xred | 47ccf7af5db91cfd6774898fe25950ec95ac5a9cc44334603259b2c10bca7b8a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Size 2.7MB
Sample260803-c5tnhsxane
SHA256 47ccf7af5db91cfd6774898fe25950ec95ac5a9cc44334603259b2c10bca7b8a
MD5 5af98b017d095f61ebe894def4f1f8e1
SHA1 5f943a6ed85797b590060ee525bb8756f61ca4ed
SHA512 33896debc120d7af084e725184df6766f07cd09ad602ad43d47802f5bb3fa4c025bec6c7f994dfe3c2103b89c53001716a4bfa07ce632c4eec4eba7fd661fd70
SSDEEP 49152:ensHyjtk2MYC5GhV83EilpQJSPYGKEilpQJSPYG:ensmtk2ak83EilnKEiln
TLSH
T12CD5E032B2928476D1235A38CD5AE3B4482A7E142D34794F3BF43E4F6F3E6816D152A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery xred persistence ransomware spyware stealer

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe

Executes dropped EXE 27 IoCs

pid	Process
2936	alg.exe
1664	DiagnosticsHub.StandardCollector.Service.exe
1700	fxssvc.exe
4196	elevation_service.exe
4524	elevation_service.exe
2996	maintenanceservice.exe
2896	msdtc.exe
4528	OSE.EXE
3536	PerceptionSimulationService.exe
2888	perfhost.exe
4276	locator.exe
804	SensorDataService.exe
1796	snmptrap.exe
4868	._cache_2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
3844	spectrum.exe
1584	Synaptics.exe
2016	._cache_Synaptics.exe
980	Synaptics.exe
5048	._cache_Synaptics.exe
1864	ssh-agent.exe
4612	TieringEngineService.exe
3384	AgentService.exe
3312	vds.exe
4928	vssvc.exe
732	wbengine.exe
1652	WmiApSrv.exe
5096	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3147ecf2a19fe9b3.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000975daa0f122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce24eba0f122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e88eda0f122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f4fb4a0f122dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2eaefa0f122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1688	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1664	DiagnosticsHub.StandardCollector.Service.exe
1664	DiagnosticsHub.StandardCollector.Service.exe
1664	DiagnosticsHub.StandardCollector.Service.exe
1664	DiagnosticsHub.StandardCollector.Service.exe
1664	DiagnosticsHub.StandardCollector.Service.exe
1664	DiagnosticsHub.StandardCollector.Service.exe
1664	DiagnosticsHub.StandardCollector.Service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
644	Process not Found
644	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2816	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Token: SeAuditPrivilege	1700	fxssvc.exe
Token: SeDebugPrivilege	1664	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4196	elevation_service.exe
Token: SeRestorePrivilege	4612	TieringEngineService.exe
Token: SeManageVolumePrivilege	4612	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3384	AgentService.exe
Token: SeBackupPrivilege	4928	vssvc.exe
Token: SeRestorePrivilege	4928	vssvc.exe
Token: SeAuditPrivilege	4928	vssvc.exe
Token: SeBackupPrivilege	732	wbengine.exe
Token: SeRestorePrivilege	732	wbengine.exe
Token: SeSecurityPrivilege	732	wbengine.exe
Token: 33	5096	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeDebugPrivilege	4196	elevation_service.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1688	EXCEL.EXE
1688	EXCEL.EXE
1688	EXCEL.EXE
1688	EXCEL.EXE
1688	EXCEL.EXE
1688	EXCEL.EXE
1688	EXCEL.EXE
1688	EXCEL.EXE
1688	EXCEL.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4868	2816	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe	99
PID 2816 wrote to memory of 1584	2816	2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe	101
PID 1584 wrote to memory of 2016	1584	Synaptics.exe	103
PID 980 wrote to memory of 5048	980	Synaptics.exe	108
PID 5096 wrote to memory of 4376	5096	SearchIndexer.exe	132
PID 5096 wrote to memory of 3672	5096	SearchIndexer.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4868
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2016

