d2fa0310442bea3367741d078296dd8f17b12fddc387201313e9172690cd3d5d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Size 2.8MB
Sample260711-glpyfacv6p
SHA256 d2fa0310442bea3367741d078296dd8f17b12fddc387201313e9172690cd3d5d
MD5 86695f6b43d723c427a9b001e8c10a10
SHA1 0ae6def376c5a4e1333a4eb9b59085929644a5e8
SHA512 95fb121c67886575d929c905315460db9b29fd0c0ca331ff1fb87cfaf09e4e76538d2b288c2ecea5f49adf9963e53f4f16691c3cc2b8813fc945e587d6964aff
SSDEEP 49152:dckCO6uRycRUAMHryl0+h6T/8RQ4EsFlt0bYLAxHfJvYrPs9HHC:dYcyGKM0k69oEjgrExHC
TLSH
T18AD5AE223911C536D55231F58D78AA6E956CAE2007121AD7A3F43A1EAF701C3EF3729F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4904	alg.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
2608	fxssvc.exe
3228	elevation_service.exe
3764	elevation_service.exe
4676	maintenanceservice.exe
1624	msdtc.exe
1536	OSE.EXE
2124	PerceptionSimulationService.exe
3384	perfhost.exe
3020	locator.exe
5828	SensorDataService.exe
3064	snmptrap.exe
6132	spectrum.exe
5892	ssh-agent.exe
5692	TieringEngineService.exe
2756	AgentService.exe
3168	vds.exe
516	vssvc.exe
3872	wbengine.exe
1836	WmiApSrv.exe
2180	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3fbaf6965a3b5d25.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb5378b4f910dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f046ab4f910dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c573ab4f910dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079f337b4f910dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e9fa5b4f910dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a80a9b5f910dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000628f19b6f910dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeAuditPrivilege	2608	fxssvc.exe
Token: SeRestorePrivilege	5692	TieringEngineService.exe
Token: SeManageVolumePrivilege	5692	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2756	AgentService.exe
Token: SeBackupPrivilege	516	vssvc.exe
Token: SeRestorePrivilege	516	vssvc.exe
Token: SeAuditPrivilege	516	vssvc.exe
Token: SeBackupPrivilege	3872	wbengine.exe
Token: SeRestorePrivilege	3872	wbengine.exe
Token: SeSecurityPrivilege	3872	wbengine.exe
Token: 33	2180	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2180	SearchIndexer.exe
Token: SeDebugPrivilege	4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	4736	2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeDebugPrivilege	4896	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3228	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2244	2180	SearchIndexer.exe	112
PID 2180 wrote to memory of 5052	2180	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_86695f6b43d723c427a9b001e8c10a10_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5948

