6d9874818d360211af25149395d9a01c7ffe467ca680292e167dbc2aa7c0b609

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Size 8.3MB
Sample260803-ffkk4acb95
SHA256 6d9874818d360211af25149395d9a01c7ffe467ca680292e167dbc2aa7c0b609
MD5 a77a6ee38ba960686ad8b19bbc706481
SHA1 b46b51fe0cbbca4030620a8f6f738adc175b8dd9
SHA512 80a2257c2154b7e81711303d31fefc35177ff63e5b1e330a2897ac4c1d09d319fa058dc26648d25f0b2db2e9e1db27846ae4c2cc1131cb030f9dc893b96e1c67
SSDEEP 98304:XPi1IuJqZhGfeZ1fezbapHFg02aqbutcKCd1xjv3bgam7WqVZhhHEQs7wRGpj3:Xfu6x0zOZezaqCtcKKv+VZHXoF9
TLSH
T1F196BF11FA01C039F8D202F687BD8BF9E97D9A24077560C753D46AAD9F305E23A35A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4520	alg.exe
5040	DiagnosticsHub.StandardCollector.Service.exe
4236	fxssvc.exe
3628	elevation_service.exe
3040	elevation_service.exe
4516	maintenanceservice.exe
3740	msdtc.exe
4700	OSE.EXE
3340	PerceptionSimulationService.exe
572	perfhost.exe
2544	locator.exe
2244	SensorDataService.exe
2792	snmptrap.exe
2688	spectrum.exe
900	ssh-agent.exe
4076	TieringEngineService.exe
3392	AgentService.exe
2932	vds.exe
2976	vssvc.exe
2844	wbengine.exe
3572	WmiApSrv.exe
456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6487463fa19fe9b3.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003589538c0323dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000351dd08e0323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ee9748c0323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031eb558c0323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008683cf8c0323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f524708c0323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065de6c8d0323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089a6338d0323dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076747e8c0323dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd72438e0323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
5040	DiagnosticsHub.StandardCollector.Service.exe
5040	DiagnosticsHub.StandardCollector.Service.exe
5040	DiagnosticsHub.StandardCollector.Service.exe
5040	DiagnosticsHub.StandardCollector.Service.exe
5040	DiagnosticsHub.StandardCollector.Service.exe
5040	DiagnosticsHub.StandardCollector.Service.exe
5040	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeAuditPrivilege	4236	fxssvc.exe
Token: SeShutdownPrivilege	4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeBackupPrivilege	4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeRestorePrivilege	4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeDebugPrivilege	4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeTakeOwnershipPrivilege	4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeRestorePrivilege	4076	TieringEngineService.exe
Token: SeManageVolumePrivilege	4076	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3392	AgentService.exe
Token: SeBackupPrivilege	2976	vssvc.exe
Token: SeRestorePrivilege	2976	vssvc.exe
Token: SeAuditPrivilege	2976	vssvc.exe
Token: SeBackupPrivilege	2844	wbengine.exe
Token: SeRestorePrivilege	2844	wbengine.exe
Token: SeSecurityPrivilege	2844	wbengine.exe
Token: 33	456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	456	SearchIndexer.exe
Token: SeDebugPrivilege	4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeDebugPrivilege	4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeDebugPrivilege	4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeDebugPrivilege	4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeDebugPrivilege	4368	2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
Token: SeDebugPrivilege	5040	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 1608	456	SearchIndexer.exe	113
PID 456 wrote to memory of 4936	456	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_a77a6ee38ba960686ad8b19bbc706481_amadey_blankgrabber_darkgate_elex_glassworm_luca-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3908