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2936

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4284

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4524

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2996

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2896

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3536

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2888

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:804

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1796

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1020

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1688

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5048

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1864

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3384

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3312

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1652

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4376
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f32efc0ad47a07842d6ef365e8e54e2bbb05a21288d785e15b60084b2b914213
MD5 71e31c04ffa5c6d853837e0e5bac6b59
SHA1 d63aa425e39f6f5a13345abfb91169533d920505
SHA512 14558f2adb0db42895ccc98304cec344ac2cb737df218151b7000b014767777b06fb3347cd2a2b8b0f50dc3c468402dfa9ddab45ed148461a643359563413fc7
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnjEilpQJSPYG:d3q6HjBcEiln
TLSH
T122D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f63792df71b48e7d0e87f7171602c11f208839dde7524b4c19550140612b32a3
MD5 7ad062c69fece23f882f95d4e37a176b
SHA1 4e5a3889c53f3ad599c37e78f5f2721772a86e11
SHA512 14a4e065d10ff14964ea7123079327d20d67a2335d0dc49ac759d6705d3c7e33006a4b2a9341f21989ede24f3cb36b2d5082c221cff83675ab2d4d79129bbc3d
SSDEEP 12288:L1XLsswWkxy2lRq2czA68kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:xXYfDtczA68qZ5xpHEilpQJSPYT8L
TLSH
T1D665F12877E404F9ED678278C9A2C115EA73BC5547A0E78B03E499261F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 93afcbedb1affd8062c9f3a65da1bdd62f6740aa10837e75b05eeaf045fe9ccc
MD5 104328c64c532a189b3a93ba5ea1048f
SHA1 46e8b4f08c0dc7c3d59587d6f7952b11388183f7
SHA512 fd1d111047d7d60eae646ef5ed8878ecc1c7669c9d23703a6db26aba5be268f583ba7260e2dacde99713702ed1c614bb9f862e86076f6d105759e65626f9b09b
SSDEEP 24576:S0Le5ji0hmxMrMJ8qZ5xpHEilpQJSPYT8L:SPji0AyyEilpQJSPYG
TLSH
T118859E15F6748335D073C0B9C5D2A68EE97130861B308ACB5286D77C7E67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 35bdf928715c4817c8a01de20fb16b8d3c80a6b026b02ad21970f49465887afe
MD5 869f8df1d7a070dc916adba21a834dfe
SHA1 1e50b90f6a2e7dc569312905036f00bfca9f61a3
SHA512 a8adc298b70bdfd1899238f0757ebd21e93dc23815f0106314978ff686095f2a5ac12179dc9a01cdeffb194cb8e103ea045865232e294943e5b1740f608f318b
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWE6q8wyun8qZ5xpHEilpQJSPYT8L:P/ezSC6vUzPvxHjyWEilpQJSPYG
TLSH
T102755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c3396c29b357fd647410bcaa53c59d730a9aca9c7fb97f5cc3558f3617dae71b
MD5 83e8c12b86e6ba36bc949003625e4fdc
SHA1 e42e97e7db6f4d46d35da7d61f66b6f0b6d345db
SHA512 47190050539c98f15559ba255eaaff6521a3819772992f6c91c17c957fd9979f68b32b07f9bbcad40c7f4f7f40027014a20fb1c78dab23bd0a6b12dbf686afb9
SSDEEP 24576:BVbqPb88hv/l+6y8qZ5xpHEilpQJSPYT8L:BVO88hXl+nEilpQJSPYG
TLSH
T1EE559E66F5748331D073C0BAC5D2AA9AEE3234414B31CACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5e416f6eecd8141975cb2793fb63393a0a9406f4964bf370d7ea5c41cb0f5d14
MD5 f41d9e9957bb3a4ab2f09b36345dd689
SHA1 0bb48436723d14ed5cecf14dfbe001eda7dfe5f6
SHA512 32063783a0ead2e2d0b18c1200bfea755db2f8d9358abb55b786ee21f994124f7c35d523b7a722db71b77d6b80ac90e2513d4dc0b96c507c6f97906043bca23f
SSDEEP 12288:Lu18kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:Lu18qZ5xpHEilpQJSPYT8L
TLSH
T1B64523485A54C0D5F79B6BB093C5E1DEA8B89E1844D89F0FB4B07C0B593EA78DC9C863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 04c6b71418e4b27f8f9eefd0a7f4c6e7d166f2079e27ee261f63d94fe3625626
MD5 0f347056cb4c9926399a436d2be8376a
SHA1 2e5e16a35d24326958c817e608c865b39889bb98
SHA512 5156463f144eb95823290db7663c3cc6534c56c999d49383b874c6e26932a2e74f8b58f9dad7846064cd9796986aca4924bbe73f99ed94177314800544795177
SSDEEP 12288:leBNUbTVO86Uq8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:lJIUq8qZ5xpHEilpQJSPYT8L
TLSH
T17665CF3BAE28FCD2D27A9DB85791C240E77278304B61A3CBE175820EDE235E45D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4a4fd2f4f4101fcff219bd69357ab7b92615249a1ea12682ca45eff5851a680e
MD5 7fe4700268a411d10920ee96570e3a82
SHA1 950e50b2bc720c38753c42e2100f2cd667a58e4a
SHA512 4956d31f514e27754f42055f6009a01c9b6530968bfb219dd58995f8e627da4c98ad5a21e1dae3bb9caeeb6e0aa221ff83d21aa90d28b322519ddfee31209aa7