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3764

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4676

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1624

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1536

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2124

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3384

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5828

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3064

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6132

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1740

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5692

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3168

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:516

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1836

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2244
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e532ba4efa680035d3a247d343600ae7e8dd91ece426a90239b5c0e76d4812b0
MD5 f560a86a5807541d7171c0b541809dca
SHA1 6be0c04dd267a1194c6f9b5f6afc1cf2099fadc3
SHA512 94ebe27e9a73ad936fcd796cb3fdacb68c53a7f097078b947e7aa09f7221276ab53ec5f833edbe9ac94add6f5719bdd76e09fb8d210da1e72a5086bef404433f
SSDEEP 49152:Eb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4xHfJvYrPs9HHC:+3q6sjB1grExHC
TLSH
T1E3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 332ed784a298d60a9f2aaf2d3fe795a27543b4f0656f53613dab0a7c0c38db86
MD5 0eb329ed630c526088188a9ce9237173
SHA1 161c40301ee41a2ca955f3e8e76208126c797147
SHA512 0dbe52bd875bb93fee28a04873898ed4a75fc24725a3fba111dda20f33be3424f681f8b0413968a698596e0f580f0a41541999e4016bd98577e42104e0d74a8a
SSDEEP 24576:qXYfDtczABxHfJaMJWTTXPPC1X9qSH9Y6VyP:xtcmxHfJvYrPs9HHC
TLSH
T16475022877E509F9ED27827DC8A28111EA337C5547A0E7CB03A499661F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 251766b8a286bb887a5c0a32511fc48fb02d4f548312c6e01ccb6be6fa87328c
MD5 b52c1d1607041557fcd36c99fc107807
SHA1 0c2373c99c503ac247af662d3aca7620bc8b53dd
SHA512 0e2731ae6bfb069721580c7d9b027c311a751cd0c7e19a33318d59fea7a6e68cab03365a756ef2130d3f43e4999d137fb026d8da9ca8e86af0e512e78e8a2c26
SSDEEP 24576:W0Le5ji0hmxxrMAxHfJaMJWTTXPPC1X9qSH9Y6VyP:WPji0AjDxHfJvYrPs9HHC
TLSH
T19D859E16F6748335D073C0B9C5D2A69EE97130865B308ACB0286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 48c16c52fc7f5b79eab3af933a075d9fde6d841e1072d560f8a776fd99ae7297
MD5 0dbc7799823b3bb1d05bc2be0b81f0b5
SHA1 0dab4cac59087a30b19cc8fe57381125acea2edc
SHA512 26e7b619abd2630644d9c80dd19e0adf0170db535b72de51f1f5588ba389f1c1426748f95cebed1bda9faeee7517abe50c51e4d8ac6317bc9f4abd4c1af8d747
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWn6q8wyu2xHfJaMJWTTXPPC1X9qSH9Y6VyP:S/ezSC6vUzPveHjy/xHfJvYrPs9HHC
TLSH
T1B4755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8cf734d92d33b149b072157152f5ccb70dfc82949d3463812ca182172683115f
MD5 673856659320f5dfd5c444cb262a948e
SHA1 21653b4a2ba0f1da5a63834d6b5a078eef5aee3e
SHA512 aea758b09e9bf9d6b36e2d9a743ef9f64fe60c9e682a8f3cd7a5d9482dff2bf319b5f52d77fe2b37a3b70e0387a353c93192cee164abea67c57632f6de6a342a
SSDEEP 24576:TVbqPb88hv/l+YFxHfJaMJWTTXPPC1X9qSH9Y6VyP:TVO88hXl+OxHfJvYrPs9HHC
TLSH
T1C5559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8162f3d50082125076abaf7d7d1885465338f64b79e3e73cee1758f9274af7cf
MD5 e47553d7fc706279b3063073c646ac25
SHA1 f0aaf36eeac146a11a046cae1465dc1ebf88a898
SHA512 daec6e620049b8ad915e6ca245dac56abd440be242669e7b4c7d14e0681309ae06850d0098e9b0b02df2120217385876767fd3ab6930d623e762f71d11f47b2e
SSDEEP 12288:xLUxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:xLUxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T172552356DEEE9375EF21037605E762580852BD6DABC7990A1003BCCF263A7A5D00F8B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0520c504a1bae5e772dc15b8cdff576625be13b65a552628d36bfe5a52d68e6c
MD5 e3da0d424502e26694f9c06622c339c7
SHA1 1cd9622190bcad52d101c3a1401d4d55ebbe7892
SHA512 06c8213f9b25af65437b0bdeee35c41e9f82f848947385002382318848e0aea7cebc905dd6035c687262a04905f6bbecd72f7dff3a5e9faa620e02623531cec1
SSDEEP 12288:weBNUbTVO86UNxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyV:wJIUNxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T17275C03BEE28FCE2C67A4DB95A918340977278304F52A3CBD165C20EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ba01a746c6175152a712d486a45ad234b56e334f0593ab3ae9cea5eda416d9ae
MD5 5ec3d34610ba93c7301010e42be2e7a5
SHA1 30153d19bc4a8101cb2ae4ba1f6a54c8dd8e60de
SHA512 f2ede89a861e45fe4ad362bd39119bec12b907c1d091e37e0585ece5411476c8d8d53a551e890adf8a1cb1be9764685f2d2d31b4702b6f475bbf323c7441a330
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THS:8QvGAdlCEL8c/DRNw5CGgrExHC
TLSH
T169267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 114b4911987a08dc1c1bb1b69aa985fc9f3f672931ff2a3fad934efc07764273
MD5 5cc49710b7769976eebe129f4fcc36aa
SHA1 6eb779ea5056241901f729d065e050bbb3b55d85
SHA512 3de7fe2e467512584f8116b353344ba92d10685abce1c6e4b0f8557e2ef1eff3a015266ab8059b8e41b6cb60e24f56070fb57cf17866d2babd1e8d460d29d87d
SSDEEP 24576:w0ewsAjTxHfJaMJWTTXPPC1X9qSH9Y6VyP:1ljTxHfJvYrPs9HHC
TLSH