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3040

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4516

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3740

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:572

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2544

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2244

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2792

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1176

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2932

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3572

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1608
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 95b89330c4c70a2fce0cef6b1dde0d5e0937235c6d4e5842b233a5bc0a06b07a
MD5 c8dd7caa08bfaf613b5ef8fb55167c53
SHA1 26a4082e46552a33c62512a5edc80d738498c61d
SHA512 70668e2cac6b7502b2f3c925f09a68605fcdb078279087f0e62f6be8d19fb68d179ca32804c13ec3264b62b4f08bf0db0ef1b11205a08fa7d4840dd00f40d67d
SSDEEP 49152:Pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn+LNiXicJFFRGNzj3:N3q6mjBh7wRGpj3
TLSH
T1C0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 8f8c9b8db8936451c5eb2bca4828546c0e72d404930e6b9e58d66c2cdf4f513c
MD5 fe86bd941e1694e7d5983f4b98ebffcb
SHA1 63e778b29b966b78624e8872a625a6570e46f19d
SHA512 6353e3aa7827389ba5296c7ef9d14b4c0b8870cde78d2cdf674d5231357f91bc88612f6b9342c2ea74afe4bb476c522582b1415e2181017291d51495b2df2825
SSDEEP 24576:zXYfDtczA1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WtcsLNiXicJFFRGNzj3
TLSH
T14975012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8998ea560bc7d651b6a73b133a45c70fd23004baf40dc3e10ba9c2688ed99e0c
MD5 18c49441c246be702c56052881ae2b8f
SHA1 cbbffa1f7e39bf4d558030b096f86744451d0b16
SHA512 20ea6d3e732f1dc060afecd4da3b3fb81d2e090754954ef3f8c3d66a7d8d89547afb5fb4f3fe1a36c1441fb75da8c05b7f06ad00725008bdcaaaac684444e15f
SSDEEP 24576:70Le5ji0hmxhrMG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7Pji0AznLNiXicJFFRGNzj3
TLSH
T18F85AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5b457ec8234e3759546f37e438150f6b80d129a00f05a5c2f7ae2894658fb168
MD5 2b44b363c1b156a7e7d634563b12bed5
SHA1 6f809e9d32bd51c2bda67c3dec5508be603373d2
SHA512 baa8edc106340706ed88279d2d98c357e32875f07fdd228a73f01ea96de08a64361625753d655d61236d8b63718a6af5efa39446e0de734d42191fa604c3f655
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWj6q8wyuc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:O/ezSC6vUzPv+Hjy7LNiXicJFFRGNzj3
TLSH
T1EE756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8f036628bb96876b724cb6bcdcd9322f501792e5b60c5658614e4c7b5e990e1c
MD5 57bedafafa87fc3c67f954965d280aed
SHA1 e21697f4be116047393e138e15278c819856776e
SHA512 9a08fd9cd0b35ca0969b298e2033f06fdf038d2abe1092e6a5880541b3a8ed76acd4303d867c83ea58ea56f5566165466eb51e6d49613ec7c2e98c91c5d35def
SSDEEP 24576:XVbqPb88hv/l+BR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XVO88hXl+HLNiXicJFFRGNzj3
TLSH
T19F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 aff8daceaea71924c96c47b33b8f9792900dd2608018e41594e1e9a9bc454de2
MD5 1334e79e5cbc2438a116b827f59c3c85
SHA1 ed1cbd8c089aea934aee2d892b1399ec147911b0
SHA512 ff7132ad8ed7d87022f450fe3facb95816f8cee45a8e6538f054b90acc2f1afce813a60015fec7d3f24a9cf3974d0a2b2168c62522b90b1a92dbc0896e3b2aae
SSDEEP 24576:TGS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TLNiXicJFFRGNzj3
TLSH
T1545523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 64b9d4de56b6efb61a80611ac931c7e2700d7093287f9b7c3864ff0bd15c909c
MD5 c92b6f0b4219089e7c05903f302130f0
SHA1 10e8fbffc1d0596b3113436c2f7ec16c8dc2c607
SHA512 f81cf53a9c6ead0903ba32d0bc6e9b6c956ed95e188e1e1c52f3a7e26e2aaec4cd20b3ee3831252657f014034957c6cf6eea36d95dba39d379e6c577f5520ca1
SSDEEP 24576:IJIUZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IJIUZLNiXicJFFRGNzj3
TLSH
T16075CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1de420f316b7a7b6b6ec8a54c634b1568accf7bef5c01dcf7f700629f78ccb4c
MD5 254c87502279bfb4c9b0ab91a0a5747c
SHA1 eb21d13bb7713ac2abbc1842ba58d8a455d23ddb
SHA512 3d68a07521d60d12cc86225e3be6aa82aa9fca78151b10cc10875d62054b6b10f066f648bf4d7bd5f011142d9a2cc9f05ccad924b480e55a3296709e803c3fd9
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THp:YQvGAdlCEL8c/WRNw5CM7wRGpj3
TLSH
T1BD266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5ebdd48781a915698d013c96b116bafe813228c32bbe9986cbe6a16957ade268
MD5 16230edbeb4e8fc9063c6f6260fc1f79
SHA1 769898ea792ce93c51c92d8c0d978185d43a9d3e
SHA512 ac7d991fd35847cdae00a8d8fbbd91b2df0ae6e1b549e53a3861cd8ebb5d586d1d0f3f5d6065f3a9676962de5d92edb2098be5dcc36fffff18f63e2b0fda7c5e
SSDEEP 24576:WfewsAjX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EljXLNiXicJFFRGNzj3
TLSH
T17775E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 620e8d8721a01020af78dcb14fde8da7f55d17a18282d879cd62950cfc0a0fd0