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THk:5QvGAdlCEL8c/yRNw5CdEiln
TLSH
T135267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3810e73339308d8ba8d71c5570e64ced864eb0ffa3e2ea466e536d59fc1d4a2a
MD5 fc2e5d2a4df05e4c4be586ac0ef61a2b
SHA1 b55d995fde13b74db688501daf9a5536583e73d0
SHA512 63cb8799bc0f7a15277eb0de468e314814054856cc693fd80c0cb03f780c480e0a10664dccb0994fbe89f0bca53c015982ba1c76f623fd1a8a24f918a5e61c7a
SSDEEP 12288:+AwSfxL/2Dc3uDLLmt0LDQewsAjY8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFEa:jnewsAjY8qZ5xpHEilpQJSPYT8L
TLSH
T16275E030FA74D036D3BB0DB21B26D71A547CBA204B911AC3F3E89D9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 436f3be6db802e81660bc077b4f4103fd99cce0f6ced256581e4c0d38246d57d
MD5 41369a7c390d8d2667dce0055104d870
SHA1 1eada5a7b405654024170cde923193c035b903f4
SHA512 a42d3018ac4ca7d8e6868fd19fdcbf9c64fd554c60b1212d17691ae76ae90a4d21af99f068ca6d8ffd5d395fa1cc663f78eb1de901f17ce95900671a07be8575
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHViln:OUEtQevvqc2W1cpV2EI32V
TLSH
T1E3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 08b46c751ee4505d526e955ef5efcda49c247da119170036dbf58a3ea4b972f3
MD5 cc2f035bd9d377dde764e4c926195cd6
SHA1 aa418ebb99276486f89552ad48253f2a7cfaf11c
SHA512 746b7aafa96322b1d7baaea4c0f8a87db663a93780cc15e9119873943b26ba02aa7ccf5f4c382c18d0932c65da65c639c3fba1ae5217598d0946e590a64e047f
SSDEEP 49152:DCbRquA/m2yL5zLfFiV+XenmE3/zCEilpQJSPYG:8oq2VjnmREiln
TLSH
T164D58D0976B8C1E4D1F6C77886A2C647F37178154B30ABEF5265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7ea6ffdc0eb2f57e95b5a382309fd47281837a91ee4257052f9a0ed94d98b1ab
MD5 d5a648eb9bde57c05cabb3223894e4bc
SHA1 84e0fbac1022e0a739c1c8729b91684601ee4a96
SHA512 0734e2d699273041ad3a129f019246f4cdb784f950332a8eb3f59c0f032c927139b7fc656674b94c877c4acefe18a9beee57a23b2c1e55d9d71aadc8d70d3032
SSDEEP 24576:GAhGLJIFoiwtA5l7S53L8qZ5xpHEilpQJSPYT8L:GAMyFoiq5BEilpQJSPYG
TLSH
T127359D80E7F951D4F5B3AAB899B69171EA76BCA95E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 c1cedddb89256945cc69610e4197e87604c7c43238e68584c517748edf43cc34
MD5 eb2ae6348c354324721b73954df817d7
SHA1 624a3cfd6efab6c5fb441d5779cfad10d697ee0e
SHA512 604fc9851950d8826d414d2b53a1effeb7804547b175b4d0853c13b9ce6bc29dfc756c8f58dcb41f054341647244f24b09f845e3fd22b6028e1a7f265a700513
SSDEEP 12288:Omw5HEjsChNHBFgl0WDm+Cz8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:HwueOW08qZ5xpHEilpQJSPYT8L
TLSH
T1CF65F14976A408F9FA6792388687D136F7F2BC012A65DB1F1760C61B5F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b73a458f95a2001776214fd86763f7bd1f5259f3439325c7de73093a746fe418
MD5 b0bbe8dc43e779be313f5f117205ebf7
SHA1 9c8ced03ff5e7cf13ce7c46e27289ee3abba0bb2
SHA512 bffbc1a118292cebf1fe0ae689db32eb11892f76ebd68e439c23c24b07e4c3914658b5e87432463de7e65d663d7bfc8029b7494c0cd4c5bf448a9dfee371dcf8
SSDEEP 12288:aXZ1Iyo8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:SZuh8qZ5xpHEilpQJSPYT8L
TLSH
T1F155128933A460F9F2A76278CAD19249E7B27C1613B583CF21A0552B1F37AE55D3C732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 696a86d521de275f8590896705a2d1850f70a9de02ea437196f92b9cdaef05c8
MD5 c7f99e793845dcec8bbae929fc031d0d
SHA1 13e33da31815aa8c837a067662f6a57c8807da3d
SHA512 380ccddad1a7820cd9b46f2e95f277e5c1a5bc67e903793d59714c6538432ceba7abb0d459a1a5ec8f9a5b6da841cf55e53a78b333603b0e3b799999ef499c0e
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:6QRQyi36YOcPQLvw2gAf+PN3cEiln
TLSH
T16C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2290e114051b512169e1e4f1875bbd66bf5faa23aef0a87da357b5e79074a4f9
MD5 14721d1e0132f7b3b8ec7f1c53ceb2bc
SHA1 6e10d538fe1d7a0568c7427c41840b56c6e936f9
SHA512 b36da729153fd5bf9407415b0bd011dbd34784e2850fa1bbc4b77860ec5dece18aa764a7fd8d5fb1776975bb22cbdbdd9624858337bd9fe6adb3538d332f1c77
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:0QRQyi36YOcPQLvw2gAf+PN3cEiln
TLSH
T1A4667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0d39f7d226e93fa71bb9fe09b870c9c79eb557bb7395cfb6b9c4d0bf2642bdc3
MD5 25411eaa2376f53ca691e45aebaa4f51
SHA1 e982efd3ce601bd03ccc17a7d11c6191792b6bb3
SHA512 51b8dd6f176d6101cdc1504d0baf22969d90f66657583d0459cc4305207ef620cd56a362ce53655eb5e259409dfa9e52e9b2e666fa5051eebf2272f6ecc78b30
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0R8qZ5xpHEilpQJ:Y68Qg55nhheWu7PNU3/yEilpQJSPYG
TLSH
T110B55933B2F200A9D44DE1769F4A973196D17C758FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6ddee8756d5fbf919b5a52af874b61cdca1337b3d97225f0cac55d3537542b95
MD5 2a469439bdb7be2a6b418fab8ba410a0
SHA1 5454477512dc3a70a89769098f9ca0269785b33e