T12775E031FE75E036C77B0DB61B26C716146DB9204F9219C3E3A89D8E59342D2237AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b8131d6d497b6e3fc1549d2a5b4276add938f27bc96266ed2ec570be9fdbcf1b
MD5 524f76065bbf4eddd6b8672a7242ed69
SHA1 c7c7a10a2c4892fa7921bf5b6053c581940d7323
SHA512 55633d85ef28a43165df4bb79291c5acfb2a99d08b98e4f3a244bd14f1a707fe188a63cbd7fe74c9ba25db4650007fd90b931357bb8598e05969205d73f440a7
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHrgQH:pUEtQevvqc2W1cpV2tI320y
TLSH
T174474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2a7be4a593997bfcb919bf36eca713acf4596890255440aba7f4acda60c72496
MD5 99d5f29cc394aa4c396d735fe758518e
SHA1 f42a5efe873da9df31279049175a705c94f65886
SHA512 4334fcc00b56eba9732950867685ba65c68f1e436a43d559bc4062cae9eec785c4f11f197240aaf701d4ba8a0feee444977af11240f8ac93af98f55aaebaf24c
SSDEEP 49152:pCbRquA/m2yL5zLfFiV+XenmE3/zzxHfJvYrPs9HHC:moq2VjnmCgrExHC
TLSH
T100D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9c319327043bc0a3e4d24dd3500d3330d5d7ab723b9144d3b643481529a145d4
MD5 9d52c0fff455cde5e9766e22ec67990c
SHA1 62b19ea6cc4bbc38671cb914da2ef7cab17df618
SHA512 cc380448b96176a22672f3e03d33bb82f8021ae1f5ffa55e73275434c96fee6cc7f1e5aee8fd20ccbffc66631c22ae9d6a0ce4acb67271f9b8008e5e80aaee4d
SSDEEP 24576:dAhGL3IFoiwtA5l7S53ixHfJaMJWTTXPPC1X9qSH9Y6VyP:dAMUFoiq5SxHfJvYrPs9HHC
TLSH
T14435AE81EBF955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0accbac0001cc3dd08d04557027527975b9e7a2d2690afecfab2a8e52f9e5428
MD5 af5c4fd4194800911674115ef726d425
SHA1 acdc7693abe3cd8ae37233383ba8509163a82b07
SHA512 a86f53272bab584871e6012bf9f3d743dcf071ba6317e8cfe06dca33720ff101fddc46084d7719a619ba5c6e4fcfe6a93a32dc1f1563009d63d73c30910fda5d
SSDEEP 24576:dwu4OWfxHfJaMJWTTXPPC1X9qSH9Y6VyP:dwvO+xHfJvYrPs9HHC
TLSH
T13C65F14676E90CF9E96742398597C135E7F2BC022A62DB1F1360C64B6F37361AD1EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 35179bcea1313fb90a00b7de1ea79d90ee098ff18ece747b5ef2ba7195ba7d4e
MD5 7b03be95e737d2bf377ab4b2b596d287
SHA1 a2c29348b1783880d4cb2fb1c4fe9a5723bb08f3
SHA512 b5379db41a2a517f1c7216e18331be50a7e2f28ed4ee9d08f67186eeab9de3e3d885ab2e3bca6d14d76a6c0e78a1c826176f38456ae9170dc3cc7a5057f7f183
SSDEEP 12288:feZ1IyjxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:GZuIxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1BE55125A36E861F9E663427D88E252048772786667B343CF1111A68B2F33BD15D3EB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 91b181ec3fa26fc127b9225229553591063085f0356aad7d3cf04f9db47bd1c2
MD5 dc90aade7e6dab7b8aab691bcf84a00b
SHA1 7d48043835b9655985ccd7406586b21c28f39fa1
SHA512 2a114b97c1787f27eab533d5984a968a2febf0fbc89146f8873b83e575931db8a170b26bb91cea7542f1f65a31ea114060751ff9e0db7f99ce38a53b034d6dd7
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:/QRQyi36YOcPbLvw2gAf+PN3pgrExHC
TLSH
T1CC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2ce793ebc739c4b888cc8eade9064ce32450ca7aab71b07260304e86c40a41ec
MD5 33624fa457047e62aa3b614dc5770335
SHA1 fb85d485b75504d3de83e624f152c880c5d2b4b0
SHA512 8d4d20fa641fabf950ee8e64ad641a3819a4c4a3400d2b63c13e2a747d25ad8ecaace0d006869a2b30e19538fc3dcabc99cc1b8befabaca97032c7d9981982a2
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:cQRQyi36YOcPbLvw2gAf+PN3pgrExHC
TLSH
T153667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bb1f9dcde60386795a3d06fe85669f1706da89e659c10daf72301ed6431665bd
MD5 b73704e8238eb66950a15747fa49e300
SHA1 59b25d158065368efa34f44921f2e01506867fff
SHA512 6686b139f8d860629157b7668d3a12d7cef0308175964c5054b0f05497cc735b1b1e92f9c97eca3764a6c8a55fde87b57257feda11812c4d0dc5f718526f10a8
SSDEEP 49152:X68Qg55nhceWu7PNU3/DxHfJvYrPs9HHC:BthLRc/DgrExHC
TLSH
T19EB54933B2F600A9C44DD1769F4A872196D27C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 54fe82694f62a69552cb9a7d3e8790545a0143bbd259d4923ff43040d3f43f69
MD5 0270461a2791f2ac06826b6afdd224bd
SHA1 3328a55fc28638a5d72edb562178da81816e07d6
SHA512 58856f425f0eec1f17bb3fec61aba220da80ddabb5d5f679e25234a2b5fd53f5052088f04d1bf4d5c0340aa0fb41adc6c02a3832bf460d702c44fea7fdae6f70
SSDEEP 49152:j3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99:2y5112gYy5azzVvt69nLKnhZUgrExHC
TLSH
T15C167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e76a9ce541d6f1f72e8c8a1b7a85de1fe603a12383601e5c4786c15a3d64fe28
MD5 4db1b93d24b4a823ee08dd0373b3186b
SHA1 e3b2da7160eb42cef82d8319fa12b4e8adf5793b
SHA512 bad228134a5f2f855ba454722a5e5730c7eeb8fefc658ad46b01ac594335fac6a9df9a962cc36d26b4e658b1851c025b1ec60b56d161768e3ea6c17e4f609991
SSDEEP 49152:rB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glxxHfJvYrPs9HHC:9u6Jmdxd2dxgrExHC
TLSH
T14DD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 65f650151320da2ff42b2d160d305b1c9bfbfb8af154b24227a59b5861d34742
MD5 c0e5d5ed2ddaca3690a4aea05fe03141
SHA1 1ad189f5fd93e1572f7248d114007f391f7014c6
SHA512 8ff0b8a7ec03420e5765a515e2e3596d880015d23511261eb898ad2f551c5431fbe19cca7ecacfba872704528b56112ecde92c7beea200bec969105cefb318f5
SSDEEP 49152:J1hpsNoJpF1A63U44CwH7R4xtxHfJvYrPs9HHC:JmifPWRCgrExHC
TLSH
T1B9B5BE13F2D901E8D06DC17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3c60d1f09b655ee4bdb9615ca145b83b21d456f7c43e7541c91807b64ae68e38