MD5 58a1dfec148c51f9aca74a5d8da9ff37
SHA1 48b7ddfe0ae5f6316e3b990850af4cae5ffe7e68
SHA512 f041fff047a0d5447b6e26bb8c3718b87b7fedb8ca106fe9a2d0eb8947f010016112f4bd3b1b64653c9e0e15a644b15756f9577e670f6211963a8a3172936f08
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHzF9:TUEtQevvqc2W1cpV20I32x9
TLSH
T112474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 619ba87f11ff7eedcf8737087caa0ef653f3638ce19bf47acdcc5c873ed090d2
MD5 825a8c15e721b36676f8bc57f925b312
SHA1 b49fa8a6fcd63056beffc7eba7617f8749bbb73a
SHA512 571e80d7ee41c288933a9927493d7abac77edd6fedb2f0d220d046e52a0be8b291d37278a7f0d51b809f391722f7396fc97466533cae1c29bac4ec59641b70a7
SSDEEP 49152:zCbRquA/m2yL5zLfFiV+XenmE3/z3LNiXicJFFRGNzj3:Moq2VjnmQ7wRGpj3
TLSH
T11AD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 597fabdf467b5b4197027521bec8982be1d376ddc43c31a69e26f5a1edc93e88
MD5 ae0606fd9182877c8fba51a3ef03ecec
SHA1 de96e35b0f745769a9b110d9d309959e0b7e157c
SHA512 37d89923ecc4900f34907b61325a6caf12a92c82636cce8d9118ccf42cf342c073b1ca4379a5b3a5c0c7dbccce5a7bdcfb4c3ae59767953d5a499ff902d29c43
SSDEEP 24576:WAhGL6IFoiwtA5l7S53w/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WAM5Foiq5ALNiXicJFFRGNzj3
TLSH
T148359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b3aa1e2f2b0be8b93b4122efac71550c2f874df404646e4f93287d4ef5783a1a
MD5 2474670467c3f3aa92092fc995bd72db
SHA1 986c88fa75685d0a148f6d3237962a5988881a5f
SHA512 969b547e865d631c8b15be300bb08cba514b31df561666aace518123787996483c4f1ec72c7a9ca460d77518dd85900ec0e38afc8b6de88267ebf6a64b595432
SSDEEP 24576:iwuROWb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iwSOkLNiXicJFFRGNzj3
TLSH
T13065F18632940CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b2f504fe60eb56f34e02b5aa14122a9f090c5f34367a39f8a4e5a25d83e50850
MD5 01cbe63a0636a3add7baf321e94c8b28
SHA1 ea87842135add4ca0f28c76f6e8f43ca61cc1081
SHA512 552c8dfd3c7086e2cf7f0fb8604a4b9e21eaf294a1ae682a1906260e2a05c5512ba326cbd79d835a7614f5117a6314846113810636f5a4d6586289e754f2ad76
SSDEEP 24576:+Zuu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aLNiXicJFFRGNzj3
TLSH
T10655129622C820F5E2BB413DC9B54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 051d8d072e31e449ace95552236e28c3b29cd5437ca3dd616f704be50ad608f6
MD5 379a3240d3f749c04e5cf8600a921aee
SHA1 831e0c08114c63127f2add403025ff35227c9bea
SHA512 125b5e7b097b1a0ec6526b815a09108c2f14f982d07d15a97aa2cb2feeecf45022818b20067babfc82f89be2b7212e921319f312ab6c43337aa195e711086980
SSDEEP 98304:jQRQyi36YOcPDLvw2gAf+PN3d7wRGpj3:yQyiKanX+PNRF9
TLSH
T1F5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d308b8a843c70deaaabd1e017350fca2c8902f991fa24a448af7e1485d28923a
MD5 a6955fe3ce3aef8d8d503d76b5e301f2
SHA1 574e5bb4dd4877adce57a2a75e09e797065782f9
SHA512 28f1586778880bb332ba0ee01b0d68a5c2f56f80f4d336a10787d9c39f51cbb38a19d4e0530946fd1eefcb9943b6559161b207b323c4e132228ad21e05786a21
SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3d7wRGpj3:vQyiKanX+PNRF9
TLSH
T18E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d01576c4c866027acf1f5b3420564de93839128efe34f660c8d2112f83bfe07c
MD5 1510aa172fa675228409c07a66f64058
SHA1 2eb26584e039765e872569abc346374d35a3cc04
SHA512 fcb63da902db522505c7abf0c933f4866506161927492fcfb571e6da60f50a22d8845ad77fde4507093929a928875a194759bc5fa3243425d8096f900f6b8072
SSDEEP 49152:168Qg55nhkeWu7PNU3/nLNiXicJFFRGNzj3:DthTRc/n7wRGpj3
TLSH
T1A9B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 662d19fd69c69c5775a43cc5356996330a7e269731d0dbb678dda03328beceec
MD5 5b0d8c3a7fb071f8a4efe512e926b48a
SHA1 1656274228c6fe56bc41f958ccd513855f9d0fbf
SHA512 9f48e8b27a7bbb5482f850e29f9059864bca0413db19729e46f0131e8f039548db09bbb883398e7f8cdaf5454ddf1a06eb16dfade698cc87dd7e9772c0a38fdd
SSDEEP 98304:Ny5112gYy5azzVvU69nLKnhZS7wRGpj3:wLIHRWhUF9
TLSH
T106167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 74765f9a6ea6ed31988f2930479989a9ca6d1c0769037ba5eb5f008ffa037377
MD5 f0e306008169cb5c7a28024a463091b8
SHA1 bdff1354c7d919ce2009054bcbc082400ef7d5f7
SHA512 183a7ac8e166bc479fe7aa219bb9489596c8d60ef46416d4e280e5b2939cd1159ceb38fcd2d430f8eabe750eedaf41acbebd3cf085099647447d8921c14b3191
SSDEEP 49152:UB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glFLNiXicJFFRGNzj3:Ou6JmIxd2dF7wRGpj3
TLSH
T134D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2279c2de8b9ec49b5600ea77df74c80855ca4ac33b964a2c715f1adf9ba005b4
MD5 9a7fa7fc5ed5a7bc1a5d28542758ed4a
SHA1 4c056b320e693bbedbba4904802f11cd451f8d86
SHA512 0a045afd8983a1cfba782cc9948c55bd6d909f8272f6215d89468853fc5899cdc25b5611a390b9f642fbefa4877101289d18a9c4788eccb676b90cfb56658a05
SSDEEP 49152:C1hpsNoJpF1A67U44CwH7R4x5LNiXicJFFRGNzj3:CmifPqRQ7wRGpj3
TLSH
T151B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 50a92104281325e93a066a1580e06ef754aa4c009186ef141b4b85fa97e6ae95
