972f2746c862529d5c056bd548c88b0229fd1c9ad95e441aa6a99150c3f4c70b

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Size 2.1MB
Sample260720-teekcaft9l
SHA256 972f2746c862529d5c056bd548c88b0229fd1c9ad95e441aa6a99150c3f4c70b
MD5 5867a15e4dbdb42bf4d4eef9d9fb2c43
SHA1 77cceb51c6bf048cdee1a0c986f14c3934eb44c7
SHA512 b2a27a55920f50bb9444f085ade7703c4950713aa0048fe2107fc1b11f6a00fc4f27bb12dba11a08ee87cb2ee0fb67e803bf12a6aa5a6310ff42005f7bbba3eb
SSDEEP 49152:l0pxcrSD204a1CdmJR9n+/Q8kJh9hNhBX3fx4x8EVep:l0pxfbf+/4h9hNhBX3fix8EVy
TLSH
T1ACA5D0517DA14436E431013488AAC721DA9ABD768371A89F77E8343ECA7F9C3247726F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4612	alg.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
2088	fxssvc.exe
5064	elevation_service.exe
1468	elevation_service.exe
2164	maintenanceservice.exe
3424	msdtc.exe
60	OSE.EXE
4380	PerceptionSimulationService.exe
1168	perfhost.exe
1132	locator.exe
4536	SensorDataService.exe
1584	snmptrap.exe
1188	spectrum.exe
448	ssh-agent.exe
4472	TieringEngineService.exe
3244	AgentService.exe
3800	vds.exe
3412	vssvc.exe
3812	wbengine.exe
4740	WmiApSrv.exe
2332	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\416ce3757c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b341c48e6018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6868c8f6018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b43a58e6018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007246678e6018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa5a3c8e6018dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
3296	DiagnosticsHub.StandardCollector.Service.exe
3296	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeAuditPrivilege	2088	fxssvc.exe
Token: SeRestorePrivilege	4472	TieringEngineService.exe
Token: SeManageVolumePrivilege	4472	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3244	AgentService.exe
Token: SeBackupPrivilege	3412	vssvc.exe
Token: SeRestorePrivilege	3412	vssvc.exe
Token: SeAuditPrivilege	3412	vssvc.exe
Token: SeBackupPrivilege	3812	wbengine.exe
Token: SeRestorePrivilege	3812	wbengine.exe
Token: SeSecurityPrivilege	3812	wbengine.exe
Token: SeDebugPrivilege	4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4244	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3296	DiagnosticsHub.StandardCollector.Service.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4544