SHA512 8dbf780a9f17fc8de8d0f379195a00932b51e367725f119acf78aa17f52576a6f1174804e17e6b802974e1ad7520630137230805135b97f85b002d039daf34ad
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99K:Xy5112gYy5azzVvL69nLKnhZ/Eiln
TLSH
T1C4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6f349ea1acfa706bc94b71a65ebf4a2503bc265b272e99c71e65b24ab8bd7f9e
MD5 1d45f3a5fdfb1a0ebaa28b944df52d9b
SHA1 1559c1aafa9d5585f4c130c497cf99eec3fa7c60
SHA512 ec21d6ecbdb3b00f53858f50a0913f36c69618fce3d4323f2cb810fa80b7be362d87923ef90922c5218b934623c84c6f61a4adbbf527370d7832ca9f309615cd
SSDEEP 49152:YB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gloEilpQJSPYG:yu6JmVxd2doEiln
TLSH
T11ED59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6a8c1707b60eb50ba5be5ee9691fd6b1648f59f142c55e27109b99efd26f31ea
MD5 67614bdb390d1bbd51bd4be52078a122
SHA1 f25bef759da1d3712871559ac028dde831fa8ca7
SHA512 70a0b9004df921367231169c383787eeca59b8ead80966742c60a63425244eb011cea995aed3a35c2bc99719d167e96b5054723d9717c6b0d0148f308b928b34
SSDEEP 49152:R1hpsNoJpF1A6UU44CwH7R4xoEilpQJSPYG:RmifPbRREiln
TLSH
T174B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B6961F7BBE45F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 78235553ad49aa95843cbae1e8548d3ada35fff3c5043566b57ec2940dec0dc8
MD5 8d356dab73c978b29a096d07df2de54a
SHA1 947b096e79c77a5d6452cb707e91049011f5b8a7
SHA512 0e38516f64b429b46447c7c101bb386e7b98f608f6d3f45a1e50b24a5bb35ee1e6518e125ea300ad55a49cdccd29792328462bbffd35e72ce7e49ef6ea1d0138
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHqbEilpQJSPYG:45dKTi61bEiln
TLSH
T11CC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7caecb47ac27444425ac75e81303a9a17cc6a0a43793f6e4e44a100a7bd1fc58
MD5 235534142057a73ba2a7335ce8f13ca2
SHA1 38ed792c1fe81d16487c6ae6a843258e1245d2b7
SHA512 a3265cb144a8e6b1a28e9d42895fcd8ef777c722c8e2e787256c8687890948dc21f553e5190396284dcf05d9d24a3048376b0080e9bbff161cade67750aaa8ad
SSDEEP 49152:jhtSn8EApI0figngiDn0AP5wUEilpQJSPYG:CX2iyphVEiln
TLSH
T1BE95BE13F2D900E8D05ED178C7468632E962BC150B39BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7932606e009782c14fa9ae5767bb2fd5b8e0617c95671f7df55e7d28c4cbb1a7
MD5 8dca30d10f54f0aa5b64fbeb1878c1a3
SHA1 7375e1e80d099f10f607dee2ba08012e2c99b37d
SHA512 85f0666b528c8cf09ef0f0e1edaba0664be38113291be1d1455f957880d782bfd200376eb8b6ec26b292fa4f41e39960813c3bde141df508222b497892a9b9d3
SSDEEP 12288:6N8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:6N8qZ5xpHEilpQJSPYT8L
TLSH
T16C45234C6964C1DAF74BA7F0C3C2E1DDE8AC5E1C54D8970FB5A438075A3EA781D9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a258c22be0f788561d17f20d552ab69506783dc718110d94b51927c073063c66
MD5 7efd799bd81ad7462716c0c598474025
SHA1 7bcde3910789f70414e96eabbfe0c9de42e32532
SHA512 1c47b645dbb9375be3dcb50a1216a1656f27005f6429509095d571be59311bc1766e1db14215b1e0ab09c8e92a2eaba242ddcc0fbe964784f7c252114df4df70
SSDEEP 12288:WE8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:WE8qZ5xpHEilpQJSPYT8L
TLSH
T1E145234C6964C1CAF34BA7F0D3C1E1DDE8B85E1C54D8974FB5A478075A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 137a3edff0acdbe823d40bff676fd4cef59c9e3d4b1933d908525cc7edfe6e62
MD5 ef7efa86c5d666e20f1035276c027f41
SHA1 511b692ad57e85cdf0434bf01f611cdab2e5765b
SHA512 e30b58d77fe80d90c12df183adfef796d49e78e1a3b4bcc3a9d869b19774e956e2d6b0f32f86954f6dac415abd09aef668ade39bc77bbb0d4d77865ccb822639
SSDEEP 12288:bnsfh8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:qh8qZ5xpHEilpQJSPYT8L
TLSH
T17655F109D29842E8E16E6275C7829645F3777C2483E1D3CB62D0F83F1F3A6A45DE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 2.7MB
SHA256 47ccf7af5db91cfd6774898fe25950ec95ac5a9cc44334603259b2c10bca7b8a
MD5 5af98b017d095f61ebe894def4f1f8e1
SHA1 5f943a6ed85797b590060ee525bb8756f61ca4ed
SHA512 33896debc120d7af084e725184df6766f07cd09ad602ad43d47802f5bb3fa4c025bec6c7f994dfe3c2103b89c53001716a4bfa07ce632c4eec4eba7fd661fd70
SSDEEP 49152:ensHyjtk2MYC5GhV83EilpQJSPYGKEilpQJSPYG:ensmtk2ak83EilnKEiln
TLSH
T12CD5E032B2928476D1235A38CD5AE3B4482A7E142D34794F3BF43E4F6F3E6816D152A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-03_5af98b017d095f61ebe894def4f1f8e1_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Size 1.4MB
SHA256 8ff0af33f72d0dfa3b4ce10bed5cc95c548dac6624b758bf445b30706139d741
MD5 d868bda87812c370e1a6054f378461a1
SHA1 0203cb4941baff2ec8d6bfcac08e4eee9b76e77e
SHA512 4ad9909e0b5f543f5629fa5d2c1ca18085e19534860926276f936f85aed3b5e9b9bbc1396c6c21d14b75b733711f533f196b6af0ced178f501a76d1a227d9e1a
SSDEEP 12288:mnP+t1b8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:m898qZ5xpHEilpQJSPYT8L
TLSH
T1E565E0646343CC99D2478830CA58E2F144265C28A5A56AEF37A53F1F7B3E9828F11D7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66685E00