MD5 9aad6122087a8db21adfa79d1bb41158
SHA1 15c19361aab2fd10f13ae1f8ab674b2f0d0f1f95
SHA512 633d9bd4a71e06989b947c99ad4e0c8d44e12d46adba0433d243852feacc92189d2558dee8f75848a4903865dc24e2e4e9bbb981fa702b7b2c0b68f636d09849
SSDEEP 49152:NSuZQIY0Be2KkRVtOnks6NMHquLNiXicJFFRGNzj3:D5dKqi61u7wRGpj3
TLSH
T128C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3aa0757075eea4323614025341367db5b2754e8f298d3cf42396211cccc2f3cb
MD5 9346a1a4614200b877f606f2d0cf4e46
SHA1 1c61e817b4eee2e0c9fb9fc72a71f4b3139e683f
SHA512 0e65ef97c0900dedea63b7493e0237bbad2bc719cfa5b91672a4548ca42ec6cda5b786f06bf80f4f99a57cd8503bd53ec72caa856eff209a6a1b97112a0df94d
SSDEEP 49152:ehtSn8EApI0figjgiDn0AP5w1LNiXicJFFRGNzj3:/X2iWphE7wRGpj3
TLSH
T13795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c06f01c6ee8c27072f4591993fee8db3941c93f26e2bdc3da184100ff6e11c1a
MD5 cf45206ccba6ab675e814c484bd1bf6e
SHA1 5eabb626018b85d154aa0de3568c77d0cb45f758
SHA512 32e36cbdc6ad8f369f89bf2eaaf8c0e1fe938f4e0c734847e0e0d8dc5e697569e4eba5f8cb6d6284f841285ba56a327c37f4b5584b5db42329f4913497b350b9
SSDEEP 12288:SoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16A5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 247ec498f3b89c53df1fe86a5017da39c0f30e69b3301131b5665dcc0c250c34
MD5 ed36cbead1e2af8b47dcb05fc5f44b05
SHA1 eb56affecb4764389d874c9b156d97ca96cc3f7d
SHA512 bdb97f6a749154211543918bfc358d696cc84811dd326873866ad6dfa3929dd93229cf17799c695b479261a29a6c78f0c97ef2c2c22fee5d856980e96f09b797
SSDEEP 12288:DHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D75523D3548955B1FABC003986754428F5882E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 be57d00863ae1e301a59ff15f55618268bd9d66d36d72d2937f6985f2ac7b3bd
MD5 22fc9f97dd986cabc15f2eb12cb81712
SHA1 87a019ced02aebeca7f1d0e68569c918c6299a8c
SHA512 b1a6e5e228ef3e31d98f7c4152bfab6647f6932809b309035f1cc24e8f4823f2e9c87fe414a408bda40a2846dffdd9e69c2b99aa7762e8f7d814ca376f95dd8b
SSDEEP 12288:S9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16D5523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 06eef4d797e0eb54d055fae0deef61d29efedadeb1b046b94586e6373e4cde67
MD5 5be5aa6de14d4348a8cde5ec19ad6a27
SHA1 de9ee4894f16bf65820a762db259829d25b35eff
SHA512 880da14261184652a098d6d532366cef41d4321438e3842d4e2b74bd9b6e05e5a56d695d0b4385e14f2170e504ccf8f05272c50904ccfa4eb0ca12442381fc70
SSDEEP 12288:fVmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DC552393168901F1E9FD8039C6764424F2A47D6CDB325AEBD3003D1E5A74BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4dc98f7d9ee4707ebd1295d35b0b89dbab27afd51950f2c34db04c8a38a80760
MD5 e20e211b90bedb1a27af74d748030100
SHA1 98dec606c52d3177c55ec76876c4216e245a27d9
SHA512 70e88ebaeb26514d3d7981b8046850ed27763fac77a8fba2a3dec93d90824318fbff73293443bdd03af08077ecb42f3dac015c977a25cb60ed07f8bb5f26773b
SSDEEP 12288:deiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:do/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1985523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 fdc353a1d4617d60eec411d1673caf5f3c23c458b8b9a01bc1c2fd0174f0f867
MD5 d7ea327cfea21b536f6f933552828984
SHA1 0c0337502805ad9a459e74f227f97da2f858a7c5
SHA512 62c135f81ec1ad89df6f40a0fe4aebb94c0fdb60334ef10d5288bba0101bc9b3d0fcca3263a413d2c5765528d139bf1c16483b0122c56f8d4dbce8b7eab9f235
SSDEEP 12288:4LiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1585523D3548955B1FABC003986754428F5882E2DEB5619E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3ac561251ad48640a88cfbee4807141d2a1bdafa9f3f9c3d3a96a87d91ef80f2
MD5 27f0fec4a359e909171edf7985a57507
SHA1 32154ade7bc7116dabd21055daeabaada6de0ac3
SHA512 f36bff5c3469ad92ca5fb695065acfd3231c694779ff62b831245d962e83ee5aea52a64846d5f4cbb30ea0f840f9172150c0bf1f50e8959bf2028793f3749ca9
SSDEEP 12288:5fiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5r/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D95523D3548955B1FABC003986354428F5882E2DEB5619E3E3083D1EE278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 9a4317b6093445f3bdf71247bf6ec85b1dd088fa5faff1a31700331ff861d2d7
MD5 4db628b76ee992eab1e6ff47584132da
SHA1 6dcc111335d412d3625a63873b1450e2135f1139
SHA512 d31ec1c4e4feeea111a9d8be3bee3be6d2a39b3abe92c4a76adcffe7cbdea6fdffa4d48148c7365a0405d95b43d7bf79641dcd33a94b5f640ca1d4e18e45573f
SSDEEP 24576:2ZM3zFVSOT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2ZM3zfPLNiXicJFFRGNzj3
TLSH
T135750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f15f5f2680c5fb8a29c4490e271b2e5bb645ccf9b275f8b2dc723a88250e643c
MD5 b16f44ef7f1b0dcb5f2bf4ddeb7d7032
SHA1 8e7c3b796c0a2a718e298413def9a40285623450
SHA512 7eef3c8c238074a184750baa3a74e1fb15a3c8ff0887cad7a6629cb3d745044641a81341324fee768621c099622e114509f32e50a49572136339fdf8bd244fc4