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1468

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2164

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3424

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:60

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4380

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1168

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1132

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4536

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1584

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1188

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2016

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2332
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3548
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7edbd60101afa3165de3aa7e0afd56a365a01243f6c6b7c4d912faba0187f320
MD5 975d4bdc4104eca58f18e1a128fe0e62
SHA1 cb04940c7010ca8aee94a6ca7e60481ae165acd5
SHA512 ff07243086b4e2d03800ce49e78535cf1b1dd0e4a097deb2a1598541db06f670ac3a75e0803f0aa73947d410fadd95cd5b2ad6aa60fd2d4ca42bb888fe856a80
SSDEEP 49152:zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnux4x8EVep:R3q6HjB5ix8EVy
TLSH
T17ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 1d6fabb89e46142240cb17cf75aa74612f3f1beb70b75836aa449e45dc428a6e
MD5 236071b14e2643a017876016684c5630
SHA1 84fa49aa21e27a381963b6962a10602681a47ebe
SHA512 39b51d9f8b310093cf71a92679310aa823158c870d3669613838a42dd996187aaa66f529a073bc810c73a2fc6dbbf862c2691e6deec03656b85193568b3635e2
SSDEEP 12288:E1XLsswWkxy2lRq2czAS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:CXYfDtczASyxknw4FYnshx8OfVe247
TLSH
T10975F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 de421741ceab7d00f190ce633603effeec562003353cc071d911b8a507d6f392
MD5 c48d763f59ec7446622bd39014e29662
SHA1 89ff73a6c1c9a19235ed7b163cc619585801e6b3
SHA512 1051661170b64105c7ea763096bd6de3d3f02c8e091225d48b334c8a3cf65ce35be9f39cf0aa951449c28dd9e274dd9d67e5af3f94de936fbd34b0d69c034a77
SSDEEP 24576:m0Le5ji0hmxFrMjyxknw4FYnshx8OfVe247:mPji0ArHx4x8EVep
TLSH
T1EB95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e3c971fac62325ab58434013cb4c72c5590f37129242cd6102bcfd67f3764839
MD5 44c9a0aa6bf5714969b6134906660346
SHA1 53023b953b681af3f7c3de62a05a0c19b43e4b2b
SHA512 8a3cca5a8791974bb9823ca3e119648fd75a371610619476fe477cd2456068349dc36cdb17337018e98708ab292f0c64326a123abc309715b871ce2de709157e
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyu5yxknw4FYnshx8OfVe247:E/ezSC6vUzPvxHjy7x4x8EVep
TLSH
T162756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 726072e8d21b49ebcdd5c4314fc2cbca2578ff264cdb9fdd82aba78ef9ba0552
MD5 f6ac9437fff0d615355e992163e8da73
SHA1 0ed2c85a91e0b517f800b0e9dfb6bc859715e7f9
SHA512 1e294f5b16c0f22d8214e7cfa0b4a9ce1cc0a84a9f362ad342507137881e1dcb090048aaf59754f8ce22d913d3727bb25bb374eb82f5c3fefe537fc0139530b4
SSDEEP 24576:gVbqPb88hv/l+62yxknw4FYnshx8OfVe247:gVO88hXl+Kx4x8EVep
TLSH
T158559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 6ac72ae80f3d69ab6f247cfce5320c6717e32c15c03e34779cc7ec4d6034740d
MD5 bb26cb71a03fc8db24b8d5f55f8a916a
SHA1 48e3b7f76ad170c29b1eb2312dde725aa6dfe9b0
SHA512 96e1651d5f750f047913af5f34901aa5607ae1ecf1ba034b8a9c0579f46372037ffacceca13ebe6229244fdfb01ab32e81a5b5eabae9fd40a256c4284e204b7d
SSDEEP 12288:iNH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iNHyxknw4FYnshx8OfVe247
TLSH
T1EB65237CA7DDA4E1FA5E14331B7572622616F9A0DA74C11BC779B14EE0F0CA0E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 ed83c0d9f81f5966ab0d255aee0e44274bac0577b2184bba9273e46902399d11
MD5 e8b2f4c6ebb40695dc50a47ca2369ef5
SHA1 a552dc22e1d3cba73b01c24cd7a3a56634a58e88
SHA512 1b432f3de8ae5d32f8dd010d193f46b6982ccd09d07d1119a390b452cdbefd78dad6c2f641d66abc87126450018bd462fce029e36cac1c5dba3c320b01953285
SSDEEP 12288:2eBNUbTVO86UO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2JIUOyxknw4FYnshx8OfVe247
TLSH
T12075CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8eaa11fc1a2306050fc3ce8b0e2eae936acac2ae687a9111efa341ab0f280c3f
MD5 75468026e5dbe81a6192f81c56a6aba3
SHA1 eead563aa05bc9e49077121ccec418f29407f0cb
SHA512 1e2a0f98ac0f1f7dd66fcff2410c95f61e8abf4bfab1fb37c0cc25c9b6137e4f6a005daa5294a0d47858b07ab6906caa6749820664c9c03181650125205724d6
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THp:BQvGAdlCEL8c/yRNw5Csix8EVy
TLSH
T140267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 80b90e6ccdc936d9c47b7ec3aea7a1276093700ef69e762ce8206e9e14b220e6
MD5 ac8f683e55bded3179ceb04d4cedebb9
SHA1 a97ecdc0d524c14a5ec66b7a381de2684cdfa05e
SHA512 ac6597053b393a956b733b387a73deb1eda1d5e49b0a5fd5d61b5a44e480d335099e5dfadb070becd3d6e7eb902d757755e27576de789bb2da5fafbe1c5032ff
SSDEEP 12288:jAwSfxL/2Dc3LDLLmt0LDQewsAjc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:c6ewsAjcyxknw4FYnshx8OfVe247
TLSH
T17985E030FE74E032C6BF0DB21B36D716142DB9604F611AC3E3B89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d9004ccf63b6ce5ba06c5ae03ebe4f3fa7c5a84ef6f230a24916c6ef09685baa
MD5 6931f73589ed10273f9e7076671c283f