Path C:\Users\Admin\AppData\Local\Temp\66685E00
Size 20KB
SHA256 007be6674d21d858cb24235531b8796dadc0b9ef7665c43c1d2e30a271679092
MD5 6e0e4e3b9e92688825b26fca9d891e62
SHA1 42be79c474be7f86a71a81c6e73719e313ce8fb5
SHA512 9ff7ec21685e74a10acd0b8b0010c80ef56546a580ad6d1502cff762af257bf05c3db7ee722a00ee785d23db8eb46cb74b16fcfbb4785a1160c4b97e5e6e3d00
SSDEEP 384:MavLo1Evfp+o5bMhhLIxPpnD89fP0K3dlAUsaem08:M+oOn4o5bAupD89fsKNqHaemp
TLSH
T10F92CF1DDB69BC5EEDB04C3E829D18A7E221259DF3144A563C35B28EAB514DA038B2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zcOyFpWy.xlsm

Path C:\Users\Admin\AppData\Local\Temp\zcOyFpWy.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3147ecf2a19fe9b3.bin

Path C:\Users\Admin\AppData\Roaming\3147ecf2a19fe9b3.bin
Size 12KB
SHA256 25141ad3dc374cde2431179da2758bb23c827dbdd1f88305743bbd808a59b709
MD5 484459a66570ed62a9ddac22c7f27db2
SHA1 5f317bdabcf2d8751d98772aee4f2f37aa2d7783
SHA512 c6f8d9d5a68f27f53e45e5ee5f23faa5eef8a87f5b8a5897c255f8a0b316f8699ca56a2f0a3d5711cc1abe6f91ee15ea8fe4a1f57d446e5263612a14029cd45a
SSDEEP 384:28WcMbgP/Pq3nPJl8KmbvGN0DVkbjTl7UsIc:281kgP/kPJl8KGvtDKbjThUNc
TLSH
T1F442D1773117E348F7510915AE2C03A37F38163DFE172A72B542D3C94C1A6AE1E852B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b29f4b0dbae5a2ce5bf63d550794a4ecda8a647c362018f9408082dcf0ce741e
MD5 9807c06616a6bf81680ece51d9eb8a33
SHA1 f25c7548f06f72ee286375a953ef4a24729e0e73
SHA512 cda978032b8e43fcd9560aab324dae965254d1330ce75801e0805c6d402dfd72ab4581c91441068006796e70dbf119d2228c7aa2814c70c62b8503d510bd4152
SSDEEP 12288:8p8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:8p8qZ5xpHEilpQJSPYT8L
TLSH
T1164523089768C18AF7AB7BB09381E1AD747D7E284DD4C64FF490381B593DAB49C6C923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e9caae27292b4a1d8e492b59b8a080d02a2db313d5301125ad9ec77b726a9a37
MD5 6e19dcebbf8743347f12058a3176a694
SHA1 fbb5f7202e4a62670a4c2d498ec82a76969a4d5f
SHA512 edb596a93ab5b448165ae995ee5f4d8e92e1fbbc415317c8686cf1ad7378857d4435f7052c8544597f58daeb913dfa675d43ee1be651da940f40ba5784ea52bf
SSDEEP 49152:Ja0h2GEkuAe73q3pp46zwwQlEilpQJSPYG:Ja0hNYG4JwWEiln
TLSH
T1CE859F1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853E3F37DE84D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 f91aa343a578b0e41b28b189be485b3aad692a0b474374fb4a661c934e936938
MD5 76a8433c16b1469eb0fb29218aef408a
SHA1 49e3418bf9166f4175de4a1d266a3221b7643f48
SHA512 ab929a8897939ac615991f8b9f0318b58a44b4210ec0a8c3a41f096cf5d8214a5d9fe6d2d514e694df793c6d93646bf899fc4d4c0504feef4b87ea6860f21ed0
SSDEEP 12288:AhbHjfXM8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:AhbHjPM8qZ5xpHEilpQJSPYT8L
TLSH
T17955126D26AC10D9F276A2BC8682814AD771BC29175193DF72D1813F4F3BEE85C38E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6eb2c350c60884c7711b09932da927089e68c1449def432769ad0ad7ecfa6bca
MD5 243e439e4383988c02c283b6c22a1d61
SHA1 e7bf0eef267da65d413a689fe2825b83df2a2d85
SHA512 be7a8aa9d65b6e4abd19f8f2c1a603a89ac539c648f3b769d564045141a9f311cba568b9f68fb5843cfb506c71b2012b088d8cc83ac2c6f0bd7cb5e2fd962961
SSDEEP 24576:w3YgnJcRTk4yti+R5dBR/08qZ5xpHEilpQJSPYT8L:wIgnaTk46pBR/+EilpQJSPYG
TLSH
T1BC45B02DF2B910B9D8A6D236450143B5FB71782D1F209ACB0170C539AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 1578e56911e8d1031c5d0a128ba0b864f5c129dc8dbf3cc77f5d92fefe8b9bf8
MD5 d0245da148e1d23652acbc6aa2fcdaa3
SHA1 46fc8abb6f23d265ffa7169e19b6495b428ccf30
SHA512 2dba6249dd80a192d416865be03afa573d7c8200524929e69b94874f3993da95ed0918dd72fe9540c49bbbb57a4d0d7c2decdb2e97114052aff58bba0129be74
SSDEEP 12288:5l8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:5l8qZ5xpHEilpQJSPYT8L
TLSH
T17D45234C6654C1C9F75BB7F08382E19DA4686F1806E487CFB4A0781B5A3EAF95C7C863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 afa15054fca3073c9fbbef187ba68d587f1d4ed75596d25b54f715debdd9e24a
MD5 b19515e330b0da19b2082e3c64ce06bc
SHA1 5a9751c196e60b339f94dd130c013975a8ec4645
SHA512 21054bf9fabc64e18bf68744b5b7ca4dbaa29596a4731621265d09c21696be009e6dd8fa499bc13f471c0fb2b2cb7388bf4611dcbaea09ccb43ac6128d4c853f