SSDEEP 12288:O0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Oe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1995523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b4abd3ae12575a11dc57b4804355919582de57a79c30074353710400d6ca9860
MD5 50eb2a9ea2c884402483d30597c87747
SHA1 12bca7aad9fb0590fedbc866e8cf1506d13325c5
SHA512 c8deed2636b9f3f954924d5eb7e43c9118a821f9ee769b1eea9c74e054c1df5cee87d4139378a07b931d18bb0a19e190d23d29535e4f01b5f359cbe0a32ba4f1
SSDEEP 12288:lQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E05523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e7608aa23c3a687cc1e42c21bc90ff8e6d6d8b0e590e06394c7743cdb4b2eeeb
MD5 13bea194924316ba03e11978e6da758a
SHA1 9ba685284621f2248095e3ef9bb65a7caa1f597b
SHA512 8b34e641fcc3ca1c4893f9be88c262ee7795107d6f80db6543e9c26ebe5066cfe8e2d4f925d41767e80860c1237c5dffb02ce5d16c41d93de70fd9c353434533
SSDEEP 24576:QzyH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QELNiXicJFFRGNzj3
TLSH
T1CF650247629530F9E17A4139C9620911F3B17C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1d1d74b443bd11e628a696558522add7eea88d2ffca5dfb52a74aff9d06d483c
MD5 120498d14ea038bca8ac7240d54aba01
SHA1 29cc9cde5d24c3703e4b2d30359c9486155f4551
SHA512 48950ae7a73335d50ba59d4b5bc2071d9c309bd4477cdc90d19161b900d22f2d688c009fbd1e25b8c1c05ea550289113314cc31a78f8d97d3aa7359d47a7bb08
SSDEEP 12288:10iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C95523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f9cdb4a4735bc39ac8ed3dcd536027551da44661c0623f70d71ad7f5318583e6
MD5 6783879de876d943987c61e17928b0db
SHA1 6745b9813a05bff243619688e90de71010a5bc2a
SHA512 4db3783f7e6dd932c064b03131dcd5c14118f91880ed2bf340c577849f72f696672bc621797a2f87c64e32360ced21dd548632cbc356724d437911ec39f65e6e
SSDEEP 12288:H0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:He/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12E5523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c32f8157a3524a51cf1064c97f708a0325658b15a87d226a4258b6d849436560
MD5 f61016269064c5c951b58b5ca357d2cd
SHA1 06ff2d8e171949d862b13bc0fa5c244e1b4be3d3
SHA512 3d4b3ef20ac2ae975e252d39cd4afda5e2ffab371da41360ba5895c29af38bc32f6b6a477a064a4ec29b153705aa754c5be20c12c3d32feb2349e174342d632e
SSDEEP 24576:rzyH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rELNiXicJFFRGNzj3
TLSH
T16D650247629530F9E17A4139C9620911F3B17C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 4e242386f342b4682635271d6071c4e5835d236bbdbba186d941e4e85669cbc0
MD5 62c7dadf8b7aa82e377f679fcb20b2e0
SHA1 eeb8bbd23b3510da88d3656dd6ba1d90155697aa
SHA512 7fd64d62a9724b86d6ed9cd3dd39210c8d82b277cc3090a28c033dfe3ed5446cd82e15be859fcc501074cce37966ffb180e12bf4f620d0ffb096ce6175867561
SSDEEP 24576:EcP4mcvIjkGOxhKP2l71nNKbrh/8KBW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/P4m4IpOO67W8KMLNiXicJFFRGNzj3
TLSH
T17865AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 548d1c1a13e2cac5b5c3bfa9c559dc03cde3aa3cdcb4b67c22626ddeaa1a0b1d
MD5 a5157b0593702aefac53a06cff9b8d73
SHA1 b6f728d4b564a995cfdc4cd8b87a15d79f76721e
SHA512 e3976decdbaaa371fe0ce8416232a42ed52a56b1c231465cafdf6e87c403f5e20760bf1e6ab7654403a598973cd482f2b8748ad467e4266f61e9e4ce491565e9
SSDEEP 12288:npsfkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Iu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B965F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92D0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4ec03a2dcd9560c8a68d546b26bae86315913809f97b377cefd360938f8e3ead
MD5 9d59a48690804d022e272e3a3ded523d
SHA1 6f059fda5e431940c34537ea4894fe02a8b0b2ef
SHA512 7fcd467306935d96bda036387af805092d6430aec6bc7ae3b34396bcd30d762ac5142f44533a6280ec86710224b1223d8ba1f9fca97ad33aec5a7e4155d60d5b
SSDEEP 12288:EEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D8552393528C55B2F6FD1039853A8438B5497E2C9F1599D3E2043A1EA238FEBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 54b49ecf13784bd18c31a1278186e7d196c0418c7e5b66011351fb2ea0f78f17
MD5 36d0b71bef8e9b91396e1fdac2024624
SHA1 0db01b15a8f04f8d37dcf539bd976e32b079cc7b
SHA512 5113ea4011ddfcd825917f4d9f3ec55aebb5b1a087e5ecba6ab12d0ac9a914f5622f4d97ff46d81dcc4690d1da00c55e065a86fa2dcfe2e009108413d0a95b0f
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQoLNiXicJFFRGNzj3:5a0hNYG4Jwv7wRGpj3
TLSH
T1E285AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 8363f755e7c814579771a24a398d5119f21867cb93a74d8a9d399af2770d43bb
MD5 9d6756379214bad3809d6a42c2b063bb
SHA1 8e84280f96b031ec6bfed39f6a0242a8c2ed9ce4
SHA512 25f35784f702d20218c013d5fba0442ca136286835032daf45265f74764da39181a5e0b8ae19e793a5624b6f41ef1672d3b5ba9f02652bf7637b709be2652554
SSDEEP 24576:ChbHjPD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ChbHjrLNiXicJFFRGNzj3
TLSH
T1EE5512BE129C20E5F6B5903D8566840AD370BC29172197EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e2443e45ce296ec07b4154d7c7a5642d7d6d341bbe2de1baaee61b9c5a3f28fa