MD5 a767dbffa00f37e8cd539c0faacf3569
SHA1 dc5eb61e45d96eb9c446aeb85c300277f53b5c75
SHA512 ff9f4b64b026834221a3ab429c80f0d5f7f1e3ee515caf5cd3ee5e0b3ace2bcf821c9018352e80ff824718841b05fee40c96f5a5bc3a5ba659c99bad3d14d3b5
SSDEEP 49152:pSuZQIY0Be2KcRVtOnks6NMHqIxHfJvYrPs9HHC:n5dKii61IgrExHC
TLSH
T11AC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 655640aade9015f0ab21d469a2a60530d3dac786cc01822e9e9785cbe32ff549
MD5 73e9a81105d7928b5a73db4615f5dbdf
SHA1 69409ca215cfc811ddde222c26e96c4e8d8e7a33
SHA512 3700caf390113ac712c765c9e65683218e28f37f3595c5b41e03c3fed6920f17b60819b85b5dbb71082cb681dff9e6fe4a52c10b293739249b8c740fa64473db
SSDEEP 49152:FhtSn8EApI0fig3giDn0AP5wBxHfJvYrPs9HHC:0X2imphegrExHC
TLSH
T1A195BE13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f1ffaac1b299e2deb6d75f5a7d20378d61b50988905fb699eb76fb4331de0249
MD5 192885858f41621a42c4a578ca98dbe2
SHA1 45c557612e4dc7e71af8c827b6349dda5ae16541
SHA512 5ac3f384d948ef8b8bfcbcb019461768e697ff671a2966c97259698bdd5380dc28e72efb0699664e7bb156821ab8fcb2fd06080fbb6fe292b0454c42a7001456
SSDEEP 12288:Y8xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:Y8xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T15B552315EDEF8379EA1103B6459353980856BE6EFBC3554A2003B88B377BBA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 66b0a3abbf82c5219733fd250a06662abca6b658786e820c207846ecfddb113b
MD5 e7b8d93757eca216be97c44f910720df
SHA1 ef68f36c76d09553387615713920c9cfb7a640cb
SHA512 a31ebc84c756ad76bc9210e71cd89b49f69a49c2dd2daf9a2fbd6fd2008d1f268465b26225e1ff57a12493ed981bebede22c1deea2efac03033f538654d02b55
SSDEEP 12288:oXxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:oXxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1C2552315EDEF8379EA1103B6059253980816BE6FFBD3554A2003B88B377ABA5500ECF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9dbe5673a4207fb40018fcf69c66592c64dcacc68358efe9f7e1b9500286d8df
MD5 38741191e1253cff474b392cdcec7022
SHA1 1ba76cef75b3bf39cec5ee2ea6c377aa238b594c
SHA512 a3ba5708954c75e31418f208f81bfc655091abfdb12b5c4fac355277d6dc9cb84534c20516daa3f7438120dede45f2f432be9f46d52423140468132dda0ce6e8
SSDEEP 12288:E1xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:E1xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T10D552315EDEF8379EA1103B6059353980856BE6FFBC3554A2007B88B367BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4e8954f31474faa86eea8e38a2a0308bc007eb7b126195529e6fc4ffdb6d0732
MD5 5b4476c197eafe79d8fb26b913e79d46
SHA1 ee1f73925dad8e649f3d45dea2b4eb92e5e729cf
SHA512 c072eb4abe8d327b14ace989601397c499fdd06d0c639a9030f8f493c1244490126d97417ba0dce39bffad70bdecf7114c456433d4b0ddd9f838065e06d17615
SSDEEP 12288:tVCxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:6xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1875523117EEF82E5ED21837989A352540572BC6EFBA3568F1102788B2F727E4540DEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d6afb4340aaedc16f117450886714fa11dbc666d69f7c428d8b69263bd06867a
MD5 43d1be9de056e3690d569cac5159ade0
SHA1 99f204aabc4c63875e1ab6ba347a5d7baadad777
SHA512 312539709738472e242796ecc76084470031e6e166a5b37dc9786db39a08deedd93529299fbc5228808a40baec4a86f41cdc2e6dbe465dcc875e22741a975b69
SSDEEP 12288:waxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:waxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1F6552315EDEF8379EA1103B6059353980856BE6FFBC3554A2007B88B367BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5bb381642334a6e8704a2dd4483c8a4859b983d6009411e5eb17839d7cc59e03
MD5 6314da76759e15d8abaa8d7940f5a1f9
SHA1 52e4c4d0d49bc84b703d2b02d918bf124d660846
SHA512 8963edbda8ba34584b56738f6ce0e66eea8aced9b9372ad1f2e3c6e821b722b9eec3aa2002f5cd903b3586f124c1515c5e4a95f95e41cc83fd8e429b98c47d07
SSDEEP 12288:Y7xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:Y7xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1C2552315EDEF8379EA1103B6059353980856BE6FFBC3554A2007B88B377ABA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 68a3f645588412ef87ec4978fbcaca13c131b265e46e4452b5b57cb68d054529
MD5 d7b53cbeb1b4e765e6a5d475a8d86a22
SHA1 e0a5966119b7040dd31c27fc3acb9980fdb88077
SHA512 58627ae1484b77932c6f97cb837444f98d93113d9b0d6fdb9015274d7cd3846d6f863ebc7b41d59aab50c74624569df49c620cdcbc36a00b63f504ae7518d5e7
SSDEEP 12288:QPxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:QPxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T13E552315EDEF8339EA1103B6059253980856BE6EFBD3554A2107B88B337ABA5500ECF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b1e4ba1b63ff8761782045d61f5b373fbf3f950d00f3fac8234b6cb5c122298a
MD5 e9eb9ebe0e22f14107363bc5660b275e
SHA1 4b57f91f594affc8f32e32abce7eb7ebd86b3aea
SHA512 d0b4532f0932c9c061e5d47927f41e1920778865469abeb6b3fc992af69e437797e9522c3b3b3db5fae087f69c849e341833e1387ed409657179c5390067ba32
SSDEEP 24576:YZMRzFVSO3xHfJaMJWTTXPPC1X9qSH9Y6VyP:YZMRzfLxHfJvYrPs9HHC
TLSH
T1BE750295B39018F8EC63823ECD568905D6B27C5A5BB0C61F13A4365B5F333A11C2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 140ae6838142f60b7f9c3184dba11edfa34f5cd5aaa70e95a99157a61a72ceba
