3430d25de94170a1c8758178f13659b0efd474773be90434da75542da0fca862

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Size 3.7MB
Sample260809-w89npatdrd
SHA256 3430d25de94170a1c8758178f13659b0efd474773be90434da75542da0fca862
MD5 4f4bd1062c05951c0101dc3617f46e28
SHA1 69239778ca68b079d9c36ef6dcc24f9cbc6b657e
SHA512 a621a3bf3ae06a9399fa60feab88e904ed91f4fc75a7dc1ccf5f0a3005f880908f7b42ce04cc8de6b30249ed186e991c41210c62843c8ddac3153228b617054c
SSDEEP 49152:NskrQfcFAgozdfsFyNqRign2RMwoBcfaa++Ywb4Hw19TpIzUe/VXzaHY6Q/lFTjG:jrQfcFIADntcf8+YwbT1Ezl/dLm
TLSH
T1D706B013EB81C071E993013E85BAABFA9D7DAD105325D6C396943D148D732E2E73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4036	alg.exe
3636	DiagnosticsHub.StandardCollector.Service.exe
2792	fxssvc.exe
4796	elevation_service.exe
4020	elevation_service.exe
1588	maintenanceservice.exe
224	msdtc.exe
1424	OSE.EXE
1480	PerceptionSimulationService.exe
2064	perfhost.exe
1124	locator.exe
3028	SensorDataService.exe
1936	snmptrap.exe
788	spectrum.exe
2848	ssh-agent.exe
4844	TieringEngineService.exe
4468	AgentService.exe
3788	vds.exe
4288	vssvc.exe
1548	wbengine.exe
1744	WmiApSrv.exe
3856	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\92384ae32d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000603519102e28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000afb4fb102e28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd5d01102e28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b40094142e28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac6088112e28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd37a0112e28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000490f12102e28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
3636	DiagnosticsHub.StandardCollector.Service.exe
3636	DiagnosticsHub.StandardCollector.Service.exe
3636	DiagnosticsHub.StandardCollector.Service.exe
3636	DiagnosticsHub.StandardCollector.Service.exe
3636	DiagnosticsHub.StandardCollector.Service.exe
3636	DiagnosticsHub.StandardCollector.Service.exe
3636	DiagnosticsHub.StandardCollector.Service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeAuditPrivilege	2792	fxssvc.exe
Token: SeRestorePrivilege	4844	TieringEngineService.exe
Token: SeManageVolumePrivilege	4844	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4468	AgentService.exe
Token: SeBackupPrivilege	4288	vssvc.exe
Token: SeRestorePrivilege	4288	vssvc.exe
Token: SeAuditPrivilege	4288	vssvc.exe
Token: SeBackupPrivilege	1548	wbengine.exe
Token: SeRestorePrivilege	1548	wbengine.exe
Token: SeSecurityPrivilege	1548	wbengine.exe
Token: 33	3856	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeDebugPrivilege	3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	3080	2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	3636	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4796	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 4132	3856	SearchIndexer.exe	113
PID 3856 wrote to memory of 4308	3856	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4f4bd1062c05951c0101dc3617f46e28_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4036