SHA1 f80bc82c6047d858e85a191e6b001aace348be1d
SHA512 b0511c9c7406eabc0c24786b3e5ed44b868bcf94f8b91fa6d366e47344422d92ad378a6f591c3339047e867d1d6a42b919f5fa7912a118473b4ebf43b00abdc3
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHa:vUEtQevvqc2W1cpV2EI32
TLSH
T193474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 38e38c8bc6b5fbb63a1bac92106e77ee8719d2a75af11134617814b92349f8ea
MD5 acbfed79f08ec5967823362b51bdc010
SHA1 725e186278409c3e61828220b851e499054ea206
SHA512 7cb12559da551d2242e55e53f3cbc90a2746c741c0e4e79e52a167a3d4fd5997af1b64c083afbff652c7a98cb04ef3d69eaaee6b50f7c931b4614f42300c8d42
SSDEEP 49152:/CbRquA/m2yL5zQfFiV+XenmE3/zXx4x8EVep:YoqtVjnmwix8EVy
TLSH
T19BD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 21e265bce540530cfb76f822b7832b59ea748481f5f2cf2cbcd2712fcfd8a6c2
MD5 29c4300033ccbf948fc76c0cbb2114f2
SHA1 51306da51f4c05c357985779838464ef78215bc3
SHA512 630b050aad7eae68372aa51ec11063e2b524b2a243f2fffcac95c41166c4cf3af2c74d3b4205adf44fc2ecebf79a4fdc45bb327d7d203d1be7b65eb1e5415b86
SSDEEP 24576:sAhGLJIFoiwtA5l7S53Fyxknw4FYnshx8OfVe247:sAMyFoiq5gx4x8EVep
TLSH
T17935AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 601cce9c479482ffb7f45ac47a1b5577c23820c2716234cd5239b1d96240350d
MD5 4a87f9319d46433aa34b4fa7dcf37cf7
SHA1 355d3244779c9f3ae9ed77223fd5e8fc04ddd910
SHA512 9e399fde1ec57569ac60e9881a1a6bd3f627abf12f6c546c52ba37dc95d4cc822822b5ad1f9a44d46e6bf9080d3b36001fc24cb5ac0e23d4dfb30dda80c46a07
SSDEEP 12288:Ymw5HEjsChNoBFgl0WDm+CZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:VwuFOW4yxknw4FYnshx8OfVe247
TLSH
T19075F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 a14b530daf36ba44f3ac1dc9dda79a2f6d9f2632bcd2b1e567d37ef552bb71ce
MD5 a60b5b2cb848a8a1ef28f9168a01a214
SHA1 403a11af2d9da21993e6d4d385c0d7a4f1aa980b
SHA512 a2398c86bee331fc65463b44d98244270d6d7824c67f7352062eca8846ffb2a91afc386b64af613a77273e5789d8fd9be522913c335f80022a0a8e6582324e86
SSDEEP 12288:wFZ1IyM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6Zu7yxknw4FYnshx8OfVe247
TLSH
T16A6512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5f23af48b8f64dd4c8ce40f3510ecb7ba8fac4bea85d1c1366e6c98ea1a52575
MD5 0d8b84fdf8218ae7797dba5fadfcb0eb
SHA1 c852b428c2752bc93b60bfe023b22e7211baea84
SHA512 c8f867e7311afc98a14e109e64216c2eb96ff600292d2e3a36d9507602f67a12c2adb1463f1bc1193ae4a42655a327c6c7e7bd22287658e149f0c4e10ab0311b
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:bQRQyi36YOcPQLvw2gAf+PN3lix8EVy
TLSH
T145667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8a52f32eedf002582e3433da97fb57268dee247d1c1c5201f7cdf8b1ef77401c
MD5 d14569c5623515a4ca5984947d06b657
SHA1 1018ef7e918a7c3d3d976666856c98e6f300743b
SHA512 574708880b7da924c2f9149112896796da4a74f75cf6ebf311e1c4b3a780227967bee6ffc16f178227c9eaf7da21be08b59b440c68c5271f5b4dc5c24d47535a
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:uQRQyi36YOcPQLvw2gAf+PN3lix8EVy
TLSH
T138667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fdd2348bf12d991e35491d04d0e582b3b4750c1027a7bbc9ba1d65e85eab0e19
MD5 ac41757353f0069696fc0205f307fc09
SHA1 f23555f48c1c6af6d364764957b57ca583437a2c
SHA512 a7a65779d421cc720c306e2779f9c24bec984b923e7631ad21cf1889d9b91aeac5481cd29ddad5a634e3ee94dfeb2ef1135cbb71e90974db9b52dafa27850e09
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Lyxknw4FYnshx8Z:b68Qg55nhheWu7PNU3/Hx4x8EVep
TLSH
T1A5B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a312411f83a384d1dae87e5b3013a1e588d6976e46ff2784e8a4132420bbd5a0
MD5 f601061732e2cc0c673ede1351e04bb6
SHA1 4135e4964dcf0f8020b7fad82468a44efafc5dc7
SHA512 0b4743f448d5b0717359ee69065e43e4bb5158ff33757c63354858ab37a0add317296cf3d99ec22e562703d0d655691b676f46aa702562e8b245bfd521519589
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99f:Py5112gYy5azzVvL69nLKnhZSix8EVy
TLSH
T1C8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 83cec6a2a9fe0fea109e47967d61363c80c786b109d96906c0f18423195fbcfa
MD5 ae02a1e3881b01285d47dcbeb9c81784
SHA1 75f262d2e485d137a2d95ea6ee592e88ba6fd4bb
SHA512 c67916db366fbe9e079d461417d40ecc5afb2041e002f8bdc8b56a38974f2a7f6bb0624bde2f943284d39341901357ad7a3e63ebdeec7c03af9d0cfcbfb0cc90
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gldx4x8EVep:lu6JmVxd2ddix8EVy
TLSH
T1B6D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 030d6ae99a8690eaa7c57bd3b13c7d69980bc7d08ae3b331829efb65d59a6ac9
MD5 1a78ecdce199e42e545cceb05d3aa8fd
SHA1 3c26c74cf58c249a844ad78df3a45046e822ea36
SHA512 2ec1627c6f60ab14675122288657268775d42c63efe96a6217b1880fce02626b2b0fa932974ef1091e8553738d8919841e9566720a648fdc7bbc840de30f1ab9
SSDEEP 49152:L1hpsNoJpF1A6UU44CwH7R4xhx4x8EVep:LmifPbRwix8EVy
TLSH
T14BB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1e7862c3dad0f866708f11886cd3546a6ccc3591c89b2cb5968c9df73898d208
MD5 2168c2e057fb1eaf351c43da315f3fd3
SHA1 f6e99ea1f8704a5c1dea3ed9f5bcacf050b1fae8
SHA512 eb5d80561453ace5c0963e6a264c8d42a84982fbfff039dc2902439700974f29ecdf1e07ed9377ee159191472ef184e2cc23d131bb4ce6900cc8776e688ca0ff
SSDEEP 49152:qSuZQIY0Be2KRRVtOnks6NMHqex4x8EVep:05dKTi61eix8EVy