MD5 ed8385915302df04a25e68c0f13c0cb2
SHA1 f90a1a237a9f7cf2c3c8c33d1ef2aae846a9b662
SHA512 18cc0b1be1e9f1e287adbb1a334c955de1f97fd722816585fdbdd58fd807b20de4f2162bdc99efe9790d347249ceacd6d6e1afba29f7ac72c3d4d159dd02db06
SSDEEP 12288:TYxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:TYxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T116552315EDEF8379EA1103BA059353980856BE6EFBC3554A2007B84B377BBA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 dafa2b31fc4b2e421adbd2b3181cce69469489ea3482520a89bf7fab7ef7f7f4
MD5 e00f9c4be488c5885c7086a857ad0ef3
SHA1 5d11f25189b6093562f26822833cc255b5577ad2
SHA512 54d7d3080d57d9e9cf50c1581dc8b5d8d1cc0b155ce6a9af09610d2e6c4c0429c74a4846a193e4e74be622de37d9926ac9dc93ea7d6c74e689e43b9af30c1365
SSDEEP 12288:VkxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:VkxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T138552315EDEF8379EA1103B6059353980856BE6FFBC3554A2007B88B377ABA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 bf5bb1a9e1eb969ff9d8ebf45ebc33a1fc10e4da323ab88bd06254eb00a104c9
MD5 516fa44ea98a4fa9848bb0958f8b6263
SHA1 cea1aca61963a15513b969de2d311db5ed8b424a
SHA512 4f859b974078721ec680f3282aeecf0cdc29f1c5ee5f780ac9a36c387e66bdecf1a5559b46c46b2352283690439d20a34f811cc14b57779e8b093431f277f9b4
SSDEEP 12288:vyPz5L8jxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:CzyjxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T12665120777E631F8D532823988A21601A772BC365B618A9F1360567B2F377E09D2FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 81366641fae68df1dc2b6df2819cd14e5606f34769c5791de42738ac398e99f1
MD5 1c57f380a26b39d4736e15e87564a8f5
SHA1 36629bf7be6a9710680dfac75ac22ae3e1863e1e
SHA512 e4eafdde54187fd075a0de56ea3a011297f162a41ae6cba7885b1cbd0fa4d4f43e16d2ac695cf541d8be6565eca0763979b087cc62aab35bc399873e87c8f106
SSDEEP 12288:1YxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:1YxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T130552316EDEF8379EA1103B6059353980856BE6EFBC3554A2007B84B377BBA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f31bd7a0418fa307d4342fba10b3f62880f6fada5bbfe1e449cc670a98c6a6f7
MD5 03ed2fefb69480343e17896e69eed813
SHA1 1164e20dc0a915a9d8f11269043da9057b96bee3
SHA512 c55e6f76fe82db2263b690b436eca0a30620a67737eef478255a2848dc28ea566b7d9765e29d00bb85177d742e109a2f4eb8ec5f5af4e614904e67c188238091
SSDEEP 12288:mYxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:mYxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T131552315EDEF8379EA1103BA059253980856BE6EFBC3554A2007B84B377BBA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 295302d6bf71967741237cbc91905eb13f2af76bd6164bd1d1998c2d19625135
MD5 2ac08f9e4a43f25e75db228ce575bb73
SHA1 ccea03fd3d8335aa88852ca87407b2e4a4d26ece
SHA512 bd82c597728d38d77bc72b0ca10ba391ca6907f1ef2672a1b93eabb2843d0821429a77684f25d4b8452b1414fb51365d0117d94b8ab6101af180a78b5bea5bad
SSDEEP 12288:VyPz5L8jxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:8zyjxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T15365120777E631F8D532823988A21601A772BC365B618A9F1360567B2F377E09D2FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 d42dbfe137c96de1fe9161e58d4fa2bd17aa0ef7541630d4dfa47f8d9d8ff509
MD5 1f3a96722ba1accfa52fd2bb8d8575e6
SHA1 3e78b780618c4b0b356b5ac2f79728dcafe41a53
SHA512 3808c59b9adc537f7dfe2ed670c716e613a28cb829cc6ff647cc26fdefd1eac4dc25c175e04898ff54b02b2d10913926caa13918f4e42b96853cceda84b84786
SSDEEP 24576:lcP4mcvIjkGOxhKP2l71nNKbrh/8KBwxHfJaMJWTTXPPC1X9qSH9Y6VyP:qP4m4IpOO67W8KGxHfJvYrPs9HHC
TLSH
T13465AE2DABDC0096D0BA917885658A49FAB1742E2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 79682d964ee9e193c00e7d3cc24c95c92783f576a3fd957e314387395fb1552d
MD5 a1fb48b24f6bb54168249ab3ab19a48c
SHA1 bb64ba90afd240de5fa0fdf6a8a99e55bddbdcca
SHA512 0fd0b9deb5337a12f901dfe4bedd163e32077cf1195fc44db330e1edb2f8561e3ff454594be82969117c54a1074aa00ef85c6bac75726e63470c34a9b2775726
SSDEEP 12288:cbsfIxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:TIxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T11F65011AD29842E8D02E5279C7964640B3337C2997E2D3CB22C1F47E1F766D09DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 279cf9857e949e047a96dfa925602e39e2f8009dbe2463d010bbeb08e2757291
MD5 b2c1fef0bea132eaf646a0f5eae5b33a
SHA1 8f9a872fc19fe6cbc17a77e31b974a21437197a0
SHA512 315f65d7782c8d46df9c96a41b4f83d4941bf12aff8e3605923da5463c6202bbae253808391fa26fca7cf71394564f0d76fe71d155ca91ecbc51633b5e9d023e
SSDEEP 12288:roxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:roxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1EF552316EEEEC725F931037505979228141BBE7DAFD3954B3002B48B363ABE1980E977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4fb3a88d3953f858a3c6f112b2caabcf8157efdd8753b00f3f0293bfa4c89f4a
MD5 3ab6984016a3fd21c828ce687dd5976b
SHA1 44d2df40db1ae349afdab5863c4a7ce0890643dd
SHA512 89239fabefdcf318562f01e8e72e5dcd0e7b4e993c1ce02a944bb972d9018ddb645fb65c108dbc94a209dda87e608cb0f427c073048fdcc3bd39ca04fd43e255
SSDEEP 49152:+a0h2GEkuAe73q3pp46zwwQaxHfJvYrPs9HHC:+a0hNYG4JwrgrExHC
TLSH