MD5 335f2823dfb016b4a4fdc5d10cb8d26b
SHA1 a30422917283e0c766971e0510d6f8c9cf6d68bd
SHA512 e5b654863db167bb91836ec37249fad4035dd5e147289bd9ce4e81d3173413127f44b47637017cf8560a5a1843735cec531f88f6749d516faaf8781acfdea09b
SSDEEP 24576:m3YgnJcRTk4yti+R5dBR/b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mIgnaTk46pBR/bLNiXicJFFRGNzj3
TLSH
T11545B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 e96b7ea86acb0c7f5ad5659f83c36794de366596d3888ac52956dc92f6305740
MD5 d458e7eb2e64c698950872ca22b85a83
SHA1 63e2720f5a4aef764ca4b0c3fe86c5a398c34a16
SHA512 834c2fc65f5c2b8c9160c6a3971509d6102267607580669a78f071eca427b668ab503633ff4b18d7458aa7ebe091e843a74373dce55bdc21cf3cb541f06a083f
SSDEEP 12288:wgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1095523D2518959B1EAFD003D86764428B5882F2C9B2619E3E1543D1EE278FEFCF38563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 d30d91f1429a31cbb23cb44db52a5d3498de4dcff8550951a504c365bab5cc7b
MD5 081506e20372e40dbae50621fd6b02f7
SHA1 5546f7e219d81e206c14279a4b1db0a7947f8904
SHA512 d0d773b56f54caef4341c35c75f2c82801fd0d6bc22a0999a7f30158763e7a0a5037978b2905724d18a8832eeb3da16066303f175a96bdc1b3627803ed4a657f
SSDEEP 24576:cAL3UT1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cAL3UZLNiXicJFFRGNzj3
TLSH
T1D6750155E79400F5E97B813CC9728916E2B2785D0724E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 57d9e679dff1fef1f896e086e5c456c70338d4380a79738d8dc52b1552dd1aaa
MD5 2e49a2f704fd7d0ef927c21d541fc45e
SHA1 3b934804f7dbbb17e6ec9924b76710d42dae2151
SHA512 300d30c2497f227ec0806871cd130261fb9691c5885752fe4a2506b1529ec034f2fdf805bba143c027842ba28f6d5dde85c853bfcad8d775777a1b14c50da325
SSDEEP 24576:4O5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4O5LNiXicJFFRGNzj3
TLSH
T1C655125A32DC10F4E5B9503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 22a05a0fbbf223247a6186874992b29b9e7cbaca39007585469f1d65e4e530ff
MD5 504db58c6caa98c04d57df6be7e14829
SHA1 3d589a0d8e8f519c7e0bddd34ed76365b5ac34f5
SHA512 a6edf3667d1d8bfb32076840945f3805665c3466622d8834a43d4409fb1a1d351fbf66e6a13a17927acd5316cbf9af26f286c1da3da5acd3c41993fb74ce51d6
SSDEEP 24576:67NM9YqZqmWMUkPjZM48Mv6bEhse/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:67cBWMpPjN8DbEhjLNiXicJFFRGNzj3
TLSH
T18F65AE2E6BEC81E5D476D13DC9A28205F6F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 936cd1705b8ddcb528bac59d0939347d7c2fc2efd1972ebec910dc10aa69d992
MD5 cd39fe6cd0658d240c6469f04980b380
SHA1 b657089da6913669bc1bb027c966ac6bcf60e4e9
SHA512 8ccfcbc5c4528e1039a8bf2bf708fc90ad3f0538afefaca4af911f77434cfe4a8d59fa82ee3afad025952e0fa0a8a7948756da8e278fd49acc2d7b03a91e1a99
SSDEEP 49152:vF2YuHNETovAvNYf8km+LNiXicJFFRGNzj3:26BCf8k57wRGpj3
TLSH
T1D1858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9e7e6c98328ca0f3f740eb41187c4b62ed7dc5d3f24fab9a7c3ee0bb75a6b930
MD5 769dc6f67a901eb5b9d31b35fa64641e
SHA1 a8fd45dfade5d4036e8f85a04d4f0064ba6cafd1
SHA512 f1b797b13aa23c090cae9cb01d26cb5a58f09d382fb852d023f7a4eeb5172c5be32bacaf2e502d335c2f351cd97140d6f7cedb04f756242f3981a31ae5a36836
SSDEEP 24576:aAFs06+Omlf8NXEbTo9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jFs060loXuILNiXicJFFRGNzj3
TLSH
T10565BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 08d4c8dda4d224d15389aa33291c3e27a9a77c277854cbae82dfb873fce8912b
MD5 10d0552a5b940795adf3e7a3f76932f6
SHA1 175c0767c09a9e8c973d9918c774eb63752fd1c3
SHA512 aa8270ecb295e335d2d13570f1f7607077f21a441a7f9726171639b0ea838906fbb27e5571a13805c5bce3645a5776b2db4d445d374c62d8cf677796329b9e92
SSDEEP 24576:4JnJ5D3WXI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4JnJ5DGXILNiXicJFFRGNzj3
TLSH
T14B75D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b65c1f47c41e26a4786121c3c9e305e2fb996b00ee69e0800caf0d0d4cdd293d
MD5 3738f60dc1080c295f27e7c7e27cba2f
SHA1 112e6e61b760ded9d62e8e7d6d2920bf99ec6ccd
SHA512 0d62a57d89cde79467a94957d1425ae6bb48bbae9ef2fc7eec17eb0cbb838e44e6d4aef7894ec7b6ee148f7e416c4a7e522daf293a12215befdfd57591eca52e
SSDEEP 49152:eg06DIKdwc+eQnSt65aVaLNiXicJFFRGNzj3:X07wRGpj3
TLSH
T1B4956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 58800453c5875fc1d4e22b8d8c1bf25f8233748b0511722920761436a7854524
MD5 9dd8921a1b6cc473a543a3ff7ebf4b65
SHA1 fa4dc61c4aa5199c47d2ad6c60aae7966a6bbe9e
SHA512 7c901b9674d0c7022e1d25b5742167edbbea200b61cd39825a376814e7f120c2901a4be360fbf83cea064a7f9823049fcc28b0c0129d30b361d82449b79b6225
SSDEEP 24576:bn8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bn8LNiXicJFFRGNzj3
TLSH
T1075512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 7fc38a99cfa26c96a41af0d571bca84059490519c0dc832fc634261495cae22b
MD5 160ee7a6bdb406b866a03d3092d0ee9a
SHA1 59620c85e214d1f6ec7bb49d5b06115e6c1b55e9
SHA512 79757526590bc75cd213bb55c22d9cba980aace5630e3ea4bf15769aea24c73c770c9635c5a356918dfd36e77bbc65c0fcf5f3ab063d39e1d9f7ffb8d9aa1af1