TLSH
T17BC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 28b93bd41c944813e0ff792afc0cbe55ce3b1ae62e16f2a51e8bdd8c92148aed
MD5 c624cb8d70f404e377888537f9e96a36
SHA1 cdd485fe1f91d1fd1641f8d6bcabe18fbbabec55
SHA512 96e684fe054ec0034ac3daa3825a0def03cbfcf87c5c2c1bbf77e849174e3585e7f92e3bc185ad4bc83f861a259f4cf9b233236cbbd88efb47ecfccb7965ad62
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5wNx4x8EVep:LX2iyph0ix8EVy
TLSH
T15995BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 246dea8425179de17cc5cbf13e02154776d612881f45b1b980b38b8f0d14295b
MD5 94734d1f1751dc1ccc10be19ead192b7
SHA1 036e0be80d17a1da0140bfe65062451ba6e31523
SHA512 0b0cad32a5ae76ab8d4a48626fb012789ec5384948c960479512cb7ace43a9cd189c81cf7b723f2207f62b5bc5d752f49597973d70824ae012254f48b3f5d333
SSDEEP 12288:ef+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:efyxknw4FYnshx8OfVe247
TLSH
T12E65237CBBDEA5E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 61234ab090e14b42b4fea03e1dac56fd1545d3aa137a5945b2db9b7f62aafc1b
MD5 a7833553c4ef40db42f3810ba639b124
SHA1 e04ca0492ddc20ccc7b9245b86a4c5d57f0df29e
SHA512 805d628ae07d1267ac763e7d0266f2644198c060f9bef8278fbc99d9fda264221f17038d6894bf760f144b9c657348382350a36731310a6865698f987155ba4f
SSDEEP 12288:mg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mgyxknw4FYnshx8OfVe247
TLSH
T16165237CBBDE95E2F50D11734B7172626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 1c6cc8c4c7a61abef3e01e5c77bc88280405bb5693907c1520d9768fd757a543
MD5 084746fa07008e0facd0383a994f84e3
SHA1 6b000dabf54d6286f20733225a60473a3c55469a
SHA512 4dc29a0f217b63e2e7f9fb570353be9905d33a03ac2d836a34874044249ccbd58d4abb0f79879993040fe6aceb95fb545cbf22f2328e84751d552641fafb1530
SSDEEP 12288:AG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:AGyxknw4FYnshx8OfVe247
TLSH
T16A65237CBBDEA5D2F54D10734B7263626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 eebdb0ec9ee5d33fd3f7423f41cf59cb78391cfd90e028a80ce5e1be58bd5096
MD5 1ac2d4c1b6f69a41ddebb6b3ddbaef74
SHA1 5469c637d97af7d55aa23166e834b8311185ba01
SHA512 eb9702f80bf2acc5219991979beb3f888b6c886cb93c2368ff2237ecb53ce66e17075aa0700d59ae67de0117429f6bfae5e3de0832688faee3eab251f4e0d8c0
SSDEEP 12288:gVl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eyxknw4FYnshx8OfVe247
TLSH
T10665237C77EE50D1E85A51738A726262B365B8E5E731835FCB24700EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 e7624437988de870b3501783872654bab9eb5c11662b19016fdfad9a364dc812
MD5 8805dba6afd86e9e751c1b8f69933070
SHA1 fad25fe59c00d3021d949885c519bc6d74f1edfe
SHA512 5cc054b61acb369aa9c46680c1375d059add878405a8c97807d61791b8a847b3714825d0c2edd78a4736638357b78fc6cee28df3e52d56a709af89299947b1e1
SSDEEP 12288:vt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vtyxknw4FYnshx8OfVe247
TLSH
T17765237CBBDE95D2F50D10734B7263626609B5A6FA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 29077655bfec1e4bdb670451b3cdcc683b3e1e5d3bbdd0921b2aa641e092c811
MD5 6d0b781fb1bc3d0f3868c53f79b063a7
SHA1 2d9fbd5c86c1e4f0f6937ee51830263ee6254b53
SHA512 e9391afdc7470e72053a335175732cafc0a38fff7f84824f129c212386d58856d08436f68517fe42778b2f30876d9b8066856ed967a5b79fa3879b66a56a1bc9
SSDEEP 12288:s0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:s0yxknw4FYnshx8OfVe247
TLSH
T1E265237CBBDE95E2F50D11734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 b075a8fa0fdf89049c87a4a01f36dad6ac793c35a5d63f5c1f23c041f59ad331
MD5 5eae83b2cf6567b9821f2933718be8b8
SHA1 30fe679d3258ccf384952d04517da8c04524b48b
SHA512 22366d38f9cc9e854f9d98805e3cd6e4cb6fbf21ff595201642f32e04039d680b83ffda4ebbf66b59466e92aa0b87a224d6ee6ea55e79c83be4547b20a05d364
SSDEEP 12288:JI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JIyxknw4FYnshx8OfVe247
TLSH
T1B665237CBBDA95D2F50D10734B7173626609B5A5EAB5811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 2e31d98f67ddceb65a3104f7b619e19aba2dafc991965df0d7c8215337c6eba0
MD5 fab31ed71a80067770bab9aa9cb82be3
SHA1 c60f3bcab078576bb2e3c77d133cbad78cae84ad
SHA512 db4c2cd2a5440f6fe34871baa0ca676a706baa636571ca3e3107b8706f3a154e4edbcbad0fb0ce0262de4f4820944ecad1198498f4a805e0b16c963f40820fae
SSDEEP 12288:giZwbZzzFEoS2cPvyA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jZMdzFVSOAyxknw4FYnshx8OfVe247
TLSH
T1EC7501A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 fc6735427672cb9ebafefc2efc700fee94e2d0bbbe0b74dcd7e59db668fe3268
MD5 fca2b985a35d6b85cd6e9aa5cbb0d6b1
SHA1 22aabb701e400cc4674741cf1045b47d156cb6b8
SHA512 0d606b02e73426ef2eee368d9f2adff4f14e14812e779d09691dfbaa01baafde3ad87a21b5254846bcf6f96b5b6208b344a5ecde03feb00edefb49825ce5fd1b
SSDEEP 12288:9r+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9ryxknw4FYnshx8OfVe247
TLSH
T1B26523BCB7DEA4D2F50D11734B7163626609B5A6FA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 d06694ddcca6b2397e3820e8b6cc5c4e175f010b0505f860a481bffed9a62863
MD5 def0f5643f9633434d9aec2940c73cb8
SHA1 79b33ca64a28017787dc2e4397b75bae981f96d1
SHA512 4d9d5fdf8fadfadc185de82179ad5d798439ac3f9794cfed11c81ac173fd2773b542d5b9c507127b64a11d709ead37d8c4593e41ffc903a36ace7b3230fc799c