SSDEEP 12288:pOb3A4LWOsvAYFTC8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:eTL3UTC8qZ5xpHEilpQJSPYT8L
TLSH
T102750154F7A400F9E96BD23CC5A29516E272B85D0364E7DF13A84A161F237F14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 e434036b19d8bca81c73a981140797015c5769a8ffdfe685e49b46c7fc23ac0c
MD5 a1cc94f9aa40d165b7765f88e6a9a394
SHA1 ff7160e6ec5556f814044b4e0f21c5c6545f5fea
SHA512 b3fbf738964f171ee642f8cbe13185fd385819a03f5e3b76df95016b846f92613c3e5c8b4441cf8eb90c7f4c845c83d6049686fef1f3060df1c4e742d72d507d
SSDEEP 12288:LpFtzOm8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:tOm8qZ5xpHEilpQJSPYT8L
TLSH
T19A55011936AC10E5F27AA27C8A82924DD371BC25076157DF52E0807F1F67FF86C39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 71f2861738a317675502f21db408ff2a2307d6bf8f378d4873f9fbbd884d81c4
MD5 07752d8d15bc6260782b116d5a171add
SHA1 711797fbe171ab3de6165a940df8aa74ee1f30d3
SHA512 92610cc985a9a04eaa4ff22898741fd6a90aee51ffc434ffbaf84e12863a2873f4659b4d29561336a873922ebc45ca6f533b30b35d885667d0c90f3f062a66c5
SSDEEP 24576:J7NM9YqZqmWMUkPjZM48Mv6bEhsl8qZ5xpHEilpQJSPYT8L:J7cBWMpPjN8DbEhSEilpQJSPYG
TLSH
T17D65AE2E6BAC81E5D577D13DC9D28206F6B1B4611B318ACF1162833E6F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 df88c5c9b249006bf450852e0dccf48b8e56b749ef48aeea38bfeaadd5e77b3e
MD5 f018b389119c6bf2cfea148d044694ea
SHA1 d2633be9fbb9b7ffcb41e249a5acf29d42ac1706
SHA512 fe6693253ba2b8e92a5a0d1f1f17b18114237ddd9552fa38a993bdd565246b811b2f631d54a1c985bf2a90bc8f366d8a6e3673748102997b17d5a45c49be0a09
SSDEEP 24576:fW6BApg2YuyuNDYTabvcdvNYf8km178qZ5xpHEilpQJSPYT8L:fF2YuHNETovAvNYf8kmjEilpQJSPYG
TLSH
T1EE858E2927ED80A4E0BBD27D45B6D246FAB2B8551B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 fba64cf9ad18530315125b61edbc183ebb4292f42e5ad000058e21b1d799845a
MD5 c9d3f7e7c35e59a4fbd80f621f701a5a
SHA1 a5a4f3bdc5677cfedeac0140c0fefebb282e3130
SHA512 5eddd913e3ee9d7916a2b161b17d72a0b287448f0e9e9b717aff0d7bef41016627477b00a1bd4a5c025b6de4a652d567728dd01b2031c858e01d6a7ebd7a4202
SSDEEP 24576:aAFs06+Omlf3NXEbToS8qZ5xpHEilpQJSPYT8L:jFs060lVXuNEilpQJSPYG
TLSH
T14765AF2F66AC00D5E07ED17D8A97C91AF6B1742707255ACB0160863E7F6BEF81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 9f6353a096e9961bf32c227d985ce23e278ae57ee594613756bcc8731838642a
MD5 cb89d00109ec328098bd634e13c5ac88
SHA1 0e7bebc68fad375c3ff67dc25b33be60ff2fdc82
SHA512 ba77d69643bdad5e42f1180ca4963ed8d3c2ae06b99c298aa8c437cccd1f7491ec2d562e6df351b3cfe3ec267056eef429b8e5ce4a5a3f9cddff609f37989c55
SSDEEP 12288:rCJnJ5D3VkrFzxF8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:mJnJ5D3WNP8qZ5xpHEilpQJSPYT8L
TLSH
T19275D02DD2A810E8E4B7C3B4825A5795FE71383D2F226ACB24B4D4353F12EE09979F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 37a6cb553549f88ebef913740aa34d234ce40a45fd82a60b4c0380311b727c53
MD5 a2de052406044e930381f19f9237388e
SHA1 7a7374fe8b9aeaeabfaf92cf069e2de9a7fe28ed
SHA512 a97c7296fd4bb6c0bb4955bd50b865bd06661caac0024e42f066e50ae3b35b37ddeb3e1e60530f85b389c8db6f78fefcd2e8670039db0b3f76d9c85246c5e38d
SSDEEP 24576:XEPghm6/7IIXdwcXrif7qQncjlP65i3Vuw8qZ5xpHEilpQJSPYT8L:Qg06DIKdwc+eQnSt65aVDEilpQJSPYG
TLSH
T151955C15B7EA5294E9B3CAB1CA62A1169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 aaed8bed9f09e8e50a39cf054f4f1efa111e2073ac83dcc3cd67f86bdfe1b9e0
MD5 cd8ca42e20b42ee6f96b92f1fe240196
SHA1 99ce69975740f041e1cdd3fc13b4d590be29476f
SHA512 fdfd30cca6905b960690d8b3ff6dc71c8f383a24267b38d6ead9e7698388f2fb440b54974f1aead9bf64b709356cc7a227f6931769fd6e3b27c81f488a868f0d
SSDEEP 12288:xEP3Rhz8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:ihz8qZ5xpHEilpQJSPYT8L
TLSH
T10855125D27ACA0E9F22AA17C82818249D3B2F434179167DF65E0913F4E3BAF91D3CE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 5c943fa031774860b50b87da5450465a26977de3a6a499be75e377b7ba141db5
MD5 409b13f4d26f482f27e021578a46b0ed
SHA1 9e9544ac417f5453172cde5b3680283e8393e87b
SHA512 1cb8862bf5791325bd19a3c203cfbc7baa82990aaac6396d96692c1c8b8b41892226838715d35585f3e0901a37a13f2c536b23a76a728e7601ac5a63b6f29b3e
