F1599D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a0d4835503371129d2d6e072012d892a08f7d6d0f3ad0ec5bbebd33c0b679431
MD5 8f6d093a4d5761c8a00a1eaeb403832f
SHA1 7a69c7161dc28ba7c52ed67747a9dfe3492fd33d
SHA512 091e8818ce33477c55d42275544feff44fb43ed7cba4bf6dc56c82fcd7fce593fc5febe29952f2cc83fcad2f0210316946378dec9946eb7daf69aa48fbd44f07
SSDEEP 49152:Sa0h2GEkuAe73q3pp46zwwQQLNiXicJFFRGNzj3:Sa0hNYG4Jwr7wRGpj3
TLSH
T19A85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 4a56fd53ef8d3ec88be6fe75a1966c6fb178e53a9fc859c0223ea0c976ca59bb
MD5 1b88b6839304adb4d91adb6bfd72e96b
SHA1 5b13a65102f4e3964ef6989b55c7d75c663defbd
SHA512 8193cce96dd58a26afb1b5dcf78e31d585ea618b6cff052be1ceaa2ce781c79f06da5f194c0f6ffb206a50e1a26f36673392a8303623668553607277344fa4a4
SSDEEP 24576:whbHjPv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:whbHj3LNiXicJFFRGNzj3
TLSH
T1195512BE169C20E5F5B5903D8666840AD370BC29172193EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d4805fbbc607dcdc38e04547fac5b000796b509dc270efb00c14e4262dd8de04
MD5 3178b649111f157dcd962760e08954dc
SHA1 cde33f0a808e60a285c6ee884ab29dc88b50dfc5
SHA512 037ea1b5a5aec37cb90fc8f7c51774b254c25053fd46034592081f9df2d5fc28acca71af50407d98ca7c7e5a7070c8d71aee238fccdbfee9ed6275b68b5682c7
SSDEEP 24576:o3YgnJcRTk4yti+R5dBR/n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oIgnaTk46pBR/nLNiXicJFFRGNzj3
TLSH
T1F045B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 adecdadbb596eb54c51858d77c938a761e1c413e4af60f7adadb4521e6ac270c
MD5 67c4e610ca0101fa199edd4bd97ed1c2
SHA1 d83e85b91fb475e082a5cdb63f43bcd7d379a23a
SHA512 3b9498e2cee4aa3d92d59672fbccdfa4ac622733b4e2a74deb7d92da99b6b7b3ad3038bcf86f44f7949d0c2cd414d637f7d2612ff46c1baf4200bfdc28ba9071
SSDEEP 12288:T4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED5523D2518959B1EAFD003E86764428B5486F2C9B2619E3E1543D1EA27CFEFCF38163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 eaa4e34c69d2ae4f906ffebb379c09ece57de83f9fd2a9ee2fab87684eb905f4
MD5 f9de91a788e8b79d371da9a88adc3231
SHA1 17517287de89d77fda2c4e2c952d159cf11db383
SHA512 933548013ba741ddde1d43a3a6951de07148cd067e1c20d4e5e02c5ffcadcaa1076dd352ad489c8b5bdd32bfdb859522d0cff5d4184c23125907fb364e08e2b4
SSDEEP 24576:yAL3UTR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yAL3UFLNiXicJFFRGNzj3
TLSH
T15D750155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 1e2dd0eeb1f9584e94e5744188889a5c614e6aa44c84562cbf3581b0ac86daa6
MD5 07deb32cc6be40a53d61a5a02744d342
SHA1 bbcaca00f41bbde12e652925bac411f70a794d48
SHA512 f7f1174b58ea65d402acd797de3d6c690056ccc6e9fc1596f504488fecf2027e7a0deb29901f3861bc2ae6d94b71fd7a93ff37a4f0b733fed9c3a7ac4f66962f
SSDEEP 24576:9Ol/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9OlLNiXicJFFRGNzj3
TLSH
T1A655125A32DC10F4E5B9903D8AA2820CE371BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 09cdffdd08056855a746e27b844c8d8adf067eda18a9e8c24c544bba5bf82657
MD5 3d41039319a9a5da32efb816e109b303
SHA1 510cb74b69141478dee2a65af96c5f298f98fbe2
SHA512 fac5aaa43f2fd1def81b3db5502559f187449105247c2eafab48786e5a9f3f57abf6d9a0c0d637ac7b05d7e8ff56baa364ca1d08ec670248cb47a09bb3d0e17a
SSDEEP 24576:Z7NM9YqZqmWMUkPjZM48Mv6bEhsW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Z7cBWMpPjN8DbEhPLNiXicJFFRGNzj3
TLSH
T13365AE2E6BEC81E5D477D13DC9A28205F6F1B8611B318ACB5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 39eb8e0793355ea2c563377dbbb97253bd428aaa691225f3c6bc8d3ce088bf47
MD5 0379a4a8392b6b9af1a53a0318d068b5
SHA1 23a0f41305d94088de1c3d91b2357585907a5be0
SHA512 481121b05877177c8f6757d546e38cb1dcdc46a2fedcb7da1a20307a6ccce65e80233ff2b83ecf206ca35e854991cbf802016c598d15e561739cfd571646a396
SSDEEP 49152:MF2YuHNETovAvNYf8km2LNiXicJFFRGNzj3:p6BCf8kl7wRGpj3
TLSH
T1E1858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 594d39543781417b19d33bffe0dbcf379e02ad551dab64d0e133c5c20ab40a3a
MD5 9427d37beb9a633388d3486487ee8684
SHA1 722fef8edcc6afb52dc8a4c60df6f825272f0d2b
SHA512 1721704372464ce01c86d2c22a0e3dfce80c031c89029db7b4e0cb5e680a9c36a1a0278d7f0722eec4f38f3ac34f28f1b71e678068af1a328feaaa9b6f8104c9
SSDEEP 24576:1AFs06+Omlf8NXEbToZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6Fs060loXuwLNiXicJFFRGNzj3
TLSH
T16B65BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 a3c864b0fd17a4e2ffc4ea5c2c4e3682fd11de2462b7c60b6ce741fa588d11ff
MD5 5f3db48e208c8843514fa9e864aa153f
SHA1 269fa530d19c219ee7a47de3a3bd9f0b0b6a816f
SHA512 0762fc9e6a3ffe696130448877f1596a38c795ff7b6d90030c830ee11171eca167f3db826d410782611ec4a63ab74aba3b164c11667cb6d341fc19fbb390690c
SSDEEP 24576:iJnJ5D3WXw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iJnJ5DGXwLNiXicJFFRGNzj3
TLSH