SSDEEP 24576:SIyz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SIYLNiXicJFFRGNzj3
TLSH
T12E651245538860E5EAB9013CCA774064EA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 c4f7b35c4c20007911cf01f259b865283a476a4307c0204d065b47d6e68d4def
MD5 7ff5901cd130d332aa4b7df0987fd74f
SHA1 3af5df9d6b7b3c215808f404d856ff058d9da6b6
SHA512 ef08f8b4df4d96229bbdf709c15a6cdc172d8c01d6f4df2366e2eb63efe20a100db254d15369fee33a36846b44afefe513514fa9e0b45335bb3725f4a1838235
SSDEEP 12288:ayliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T132552396118964B1FABD003D86354824F1943E3C9B2628F7A194793ED339FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c90dbbcfca33387783f23b1629db92131adffcb5cd7432abb036621d035aec4f
MD5 c91fdf9f7e9c9ffa3be8d80b8dbc8626
SHA1 0fcde1a59cce6ca9f97692f4b63fc5e829f591ad
SHA512 b88d759b52ae6200f076dc6fb4cfbe3d891609a374849ecf4be055d491015edaf3729a20e33217355c7e6a3a916e086cb51b03a1e198872f32dce7dc316f0c06
SSDEEP 24576:LQ9MxZKdcz9dw3m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LVKZmLNiXicJFFRGNzj3
TLSH
T1BC558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 337eb42ef1c4d8dfa6fdea0e6c1fad81bc0b2ccac60e2b35d5898ddd427e28bf
MD5 d5cff94d1b5695feee7e121030fd787d
SHA1 bbbc965759afe1307fd1b1a5a21a5e365e6acbbd
SHA512 06161c1225f8775c780a11d74a14f8062ae7257480499c91072ba157cfd4a9f39dcaf7959a90c4d18dae05f6cd8663d8cfb98dcbb8643f27450149e3a8b81778
SSDEEP 24576:XyocDApX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iocDApXLNiXicJFFRGNzj3
TLSH
T10065E05FB76D40A2E176813C89858204E773B4345B2257CB6291C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2453027b7a0fe163762a43aebc659f6f0d2eef50d22286964bd9c377a2bb8972
MD5 c2889e697cc06eca335be678c4c4d9f8
SHA1 69b60315375331d03c1df1afd60fc6bf85bcc39d
SHA512 e879be87b4677b44737c7da34a80af47f87181cda0a8e48d340db5045ad4c08128cf8e720c87ace1e0ce2b28bc099fdff55d912fe885f709f2ad7915e8defe08
SSDEEP 49152:pWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKXLNiXicJFFRGNzj3:R0zuNI17wRGpj3
TLSH
T1F2A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5c0bc819f1ecaa98a5dda4b76c0e48903239e2eed6b313262d6fff1440cc5b80
MD5 b58ec5fc1c61a924508108f1bf6e0025
SHA1 4f62eac87f40e93e460fc10a4e5ce579fec27987
SHA512 51497aecbaaa174a607ad399d6708d803afe9a18779446a8ccd84950e25a70669d3cc40fbf73ba87aa642faf637ca05df7c8042d3d12cb8260b573e261d8ee55
SSDEEP 24576:X1QT7EcpfxR+N5AWAz3ooiYzjMqb8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qTDxR+N5YzTBjMZLNiXicJFFRGNzj3
TLSH
T11D55B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 d1c5c493cef7502dab2310a72989036499760561f5d4360b0c2fe44964782543
MD5 c251054e694daa436b6d927e756b933b
SHA1 c6f742c0793e310a46502d5d97c59f73cc86a663
SHA512 0c07321ad60075e5f379a351a6d68949a0775025f782eb994ffabd25284505b70c941946bab7bd2ea8d364e95acb07dcfe91cbf9809a4389b67c70b43168049e
SSDEEP 24576:/TMdOz0FFS+UmSLQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:d0K+UmSLQLNiXicJFFRGNzj3
TLSH
T11675E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 3a9bcdeadffa0b9c1a249c7ea452ebb3ec6e301a76cfd6934a177c03bc5f61ee
MD5 e316fd142f3e3cebc25967ab083f3726
SHA1 1b007d25f1c1d6d130ab809809778bc0f4cd7f13
SHA512 a4180a61bbebd4d5d05c2e3ce0b251ed1cdc4382b882da826c7d98a898a83ee28ae290e5f8b2849ef80e84dce9f23b79282ea2e44419abd1908884e076ed8542
SSDEEP 12288:o4KpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:e1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15655125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0A97E9B36FDACE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-355-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/456-285-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/456-189-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/456-205-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/456-172-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/572-354-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/572-100-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/572-105-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/572-158-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/900-127-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/900-133-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/900-164-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2244-351-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2244-159-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2544-173-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/2688-163-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2688-122-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/2688-116-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/2792-162-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2844-168-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