SSDEEP 12288:Qjky88kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:QIy88qZ5xpHEilpQJSPYT8L
TLSH
T146551208639490C4F6BA5678D79391999A74BC205B6097CFB0D0F93F5F3ABE46C38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 6997d62d9863e9da022d2f9a4b4ee5122209e5acff3c060b617c149dbd5cc0ee
MD5 ff8dd9b3f3e8fe79b01206a0e2806905
SHA1 b98aeea502ee50967d413611cebaece2b840117d
SHA512 13784f505c9141abc7d4473dc035e61267b036b1f0e96de854aedb1b0119b765778feb02bb6d731e1f2334e46aa0f8b72fe93834b3fe5c0ac92247e8b4a38915
SSDEEP 12288:wlW8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:KW8qZ5xpHEilpQJSPYT8L
TLSH
T1EA45230C2664D0C9F75767B48381A29DA4787E2817D49ADF74E0B8378F3EAE85C78C52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7c55295ca094a40926f5c2047a93e9b4a451256f63b70b112c9435d0a0dbdc6f
MD5 9a8cb803ad5eed207b9c1f108e1ba5e1
SHA1 9ddf976b991e9c0cc14d9e3d4326c3be5d94ec3c
SHA512 32fab8be3da03bbd2125195fb3667847283c9849f37ad43b0bedfcb2f674f0224ebd9316bf32730635ab165d053ac063bc3611be233167306ca2b7d4d4fe5b07
SSDEEP 24576:+Q9MxZKdcz9dw398qZ5xpHEilpQJSPYT8L:+VKZ3EilpQJSPYG
TLSH
T111558C2DABE9058AE177D27595A250C3A673B4301B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 3fb32d6dff2986a7a5436664d7dfb59e8ed1a1c1ad5ce775aacb55de0408396a
MD5 7fef52de79648afebed5bc9f86cb525b
SHA1 a4920cd19e71fb0b3033a1cb2a0e8d7e29092be0
SHA512 e5d2153519ba22dd32b22663c2e606c606451d5e9dbe43a7540075b55cdc452f47095ea420efd87315d4fbf4ab948eee759c6c77be3aaf1eb56dc00b802864f8
SSDEEP 12288:3yoKo2XRple9p08kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:3yochAp08qZ5xpHEilpQJSPYT8L
TLSH
T18A65E01FBB6940E2E166923C89818345E773B4301B6257CB6591C73E4F37AE8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 69126cad11bda552e8e314d4b2c918f735c157f8dfc7c2d6f24e112c4f41c335
MD5 e63216a94b855e866fe18c34a2974d65
SHA1 4ebc8d93c8fd02268a5c92d6258faced9638dffe
SHA512 bac4344700427aa1d90d12b2f108267aed17f21119b3fcd3a992675e57e877f35fa556a6a5bf3614db9004452da8edf77fa925870950a6e3ad3a19e14f4f55e9
SSDEEP 49152:ZWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK+EilpQJSPYG:B0zuNIwEiln
TLSH
T17BA57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 500d9ad5026070694bbf5aa10c5c77a0110439fa9f9b0af37b45a5bf38d11f06
MD5 415042d9dff2078fd4fe80b16ae981f7
SHA1 79478c21e7fb19be19912d57b18bbeddb6688bbc
SHA512 9a6e2c07a21e85673687af32f9f19521d87ae7502e0054b2e1f33af87bfab70fb85c27caf4352d7b53d7c6eac4e96cbbd856f1a193d9843d46b83734b521d731
SSDEEP 24576:c1QT7EcpfxR+N5AWAz3ooiYtjMqbz8qZ5xpHEilpQJSPYT8L:BTDxR+N5YzTfjM0EilpQJSPYG
TLSH
T18555B02EA7F845E9D17E85789B23C516FA727821033193CF42A0C17E1E2B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 188cf6f7110c83009e56a54e57d9f1582fda54fa3f1a1ad7e8fe88c8787f26b4
MD5 ff888071ef53fed0dbe7c5506fb530cf
SHA1 8b12c1d1ce02f8806e6bccb92b4b08f342309376
SHA512 d17e604dec1a7ea53904c406b77be0f89ef30f6142025897a2ceb13bab4d0912c63aef47b381c4e2dea6a290598d36f1e0507e5d413126236f65e0ef2ac59b82
SSDEEP 24576:HTMdOz0FFS+YmSLf8qZ5xpHEilpQJSPYT8L:10K+YmSL1EilpQJSPYG
TLSH
T19365E13EA36D14E5F57BD27CD643890AE67238650321A6DB16D0C07A2F6BEE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 fac7b74a716594a032c7e85a68d6a3ceddec6587d3fac827a10849c638853018
MD5 ce360cb076f07f6c5c1d8bbba108b9c6
SHA1 6321b6499e05e72872492022bda6f933a74102e1
SHA512 6e4e457a779f736ff182a055568e3b64c737ca6f32c878d6c1bf1e1bdc6f10586f543139df7043cb897fb72263cfa18a3746680a9533ffae716c45667d887345
SSDEEP 12288:Z4Y68kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:f68qZ5xpHEilpQJSPYT8L
TLSH
T1EF55120C23E860D4F567A674C75692999570BC3913A45BEF34E0D83B4F3BAE89D38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/732-677-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/732-763-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/804-166-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/804-599-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/980-586-0x0000000000400000-0x00000000006C3000-memory.dmp