T12475D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d0eb34234d498c8957f96b8a633faf56502bed4410490bf987b53454e11034df
MD5 4113dc5213ea395664a4013148cb0d81
SHA1 b30d4a7ed28717451d5ac6f930075e4c0cbd3a24
SHA512 aa95d513da7590f1a5c42287b1b3fcc86d9142a3ef74403ed60cc0b002c9a3ffcf482abb107557b280be83947f22f7e2c44210c55b00a794021e0738bd7f1842
SSDEEP 49152:bg06DIKdwc+eQnSt65aVSLNiXicJFFRGNzj3:UM7wRGpj3
TLSH
T1D1956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 eac0da0baed036c96df0815430c1bcdff851d32ab62a9f010464dfa925180a37
MD5 e78cf075aee7285250d0d79953c0f94a
SHA1 09d721e21ad44d2bd4cd37bd17be468a99bd8a42
SHA512 62cd4b3e21a0aa5502de3e90fbbe55065671bb68328cae22b3772f04e1ce0360d6be2067087871d0a2ec4012ef3210adb07812184ee2aa55c19cb553f38f9e58
SSDEEP 24576:3n0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3n0LNiXicJFFRGNzj3
TLSH
T1455512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 0e7f4d10985b0924e74cd4c3c93dfcaedc26aa2b484ad0c521620963d63a6903
MD5 f89e62c25cd748dbe4f130a85ef8ab72
SHA1 75cdbf943ade62766bea75e49e39abda54f5e3aa
SHA512 aa0ea6e17793b9b0912679df51f001204559901e07b80777ad76534fb7cd281ace6afbe36bb270c16f2eda536f9b9c0ef1db06a7c54042e8bfe92ac3795a3b16
SSDEEP 24576:5Iyf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5IALNiXicJFFRGNzj3
TLSH
T13B65124553C860E5EAB9013CCA734064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 d53f776bf3384043816d8d5643dcb9442ef769c6a9aafebad532ae886ef623b3
MD5 61b4575c5da9a5aee0add72b3dc235ff
SHA1 0189e0c534a2ee70d1005151e3f16617f36fb872
SHA512 018bc2b4a034c472ed938db7137db8a20f1c3c0cb7879b94e81e80d081c6bd936e137bbd1e52cea974fe5b7897119deec0ba7a32adc8f4bf98e3eb906b0297f8
SSDEEP 12288:OyJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A555239A118964B1FABD003D86364824F1543E3C9B2628F7A194793ED379FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 525a65738ad3e686a8f612c71e77a0c9c013165de1947ca861360428127603bf
MD5 73c37be5b6566f0ebe5ff0e7d988b37c
SHA1 7b181a8b3096d553790c218f689ccc15dc7c5cd8
SHA512 43f1b53b081fa1501ace5f97803e5dbd6446a57fcecc48cb695b9a8d01ae25de09b1a831ec70cdcaca0b8e131e604ab00c42e36c6ba08d79309a90d13ccb75a0
SSDEEP 24576:pQ9MxZKdcz9dw3e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pVKZeLNiXicJFFRGNzj3
TLSH
T157558D2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 3e79f7bc72c17a123b46928619854077ed5b0437511ff55307ac4a1594cf6190
MD5 6b28585d3fcdede031108c1a795228c6
SHA1 587bfce49ec9cae0e87f1cef4cca7204155fb2ae
SHA512 c31e40aa73d56b7e2e974e27dc68479b93821b8e65be9e62ecf14e18d866988a17e51bede7fa572ca4020e8c988718bb3c5acd737340ff8cca9ab4b6856336ba
SSDEEP 24576:DyocDApz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mocDApzLNiXicJFFRGNzj3
TLSH
T1DB65E05FB76D40A2E176813C89858204E773B4345B6257CB6291C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 125a5c5828bb9da9222c778ccb2b137638716dc10c81611635095e53ef615a3e
MD5 03b087b6f12c21b451ad8b19e4cccf4b
SHA1 6c8b89a4213b91726b06ca1131aac610bad888fb
SHA512 7d436944fe6f1734c9f72dbde009a7061bd677ef2fab6e33fb306857c5900fb8b1f57e2e972568609e550c5e5c8da03fca6ce1130df23891475461243749c5cc
SSDEEP 49152:CWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKzLNiXicJFFRGNzj3:00zuNIR7wRGpj3
TLSH
T1FBA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1dfa7856c3cca82284f696658b7f93b408257ce33a89229b325114796473723c
MD5 a6d553527c1b28b3ac0dc4eab5c2fafa
SHA1 0b724dd3f327bc0d5193461f5082c34e618a5d24
SHA512 5cdbb79256ae59b98de6006761f8c4c8e845259188ef30e8e485fd97740c4aa79fc4f3ed4284daefebf0df92fd8c523eb49dc699ebda2605f75a65b6c7132790
SSDEEP 24576:I1QT7EcpfxR+N5AWAz3ooiYzjMqb0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1TDxR+N5YzTBjMFLNiXicJFFRGNzj3
TLSH
T19F55B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 928cd352e368971a60683408561efcd81e95f4dc33d22db12fef3a107a2d1a8c
MD5 3225df9f72d865b68067fce5346be914
SHA1 f795e0f3a3d001e42de22901740b12bf10d21269
SHA512 04fba4c24128a27d00a79f9924603559ca6bf127903b0ae36570f5b1b04215531032223b32b99b9c67365769f443383ca0e6b3622b14515fb33ce5ee473f6706
SSDEEP 24576:VTMdOz0FFS+UmSL4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:P0K+UmSL4LNiXicJFFRGNzj3
TLSH
T1AA75E17EA39D14E5E47AC17DC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 b6bb93c5a5f033c388d37ff5201d7c47bbde9ce6bcb9500a6260f1b11352c91e
MD5 6a17cfa328814ed47e6fde8ec598f28e
SHA1 2fd1285580652e2cbaaf68df977f443e783219be
SHA512 353775b475edb2a8b9ae620192e9a2b3c755ea801621ed48ceff1fecb5511ccc800eaf34cf145906deaa924c4e1aae63d4479a0bdf2c9fc8e003707d2e184325
SSDEEP 12288:s4KNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10755125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0A97E9B36FDACE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/64-93-0x00000000005F0000-0x0000000000656000-memory.dmp