T1B585AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 f0cf6ef9e0a132840d9f1bcfcbca1993ff3f16d105055b36fbc5149bc157f7db
MD5 fde8fec439bc11c01f1b449f4ac63837
SHA1 37e6ac1508116982bea50493584d945c8fc786b1
SHA512 b5da9aab41b8bbe9ddbf4ab8fce52568c7f7d8852a6625d93978460553a251bf721d6f378be2ad63f45db271a7e909f6fd075a8aa4bcdd656f6623c230c5c278
SSDEEP 24576:OhbHjPHxHfJaMJWTTXPPC1X9qSH9Y6VyP:OhbHjPxHfJvYrPs9HHC
TLSH
T12855127E2AED11A9F531927D45928209C731BC291B1293DF2282917E1F3BFE45C39F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 606e15d7f92a1778bf56939f4074484c65b59f4edf3911f6b4d3b463a5c92a86
MD5 fb6368f25040c921083685d9ee42d062
SHA1 08f479536d8c3ca302df5cb3d8695560bd1c06ca
SHA512 42f928b50a3a2c961eb00bcde1ca707cc44d99ec2361967d11d5e9a525176c98a9a964b65b490f3a4ff911cf87f2e229a1421a7030ad535b5e8846d04c2c3c95
SSDEEP 24576:Q3YgnJcRTk4yti+R5dBR/fxHfJaMJWTTXPPC1X9qSH9Y6VyP:QIgnaTk46pBR/fxHfJvYrPs9HHC
TLSH
T1D945BF2DF2F910B9D8A6D236450143B5BB71782D1F219ACB0170C538AF1AEE85E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 dd9a69ad8d9454c0ea42644b277c5499340c1f5b8416030d9cebce94707c1a0e
MD5 48b2f623bb0d9c54680ffcf1c197b33c
SHA1 8a9c818de5e82fb6f98e785b82aff49e04911539
SHA512 34476652ca1199212f05980935348df65a803b3000a613434e8bb1423bda08230ecef79561f972d20b2c0d713e4c0b546c9f7f839b9ab55727ed530e6c55b640
SSDEEP 12288:w0xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:w0xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1FD552355ADEFC379EA2103BA059353580401BE2DABD356CB2003B88B377BBE5541E9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 54b8a5eca5be2f1e65fb0e99341dbcc5d9854392528048b83c9c41ed90e14f85
MD5 717e99ff50126a281a07a840d4bdb6a2
SHA1 b0a97f3209dd257d55101de3800da8b5a8a52296
SHA512 da76f984c6b46acc843c56bbbfae3fec2c0667293df09fcbe13c0aeafce53800b704e24604b8a6fccd601e219aca4e3c4de06c54b5cc34771a7a5c73744249d5
SSDEEP 24576:rbL3UTBxHfJaMJWTTXPPC1X9qSH9Y6VyP:rbL3UNxHfJvYrPs9HHC
TLSH
T18375F115F7E500F9E937823CC9A28616D272B85D0765E7DF03688A5A1F237E14E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ec1e5e44607bec4022825bc175290b84222a782db8354313ecc9e15279e0df00
MD5 820da15a0de9f44617ffef3210da4932
SHA1 8b1fafc4c736249af5fed6f4e2810e9e92a15973
SHA512 d0e6cdb49f87b1a9ee88b32c43afae93ef378b300d800db44551cdafe979b7aa5d34629d0e70e11516717d63b4f680f422cb77c60515e0ae0565699a4d4e57f8
SSDEEP 12288:ApFtIOtxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:7OtxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1D955021A36ED11E4E535527D8993830CC372B8661B6257DF029090AF1F77FF86C3AA62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f68219d82e8f4ef62b288e2873e400fb167e72ec4d592b59d5e9e1afbdcd90b8
MD5 da7213d57b0180c42ddd3e35a2e69ae0
SHA1 d39725e86beb7e6767b2505f4fe0e3d63bbca49f
SHA512 e8a709b3cfd57f590e391b60af1d4e19d9d8c194aa886f007e838bc51f0300dc8dfd664f9be26a4e08808057694925254bce43a411b90aba523a884d559a7583
SSDEEP 24576:p7NM9YqZqmWMUkPjZM48Mv6bEhsYxHfJaMJWTTXPPC1X9qSH9Y6VyP:p7cBWMpPjN8DbEhnxHfJvYrPs9HHC
TLSH
T1CF659E2E6BEC81E5D576D13DC9A28205F6B2B4611B318ACF1152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f491fd040c7e187484a129bff6ebc227f2561bb8662b83de75b9eb0fe012e50d
MD5 08564eb8009d86b448c549f34fcb5ba3
SHA1 883da0f457f6cbd493706c773ffb8856b54a67f7
SHA512 4a8371b7d3e6a899b4f1ca109f019f7d65b8495edf96cd904054d7ab9c9cd03e4ad06164c1afa4c1111eb1733655dc246af319254ad187eee142ba2a2b7ba591
SSDEEP 49152:tF2YuHNETovAvNYf8km4xHfJvYrPs9HHC:46BCf8ktgrExHC
TLSH
T1E1857D2927ED80A4E0BBD27D45B6D246FAB2B8551B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 6414b743bbbb9ad768a6e3222d2f6a865fa382b43a37b6c5689d54e3ad1de809
MD5 32c48ce09fe6758d33989f079a83b37b
SHA1 4a661614ef782e4eff9b976f44248cdafbaf80de
SHA512 e0fa9695658d38f7fc2e9a625b6cdb0e6a9fc458b520416bd1f158e21b4f2ed3eff05dfe34359919021fa85a28eb6e1dab84a87ef4b38d836a0d62e05e84ab1b
SSDEEP 24576:PAFs06+OmlfkNXEbToJxHfJaMJWTTXPPC1X9qSH9Y6VyP:YFs060lwXu6xHfJvYrPs9HHC
TLSH
T17E65BF2F66EC00D5D07ED17E8997C91AF6B1746707225ACB0160863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 10d9a50f70d08edbf8c39d3caee1e6b193f735b6ddeaa07ddeb1b954ea52aad5
MD5 9aa12c8041737c17fdcb11b5c408ce57
SHA1 9de7e30c8dfa6ed7271d28820d8fd382ffd36c0a
SHA512 0023f212cf86b8d86866b5ccee6af94e0f29b1bec0055048a3869b745206c60d7aaff79787c877ead24519e425b07fcb24f2ccd68f3b91c04ddf155b8260b48a
SSDEEP 24576:mJnJ5D3WX6xHfJaMJWTTXPPC1X9qSH9Y6VyP:mJnJ5DGX6xHfJvYrPs9HHC
TLSH
T1E375D02DD2A810F8D4B7C2B4819A1795BE72383D2F226ACB2474D5353F22FE09979F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a012fcf08652663e804a7606a3259088dcbfb3dc991177628ea1b830f0ba038d
MD5 9d3f0c85c15ab96072e3f27959d8d202
SHA1 a81e74dfcc319071ae1d4c6e0b9972c81382760e
SHA512 5cdcc1c5861f8a580bce192c5209719e24096b9538024772bcdc0394e2377bfd1a583c96c438f8faca6844488c2587bcfc1a9c52e7cc1a9c9cef5b81018cb33f
SSDEEP 49152:Ng06DIKdwc+eQnSt65aV8xHfJvYrPs9HHC:mugrExHC
TLSH
T13A955C15BBEA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 f09d84d9a4750c6fede2ce49bb31a12864db2ee5382bff8812d7bdc60a4a10a5
MD5 8d058185e55a4b61c8a2e16e4bd4482d
SHA1 31c45f6fcb3971c4e464f8e5f28d5aba52bad65d