SSDEEP 12288:V3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:V3yxknw4FYnshx8OfVe247
TLSH
T1D565237CB7DA95D2E50D11734B7163626609B6A6FA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 245975b98d0f8139475dfaaa0c2f4b63b21f5fa8f84b3fb658e5ea1a9ce29d31
MD5 4eb9194276bcf68efb8ac91b158dc54d
SHA1 a6c86a9cd610594ebf6edbe7855293fc870c5481
SHA512 06c21fd8ad92bb3e5d7c91dcbd9bea2e74871a639e32ee09843d2a83daf9e0acdf5ffde446e5eaf261eed7c23b733914232f68f918b788f8b46edc5025bdab38
SSDEEP 12288:4yPz5L8M+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZzyMyxknw4FYnshx8OfVe247
TLSH
T14F75125B73E530F5D12A4236C9621612F372B8724B3086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 740ff831fe0de33c72a1015169553d5011176ef51013fa1b951816cf15cf38c7
MD5 39ffca79f9f2c1e6bebc1b2adba7ba6a
SHA1 381995807eb7a3c7d6ca2bdc2bb7f5f3781c1242
SHA512 f5cf8bf4fd4a5761babd95e953576bd2c6a244c0c907d22a73c1a8b219d7b7cb101e82f97f88492cd0e5dae96392416fa7a258d8b5e01b6bc6003e002a977667
SSDEEP 12288:Cr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Cryxknw4FYnshx8OfVe247
TLSH
T1EB6523BCB7DEA4D2F50D11734B7163626609B5A6EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a59465c3f12e70717358338b939aa8e60e3776b5b0dd7a182cdfe3204e4ef2e2
MD5 d554ad5b6b55796198a351bbbeb0d615
SHA1 3f05c4ec23527dc05c4158e4e84f2ed76fbe8bbc
SHA512 fe9354ac4913dfc85329bba47783899a69c16f5f6e02737af0169487982b8081ba84c6b24b5ee23787e8a7e664462de1e2dd5b41bcdab7db56c8662b33d0285a
SSDEEP 12288:Ir+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Iryxknw4FYnshx8OfVe247
TLSH
T1036523BCB7DEA4D2F50D11734B7163626609B5A6FA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 989dbb17e264a155a87b1f80da4aa2c2cf1c21475548578d983cdcc677aca6b1
MD5 9fbd4c3d9ded1b99b2ae82aa72db4511
SHA1 023bbc27ec0c6ec8f6141bf3875951914568294a
SHA512 4e9b7d941abba4e8ca1a87b319ed91e485ac09aa6f382fff802e4f269225f3981fb0452cc923c63735c92261b7be7143a1ca6f9a54ff8881324d24ff9d952fb0
SSDEEP 12288:AyPz5L8M+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xzyMyxknw4FYnshx8OfVe247
TLSH
T1D175125B73E530F5D12A4236C9621612F372B8724B3086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 37fbb9825b9c7e21b3cc1bb0c0281b2bf42fb3f89b4e4f320336e6d546b676df
MD5 07c7d309a5f8ebd2440a489e040deade
SHA1 b27af3c1beaa30dda3c7801278ee582a9f045806
SHA512 35b917b1b1e48c24402ae8503056caa96f4477bc60e6838f206d2365a5d2260af1d9b7daf935b2ae05df47e44f963626f360b8529103654f130df7d9b5269a92
SSDEEP 24576:YcP4mcvIjkGOxhKP2l71nNKbrh/8KBzyxknw4FYnshx8OfVe247:jP4m4IpOO67W8Ksx4x8EVep
TLSH
T17A65BE2DABDC0096D0BA913486658A4AFAB1742A1F3286CF1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 0f29f1d9d818bec98f776914efc06d55a4da2aa5dcc85b531141191109108fe8
MD5 2bc7cc169b1caa6518d086a1d6c71767
SHA1 de23f32fd673a2dcdbc292c134498bba51a4223e
SHA512 50069448d79e5d5f61d4df7bd09796f08ed1766b2dcdff6fdaa5f9cb72057e1340b5b9dc27a15ed1c2939469bbbde3c5ad9d4e8619e61ab9f2fcd74294315868
SSDEEP 12288:1+sf7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:j7yxknw4FYnshx8OfVe247
TLSH
T19575F028E29802E4D06E2136CB625641B3237C6597F1D3CB97D0F53E1FB1990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 f9443c2839e964142d2d125f61c400dc2bc3fb4a52377536bfa496360208cdf3
MD5 91a49603a7a060fc5cc50c8c85537345
SHA1 b5be9ffa0c22f88076b652f474a2e536da15dab3
SHA512 924b83e0b7ae9400d7edaf37897c2c07b544ffcf3608310c7ebd8a5e84cdfcdd7538df8c16005fa317eea6bf67d873e0772282d9a71a1fed42c8323e543d0c46
SSDEEP 12288:Bb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Bbyxknw4FYnshx8OfVe247
TLSH
T1EC65237CA7DDA992F56D15730A31A231361AB2B4DF70C14BD768B11EE4B0CA0E83E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8691fa3a6d9f54489bca7d5175cc7794ef19b65959455c1af483e50f738be3e0
MD5 583e7cb51dcfb525b5d6783636241026
SHA1 3486f7b43d59d3d401c785d17b8f9db257d396e9
SHA512 d40aaa732f493a016c48098dc3064a7fcef3426779221004ec6ffd50fdf41dbbf655dd65ad9d5dfc06890a6bcb8808d6d57ec32eac2daa91300c3e7919eae66f
SSDEEP 49152:9a0h2GEkuAe73q3pp46zwwQYx4x8EVep:9a0hNYG4Jwfix8EVy
TLSH
T14585AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1150853D7F37DE48E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 496fee052bb35572d5a6958418c6b24b2bc2fceec8895663f2a26a04f4c3fd1e
MD5 8d0cf623f203a92cb2f3314a4574ec8e
SHA1 0d7e41cd0f0d146484c895672ed1a9efad9cb645
SHA512 9f919dbc900f9355ec149ca0311a400bcb5f6436b0d5230735e3fd15add969efc191ea718425fa675bcd1848e30d7b5b7ccc037ee6431d9988168064e42fb6ab
SSDEEP 12288:5hbHjfXw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5hbHjPwyxknw4FYnshx8OfVe247
TLSH
T18C65117C27EC20D1F175A17A86A28206D331B8651B3193EF93A5923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 273f2d330446aab0bce9537a27cae7091753afd80414cc3a470a9bf9f2a0d746
MD5 57291f8b5524f3f3e5fd59537cf6ef76
SHA1 1e76761ba82fa6aff496cdddcad083efbc9e6bc5
SHA512 570bed694ae023946086ac71eee0105b9aa4d6686699bdd36b34056db26072a332401056a35d4fac7b376a502f81908dc8c8127d16eef8b8075a5fed9a2e5fd6
SSDEEP 24576:P3YgnJcRTk4yti+R5dBR/4yxknw4FYnshx8OfVe247:PIgnaTk46pBR/bx4x8EVep