Download

memory/64-188-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/64-98-0x00000000005F0000-0x0000000000656000-memory.dmp

Download

memory/544-202-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/688-194-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1500-120-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/1500-197-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1500-126-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/1628-115-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1628-109-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1628-196-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1632-133-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1692-365-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-367-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-351-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-361-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-360-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-359-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-377-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-376-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-375-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-374-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-373-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-372-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-371-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-370-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-369-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-368-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-364-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-346-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-347-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-366-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-357-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-362-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-358-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-363-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-356-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-355-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-378-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-384-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-383-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-381-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-382-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-380-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-379-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-354-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-353-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-352-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-350-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-349-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/1692-348-0x0000020982EC0000-0x0000020982ED0000-memory.dmp

Download

memory/2056-206-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2056-429-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2056-155-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2056-344-0x000000000CDA0000-0x000000000CDA8000-memory.dmp

Download

memory/2056-199-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2056-171-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2080-207-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2080-70-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2080-76-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2092-192-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/2252-19-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2252-25-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2252-13-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2284-427-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2284-193-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2392-63-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2392-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2392-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2392-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2752-201-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3928-24-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4476-151-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4632-88-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4632-82-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4632-153-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/5048-29-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5048-35-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5048-64-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5084-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5084-66-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5084-39-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5196-198-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/5292-203-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5516-58-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/6000-205-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/6000-428-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/6012-57-0x0000000000400000-0x0000000002454000-memory.dmp

Download

memory/6012-1-0x00000000041F0000-0x0000000004256000-memory.dmp

Download

memory/6012-426-0x0000000000400000-0x0000000002454000-memory.dmp

Download

memory/6012-21-0x0000000000400000-0x0000000002454000-memory.dmp

Download

memory/6012-5-0x00000000041F0000-0x0000000004256000-memory.dmp

Download