2932-166-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2976-167-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3040-350-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3040-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3040-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3040-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3340-353-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3340-95-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3340-96-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3340-89-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3392-140-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3572-169-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3628-335-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3628-32-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3628-38-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3628-39-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3740-71-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4076-165-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4236-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4236-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4368-8-0x0000000000E00000-0x0000000000E66000-memory.dmp

Download

memory/4368-70-0x0000000000400000-0x0000000000C64000-memory.dmp

Download

memory/4368-7-0x0000000000400000-0x0000000000C64000-memory.dmp

Download

memory/4368-0-0x0000000000E00000-0x0000000000E66000-memory.dmp

Download

memory/4516-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4516-67-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4516-63-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4516-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4516-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4520-88-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4520-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4700-84-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4700-352-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4700-83-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4700-77-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4936-373-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-379-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-395-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-393-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-396-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-398-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-397-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-392-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-391-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-390-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-383-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-384-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-386-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-387-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-389-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-388-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-385-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-381-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-382-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-380-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-377-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-394-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-378-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-376-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-374-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-375-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-366-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-367-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-368-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-369-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-370-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-371-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-372-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-365-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-364-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-361-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-363-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-362-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-358-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-359-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/4936-360-0x0000021D97040000-0x0000021D97050000-memory.dmp

Download

memory/5040-22-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5040-16-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5040-24-0x0000000140000000-0x0000000140200000-memory.dmp

Download