SHA512 f4633c74bad58235db2ca40665e0398e0a02c02b8c7cf541b9155945a74fbb9e81e3aec8398e18d12149a304df4180c21aa590986f2f5eee751d91b62c9fc7cf
SSDEEP 12288:gEP3RnWxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:7nWxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T12F55126D6BADA0E9D526823D85928204C372F4346B9327DF1192D13F0F37AE91D3DE62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 615bedeb3df9df23fd9abd096e67410540401a29d49e18087029d0f8f6e52713
MD5 9e2d525d0e463959e159b75f99dd7e54
SHA1 6562132641073cd0844c4038e8bdb19cfb80bb08
SHA512 daf928d15f12fb9a037ec497da8ec51f794dc580961ef8512e43e3a3cd4a449fbee5d2bdbb27a1c7595bc33bf26b2f31d14d6fbaaa76ff680f0f620d90e74ece
SSDEEP 12288:5jkyXxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:5IyXxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T16E65130567D891A4EA35037889A382944A35BC34AF6257DF2081F52F6F37BD4AC39F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 2eeead3e30235db676dabc6f3532bc8959ab23debee3635d08f5f07e5e1b7239
MD5 4eb93cea3d0b27063723a5335c14c2f6
SHA1 b090bfe6d6036e27e474eb701ba9c721ac01d233
SHA512 1b50d08204f7f8b54e9ab027bd3ca2d0911832a98e8a663706b1e3575df4444d2e370dc8d59d1ad58edb5d5949a6829bb012063dde8149e3190a85770af46e0d
SSDEEP 12288:gy9xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:99xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T154552319AAEFA279EE2103B905A3535404217D3DBF9325DF2082F49B677BBD1501ECA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 da0a5fa967461b11384c03452ce23c23a174caf32b1e4d9367e64691eb3aba35
MD5 e048c8962308d53d922c6ff9846db7ce
SHA1 7700887816b6a43ea6dc373e401f145a9ff5370c
SHA512 ef8efc0e5c2337b08a73e4e2984e857917ba0878e255c6d9136f732ebeb161d7c9ae86ff855d7f892704153801b17f012f63dc56bf82927af9e0d72509f34d96
SSDEEP 24576:qQ9MxZKdcz9dw3gxHfJaMJWTTXPPC1X9qSH9Y6VyP:qVKZgxHfJvYrPs9HHC
TLSH
T14E558D2DABE9059AE177C27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 3adf106be856a94ca045249345d320a507ab2e13a1ec509305506b520bdb0976
MD5 c53aa42e329f13dbd7db9a01bf85b72b
SHA1 adb2cf180caac9d52608b913fa1d7a536526d149
SHA512 d28ee73ad0af28e7891840fe2eb4e6a61e60841bf994a9e31be03df2483cae8b741a083f0a464affb5e8fdedf66c77d91a950ce39b1691fca1c2d99c24ff62df
SSDEEP 24576:jyocDApTxHfJaMJWTTXPPC1X9qSH9Y6VyP:GocDApTxHfJvYrPs9HHC
TLSH
T13765E01FBBAE40A1E122823C89858345E773B4345B5257CB2191C73E4F37AE9BD39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d832eca6847dbc8ad2dcab09be722a40fe67bfc363f2b20c0cebcb440b6eb9b9
MD5 b11ae31962eb8813bd11edb59eea079c
SHA1 58c1422186073740066488a764408f6b51f7ebf0
SHA512 c7ea518c8948d02fa2365d0d776a601562809fb26b47f5f4e308ac412896c24b7cb679fb85bb5b2ca988b8e8bf16bc695af3743796c4d4ab701ab92b856e662a
SSDEEP 49152:oWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKTxHfJvYrPs9HHC:K0zuNIBgrExHC
TLSH
T1CFA57B3DA2BC00A8D9AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 60b0ce09bd0d35b0883ea4fa01b95d2d4f280f01074ba214084b2af32bf28652
MD5 5d2872b11d08785ad188e0c84bd9a05e
SHA1 56e4898b7f3ab1a2a0d2f5bb008a8bd5df0dd3da
SHA512 7af6078604226418089cc514bdfeb5ff20daebaf775f1e6e9b7f0991171e9a7291f03fdb1ec2f72bb889661c5581319b2b1c8a5410d9e8baa40dd98308f0a4d3
SSDEEP 24576:f1QT7EcpfxR+N5AWAz3ooiYujMqbWxHfJaMJWTTXPPC1X9qSH9Y6VyP:iTDxR+N5YzT4jMNxHfJvYrPs9HHC
TLSH
T12F55B02EA7F915E9D17E85798A23C502FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 1f7e3d7c1587581f118306670c288c1388ea38d1e99e8c4fd6b5d13e2c78cc43
MD5 a1937ce6e9d1784854d413e355123a87
SHA1 5d84563ab936718eb993dff7f2337c2affc8f220
SHA512 de1a49daebb96a7ad9883b8bc76cd3a52cfadb6361dc49afb58f6771f95bb270b81394bdf030d9ab05d6c13c2aed4124d74b1b3c07f461634aa4883a8df04b50
SSDEEP 24576:ITMdOz0FFS+bmSLCxHfJaMJWTTXPPC1X9qSH9Y6VyP:A0K+bmSLCxHfJvYrPs9HHC
TLSH
T1F275E13EA7AD14E5E43BC27D96438906E5723865032266DB0690C07A3F6BFE4393EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 7a9e680c158e5cfa4c7abfdf4583ecc036d5e76357c27babde057db4298eb504
MD5 d35df634bdffd25dc86db46aa625e957
SHA1 7ea6c430257ded810151fa9ced2770a2cdad4ad9
SHA512 4b55544606fa101ccdb925f3a3f85121c28c886d8b96c89283939d37c4acb9ae75ddc0666d4cb8132229d69ec3c49bc0c518c32314a41b89a94242858f674bd2
SSDEEP 12288:H4KBxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:bBxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T10F55121D67ED21A4F83242798A6642440631BC3A276256EF30D1E8BF5F37BE4943DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/516-203-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1536-74-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1536-81-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1536-323-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1536-75-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1624-70-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1624-284-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1836-207-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2124-344-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2124-91-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2124-96-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2124-89-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2180-353-0x000000000CD30000-0x000000000CD38000-memory.dmp