TLSH
T12F45BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 e5afe199f2888acbb7ab7bd3299375a7d9b999c472b85c74d4914d3ff3919280
MD5 20d03206ad3dc19525895bb1d2e48f8b
SHA1 825de5bf5889f955c34bf1d7c3786dc581831f97
SHA512 3d9425bccb0f63feca48e92dc3a8a4f09f68cea4e2c25b4b1883c4363d1a7007ef59491a55d786d4dedda39c6f827150caa9403c4d495f35cb860d4798a741d5
SSDEEP 12288:Cn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Cnyxknw4FYnshx8OfVe247
TLSH
T1DB65237CA7DEA4D2E55D15730A7262623605B2A0EB7182DBC77DB10EE1F0CE4A03E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c37fb539ca362b2b6698084aa83c2e3a81cb7062933a6db3012322b2fb751670
MD5 763645e44557ac68b30fe13d29b0388e
SHA1 1f2ba58cda6b844e90b91fd2f5e3f9e6702962bd
SHA512 cc6dbdb569df06a240c2df2933fb849c4c98dbee6846d2a3c92ee5b168df54ba19168218921b2a14d3c689653c01d323b987961874e5a4c25c5b87bfdb0e6333
SSDEEP 12288:KOb6A4LWOsvAYFTS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7CL3UTSyxknw4FYnshx8OfVe247
TLSH
T172850158F7E400F5E86B813DC9729612E272B49D0774E3DF43A84A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f0a1924924b0efa168f81791228744ad19e284f762f855a7595b14724324ffc8
MD5 121990217e4fc75355a5b4dc1173ea42
SHA1 404ba464b3ecc970d1bd04f1f75297dee0141843
SHA512 2b80c26c4b53eebd36990247192744d7226e9416555f58bd8a7c69b67214b59af8e06734af252e9dbe8ed96f85492812c326a0b2f0bfb53092f536f189041371
SSDEEP 12288:fpFtkOu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qOuyxknw4FYnshx8OfVe247
TLSH
T12765022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DF8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c3bb44590de22b7a9b72cd60ac7e8b4547a67f0720a8ed4e77264d44cd0b0909
MD5 f0c0b486f2e1c6ae2c7143163b68a0c0
SHA1 d3c5789d177979d503f098165f0389b5902ba042
SHA512 912c78d8d99195c6a2eb300fd4710b1e5afbf9f7731c0a72476492d8738523f8d78ab8f2229a371efc501dc606ba7dcff9a9b8cd4e30e667c40bf17a88725ef4
SSDEEP 24576:Z7NM9YqZqmWMUkPjZM48Mv6bEhsryxknw4FYnshx8OfVe247:Z7cBWMpPjN8DbEhTx4x8EVep
TLSH
T19B659E2D6BEC81E5D476D13DC9A28205F6B2B4611B318ACF5162833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 df251496fdd7dcd519b84daad2ff95f8ed57f3a97df57c1dd679e450cef592a4
MD5 f956846489c938dca07112cd32dabd1f
SHA1 29540449cba8bd52bc07659667aa93f5344c240f
SHA512 af38fddd6cfb47d882c679ca05df7f7134b246d715491d6a41cc3054330e042f76588de2ae55f50f662f2b15cd704c21357e0570b57faf48a995bd87de5d9599
SSDEEP 24576:7W6BApg2YuyuNDYTabvcdvNYf8km1Byxknw4FYnshx8OfVe247:7F2YuHNETovAvNYf8kmux4x8EVep
TLSH
T10F858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7b787e7c527efbd4795a35cad46cc79d10d2913b20f0a59c3b8a125bfd20d073
MD5 0718f02f2f45e7bef99cc404df2abab9
SHA1 f5ed0f5b4a9db40b773466e78e615cbdc7c6b737
SHA512 256004a99441f30e3ea1d85fada0046fb34ab5ff98358a7fecd676c713ed28c098e80c377694f21b6db05d2e91ad907a084728bbb27ce6bec6ab8223b9592bac
SSDEEP 24576:SAFs06+Omlf3NXEbToqyxknw4FYnshx8OfVe247:LFs060lVXu4x4x8EVep
TLSH
T10665AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 e1643bb691bdb7d2737b736485235fadf216638ab95a6fa7e6adff606bad6e76
MD5 99edd3c42a72fca0e06215c97fcfa7bd
SHA1 d32872bc53aabef2b7bd878f405abc96f40d3946
SHA512 fdc04711a6937c09528500b8bf1376fa1c8b3f2a89aff49fa8340ccd63911a653370083b4275fee45b24a4555afe9d84261bfc4ba8593b667bbf96c7cf6f9fcd
SSDEEP 12288:BCJnJ5D3Vkr8zxL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YJnJ5D3WoNyxknw4FYnshx8OfVe247
TLSH
T15685D03CD2A810E4D4B7C274825A2756FE72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0fb95c5fe4191d0ae587463b7facb140569f429e9d95057943e6d0a541a1e700
MD5 69367761e610d8b9a0d2d98656158cdd
SHA1 88674fc9459db8e4d5fe78dcf2a30e7d5c6b2107
SHA512 92f19eab214ba9b249ca5250c9b26030455648946fe7196b66ba88a0b28edac876a27cf5843e77104b64686e5bea25c52efa505071666d26c643c9a7188ea87b
SSDEEP 24576:CEPghm6/7IIXdwcXrif7qQncjlP65i3Vu4yxknw4FYnshx8OfVe247:1g06DIKdwc+eQnSt65aVKx4x8EVep
TLSH
T14F955C15B7EA5294E8B3CAB1CA72A1169B327C509B34F7DF0AC0C92E1D33AD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 af133e4a1d86b6fb9fb01bf344f49b16f24e8f02dfd6f6a0cc881faab36a895f
MD5 85eca8712ec06af0f7ac1826eea5c051
SHA1 e63d0b0df45e2487ee62d1050f726f2e17f104ee
SHA512 f032742de907c4446c45807a265ddb110b4a4f133141ecbd47d03d0cedbd22dbfa09f914d6a8b4cc8c36acf52240785f99c2218f5191ee0239106e8aed5fe1a3
SSDEEP 12288:iEP3RMZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hMZyxknw4FYnshx8OfVe247
TLSH
T19165126C779D70E1E52A503A86A18205D372F0706B7253EF87A5D23E8E72CE46D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 547035cfd9f22dbcf4f9cc05377dd0cff2b6aca49f77f644be3031a45941c76b
MD5 f361f6e8bc2dcf5893a5940ae67e1011
SHA1 7fc7e3274ea76374f92302f4090a5f98122535e0
SHA512 8233ee55270e7011a5994ec9bdce67ae3758cd8ab2a06d7a960bd41374c8d179b475682d51fed9798725711b30ad8662fa3af597b6e2c823300b2d205de7205a
SSDEEP 12288:ajkyg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aIygyxknw4FYnshx8OfVe247
TLSH
T19F75121C63D8A0D1E5B905369A7352A15A35BC709F3193DFD290F23EAE71ED0A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 9077df0beba7a8bd87286ff6911c6ab43ab5acb152df9a2f26f00c84213450fc