Download

memory/1584-605-0x0000000000400000-0x00000000006C3000-memory.dmp

Download

memory/1584-629-0x0000000000400000-0x00000000006C3000-memory.dmp

Download

memory/1584-645-0x0000000000400000-0x00000000006C3000-memory.dmp

Download

memory/1584-602-0x0000000000400000-0x00000000006C3000-memory.dmp

Download

memory/1584-266-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/1584-261-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/1652-680-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1652-764-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1664-27-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1664-159-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1664-19-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1664-28-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1688-434-0x00007FFC0EE50000-0x00007FFC0EE60000-memory.dmp

Download

memory/1688-440-0x00007FFC0C690000-0x00007FFC0C6A0000-memory.dmp

Download

memory/1688-438-0x00007FFC0EE50000-0x00007FFC0EE60000-memory.dmp

Download

memory/1688-439-0x00007FFC0C690000-0x00007FFC0C6A0000-memory.dmp

Download

memory/1688-437-0x00007FFC0EE50000-0x00007FFC0EE60000-memory.dmp

Download

memory/1688-436-0x00007FFC0EE50000-0x00007FFC0EE60000-memory.dmp

Download

memory/1688-435-0x00007FFC0EE50000-0x00007FFC0EE60000-memory.dmp

Download

memory/1700-32-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1700-82-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1796-603-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/1796-177-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/1864-651-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1864-743-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1864-654-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1864-660-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2016-433-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/2816-133-0x0000000002F10000-0x0000000002F11000-memory.dmp

Download

memory/2816-276-0x0000000000400000-0x00000000006C3000-memory.dmp

Download

memory/2816-11-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/2816-0-0x00000000022E0000-0x0000000002347000-memory.dmp

Download

memory/2816-10-0x0000000002F10000-0x0000000002F11000-memory.dmp

Download

memory/2816-7-0x00000000022E0000-0x0000000002347000-memory.dmp

Download

memory/2888-584-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2888-156-0x00000000005C0000-0x0000000000627000-memory.dmp

Download

memory/2888-151-0x00000000005C0000-0x0000000000627000-memory.dmp

Download

memory/2888-160-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/2896-121-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/2896-443-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/2936-158-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/2936-13-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/2996-117-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2996-112-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2996-106-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2996-119-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/2996-114-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/3312-761-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3312-670-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3384-671-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3384-667-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3536-148-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3536-570-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3536-139-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3536-145-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3672-756-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-771-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-779-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-780-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-778-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-777-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-776-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-759-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-760-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-775-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-774-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-773-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-772-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-750-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-770-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-748-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-751-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-752-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-753-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-749-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-754-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-755-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-757-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-758-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-745-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-746-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3672-747-0x00000248664F0000-0x0000024866500000-memory.dmp

Download

memory/3844-241-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3844-604-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3844-257-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3844-247-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4196-84-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4196-190-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4196-90-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4196-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4276-598-0x0000000140000000-0x0000000140133000-memory.dmp

Download

memory/4276-163-0x0000000140000000-0x0000000140133000-memory.dmp

Download

memory/4524-95-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4524-256-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4524-103-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4524-101-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4528-134-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4528-487-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4528-131-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4528-125-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4612-664-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4612-744-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4868-191-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/4928-762-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4928-675-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5048-585-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/5096-684-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5096-765-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5096-706-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/5096-722-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/5096-738-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download