Download

memory/2180-360-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2180-164-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2180-208-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2180-199-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2180-180-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2608-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2608-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2756-146-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3020-110-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/3020-356-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/3064-358-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3064-129-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3168-202-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3228-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3228-33-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3228-39-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3228-32-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3384-355-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3384-108-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3384-105-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/3384-100-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/3764-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3764-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3764-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3764-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3872-204-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4676-67-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4676-65-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4676-60-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4676-61-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4676-54-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4736-69-0x0000000000400000-0x00000000006CD000-memory.dmp

Download

memory/4736-492-0x0000000000400000-0x00000000006CD000-memory.dmp

Download

memory/4736-8-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/4736-1-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/4736-0-0x0000000000400000-0x00000000006CD000-memory.dmp

Download

memory/4896-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4896-25-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4896-22-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4904-88-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4904-12-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5052-387-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-381-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-396-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-400-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-402-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-401-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-399-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-398-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-397-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-395-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-391-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-386-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-367-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-368-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-365-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-364-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-363-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-370-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-376-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-394-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-393-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-390-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-377-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-378-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-375-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-374-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-389-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-373-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-372-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-371-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-369-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-388-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-366-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-385-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-382-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-384-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-383-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-392-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-380-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5052-379-0x0000015FCAF40000-0x0000015FCAF50000-memory.dmp

Download

memory/5692-201-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/5828-115-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5828-357-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5892-139-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5892-209-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/5892-133-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/6132-127-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/6132-197-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6132-121-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/6132-359-0x0000000140000000-0x0000000140169000-memory.dmp

Download