MD5 76b65a460ba427544f26cb2ca6b60313
SHA1 13702ce3c979ef071e78be7047b6e2f4b5a9b4c0
SHA512 3ee9d248da3591e91fac3b8b69c9034f06a0e3076725ec3991a823e489c6fd3a37aee8a39389dbaf0acc980014d833b9c90eecb3527f3c86d1935dd796a4c0e2
SSDEEP 12288:SGe+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:feyxknw4FYnshx8OfVe247
TLSH
T15865237C63EAB4D1E91911734A3163626215B1B4AB7191AFC7F8F13EE6B0CD0A03E953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 bb5cb70c0b25d5c53f6521d999f34cd2c7930295769c83ada108d512a2fd59d4
MD5 aa0925b524b3eb4cb7d3a0b631874a4a
SHA1 6c2f74ba2f2fcfa7b109de9014ea13f2bc74fdc5
SHA512 54c2fe3618352239a2b6f3697f4a7f1dc380f4874fabc1f10608e1be4731e5fa8a276c9618c3edd9e907591450093c2ac94ab6df85961b7ff37c25be29cf3a13
SSDEEP 24576:WQ9MxZKdcz9dw3Dyxknw4FYnshx8OfVe247:WVKZGx4x8EVep
TLSH
T1FC558D2DABE905DAE177D23595B250C3A633B4311B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 0fa17649239e827eb0293c17a5c1252360cc4a8f9347dd855a2162d909f9a88d
MD5 df8c264ef5c68a5453db1c63c1ef9829
SHA1 01feaa31c6f245ce7f8394aa956294283ea72c9a
SHA512 9348f084f2dbc76627c22d43618cb1ac2f54db0e26109679352209165eab30811ba56048bf5c0af122ff65a2ff6dc18a13d58eea71581395398656ad6bf45de5
SSDEEP 12288:vyoKo2SRple9pc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vyocgApcyxknw4FYnshx8OfVe247
TLSH
T1AF75E01FB7AE40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6a775d6b49fdc59c39c3bcb15b99b13cb5b7cefa420ec07e12d0ce6f1c2059b2
MD5 965cc0e42cae929d2f67e895d7722c13
SHA1 bff068af56588ee32311ef8b282aead65f2c94ab
SHA512 d3f117d9c0a9606c92fdc8e3d182c89340a7c785b5cd24dd59a8512aaa0bb5558e1cc88b5564bfbda7957167f38d21a863e6e468348c4dc853ff6f7ed30f92ec
SSDEEP 49152:JWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK3x4x8EVep:x0zuNINix8EVy
TLSH
T12DA57B3DA2EC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b624ac147b7aad86ee1b4552eb8b26a86820fd30027498aa0ba1b69cb61ca798
MD5 2b29a76c8640a47725203bf4803e75b8
SHA1 932061abee98d5a292594448ac519ab6ea1a4971
SHA512 282b73ad69b39cf2e3485fd505f04a5daff92c51d86595161eca7cbb59191d8c6a06b057ebf5b36dc57a56540ca6ddd4b41f49ea361ce4162903515161540b1f
SSDEEP 24576:m1QT7EcpfxR+N5AWAz3ooiYtjMqbZyxknw4FYnshx8OfVe247:rTDxR+N5YzTfjMBx4x8EVep
TLSH
T10D55B02EA7F815E9D1BE85798B23C512FA727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 1f2e1ed51bbd3966f8680fc201b040367ed7bfdbcbec0626e99f480dbf3c4d42
MD5 ed9ebf1008eb45a2454419db4de5dfcb
SHA1 71f5b5929b1cabcd2c08afb6d438b20990a96801
SHA512 e5b962cd6081b42742c04e74a5a0a7c409e950fa4585fa26bff33c95032ab0302ca0c701da781e1f89829f81e0886aa4c5420c81e34e2a5ea9591649f91e513c
SSDEEP 24576:6TMdOz0FFS+7mSLlyxknw4FYnshx8OfVe247:W0K+7mSLwx4x8EVep
TLSH
T1FA85F13DA3AD14E5E47BC17D9A538906F67234610322A6DB06A0C07D7FA7EE4793EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 cfcf393d19a0f6a2ab6fed8bcb44bff39adb005d1d26a0e0af1907c194ffe679
MD5 b4c8ded690905f33bf97ef159d4df264
SHA1 5101abd710c8aa3a38c740748e6790e3abb00c02
SHA512 06b3a38baf277c3829bcb55b3ce029a92a866d621d2143895b86211b88635dddd2c94af97dfdd5b03d233a4a63d37cbdbf0cfc31bdcd66107ff14d0ae252ba60
SSDEEP 12288:M4pS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JSyxknw4FYnshx8OfVe247
TLSH
T11565122C63EC30E1F46A52328A3252169631B875673192FF6AE4E17E9F718E4D43DB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/60-74-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/60-95-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/60-80-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/312-348-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-362-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-345-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-346-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-347-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-349-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-350-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-351-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-352-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-354-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-353-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-360-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-361-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-363-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-364-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-366-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-367-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-368-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-369-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-370-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-371-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-327-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-331-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-336-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-340-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-341-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-339-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-338-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-337-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-335-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-334-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-333-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-372-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-332-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-329-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-330-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-328-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-326-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-344-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-343-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-357-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-358-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-365-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-356-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/312-355-0x0000021640220000-0x0000021640230000-memory.dmp

Download

memory/448-138-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/448-143-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/448-136-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/448-310-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/1132-166-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/1132-112-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/1168-162-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/1168-108-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/1168-102-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/1168-103-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/1188-282-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1188-124-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1188-130-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1188-123-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1468-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1468-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1468-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1468-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1584-200-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/1584-119-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/2088-33-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2088-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2164-66-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/2164-55-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2164-56-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/2164-68-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2164-62-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/2332-172-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2332-380-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3244-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3244-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3296-101-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3296-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3296-22-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3296-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3412-159-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3412-359-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3424-150-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/3424-70-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/3800-342-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3800-155-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3812-163-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3812-376-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4244-84-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/4244-0-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/4244-8-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/4244-1-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/4380-85-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4380-91-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4380-96-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4380-158-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4472-325-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/4472-147-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/4536-171-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4536-115-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4536-377-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4612-100-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4612-12-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4740-167-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/4740-378-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/5064-32-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5064-40-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5064-34-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5064-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download