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2688

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4020

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1588

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:224

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1424

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1480

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2064

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1124

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3028

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1936

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:788

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2848

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4560

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1744

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4132
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1ff376be183c13c6f89c63228f0eb15f430a9695d25b8e16a1a496c0e8a5ddf9
MD5 d56555842b650d55d96ed49b4cff0332
SHA1 a315a213ecfe4b71b0fd34f6c858a56f28febcbf
SHA512 dfff485242308b25da06dd674784e433168f5a7cfff6b01a4d47c1e7b38555ff2d49d9fa2b5c3bb2ee8065ddfa578d53f99f059837a0a36d6ccb04db5db7dcd7
SSDEEP 49152:qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnPQ/lFTjN4:c3q6HjB3Lm
TLSH
T1AAD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 94ecd2ba9a259341120fec7a49e98dc37a5aafe5618cc003a0e94396f90481c1
MD5 4888b874e591d580081ad3e1116d3174
SHA1 1ab5789cedf7f78c7d5bdb122805b5a4198f7d54
SHA512 ac215ed04903c6e5d6a6a1d21229c0c495ab2aa35117dcf7404c282ad697e67c6cb32d09cf4230233dc71cdd5c847d089c403fd4cb75743b1d3514dec3618515
SSDEEP 12288:01XLsswWkxy2lRq2czAQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:SXYfDtczAwnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T17A65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 93cfe47f0484fcd0c557f30b5d761e73af6cfc77d55464aba2fd05322d643e53
MD5 e3ea655439f5f1df868788578cb640a3
SHA1 52bff3e0bd84e386acdc3f5cededba8ca5a058f6
SHA512 1753f1d99a5ac72c52940757b9c9f027b273174ea41a55ec769baf06ec90aff4371b9f78dcf18644af6a16d960bdccc9e619197271f26be23ecc2190034e7aed
SSDEEP 24576:80Le5ji0hmxLrMnnQ/tbw/2Mkjy6Fr7g0oP:8Pji0AlqQ/lFTjN4
TLSH
T17E859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 43d918453c799561cffdadfdbb2fb60a58df614feabd3f1f5ff014e5cc6375aa
MD5 a7d0a1e376ecd7c28f3b66e09cbe0e7a
SHA1 629b923a8a8873e5ce11a7b3bd5500ec775012dd
SHA512 cc9de7c3b534a5e1c88356e10f800d92ce8320badc0f01ea789df0d618e07c9453a999e817977e3792366ced70041bd825e5c3b76f9bb333ef9bf02db790e096
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWE6q8wyudnQ/tbw/2Mkjy6Fr7g0on:b/ezSC6vUzPvxHjymQ/lFTjN4
TLSH
T156755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fcdb9a1c029fa02385b0ba9f892fdb7f9eb3383948c286ef1b845232f2cdfdb3
MD5 1068c040bd660789e4f27d96258a7a9d
SHA1 465010b5721a1d4467560ccf207cc479ae48af57
SHA512 d1f7607db46b2c8508730ecdec6e43cd72d2633064573b00e1e5ff460aae91d0bf73a622108164a232e4e75344801c50e8d15c003da3cc28c1a45757ab10603b
SSDEEP 24576:ZVbqPb88hv/l+60nQ/tbw/2Mkjy6Fr7g0om:ZVO88hXl+TQ/lFTjN4
TLSH
T12A559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 713b12dbf51d4811773b9b8350ee059f09099f29325417595990574fcf71dcde
MD5 229cd7b460b9b04545ca0bbbb50c80bd
SHA1 dcd602b8b3e7aef2e465e1796219327474dd1901
SHA512 f1db74241f6b8f400b230ef967821a5ee2a35088f7d5e7618998176f196b6ba4585bc800666a9ce832e890599ffa5f46f901ec20e66f9aaec6c1cd2ce7255cb9
SSDEEP 12288:xzLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:xz7nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T11F5523696A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2355420a47dd771c248c4e4cf5c1ffc8b14abca6272fa7b6122d2061decc78a3
MD5 cd8d70e6ec516e217525325805968444
SHA1 1b4f1a61caeac3c21d98268c8921d3fe3bfd5cd0
SHA512 63d389cd70b7ca97dc47d6f96e67a3b46ba9b2f6bdbdc2e8ec8c0868a0deceb59dd4b060f78c476d8b9f7a0d8bbcb2db75b7d903bea7514737a8b8c81e71e5f5
SSDEEP 12288:peBNUbTVO86UsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:pJIUsnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T11375CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e47fbc932fcc7040245e436a5421053b40dd3104f0fb90f395854a3c1c949d33
MD5 ba80906433dbd5ccfd2a2af76f9a2ad6
SHA1 6daf8cd63c6f7e2664450eeef83ea08979b86d6e
SHA512 a3d526d749e9cd386badbde766f6b8ec41bed50af920fd30c5ad537df29d20f6878911c810db7894727654e1ca2408791089ef3ecb60bb0a5b01440223c6bf38
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:9QvGAdlCEL8c/yRNw5CCLm
TLSH
T14C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 85975b910924d1cbfb60fde9772f43557c24f9f9b867d1c60727aa616be5786d
MD5 299df250ba1a3336c491b9697b47d165
SHA1 5be0aeecdea9348ea522824ca795b73cff23dafc
SHA512 a4a4610769960157bfcb0a59b208e48ed53c335140c17ef870a9e1cb8a13973fc4a02f24cc2c8ee54a3bc4af64b5bf7f4b55688d07ccc50886d6bbd0304f3158
SSDEEP 12288:yAwSfxL/2Dc39DLLmt0LDQewsAjaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgd:3QewsAjanQ/tbw/2Mkjy6Fr7g0oz
TLSH
T10B75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fd2ce73459431e06b4a5fbf9396f1c1eda3388e30037cb7d3b17d3a77af9a98a
MD5 d58bca8fd13d1b6924ebbe29bd96306d
SHA1 ee7c9c1e043f49812687d8f0571dfb9a93f7f147
SHA512 2b7c3d46d9c4fdd87b4a28e152f82f9ad4bb15a56ae71f2cf0a91117e6c3bb0c21fb9d21f43ee31705a769697b6749da9de6942484f2e59649d21256d5210ee6
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHNL:KUEtQevvqc2W1cpV2EI32
TLSH
T114474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f34d929506e426e1fdd812242dcaeb8a23fd05b9f06251d76a1a68f3c9ccc764
MD5 693823d5f2f55ea4525f71c8b3f08b57
SHA1 6f49593738ad7e72d882a14c8e71746685844f57
SHA512 dad5410c86b7bdbb2e66df83a36cdad57551e7ca2f06433d57ccf929524de91f7d6f0520ea791e1353399f1b006b3835c2340d1c0370a5dc09173e67df2bc6b2
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/z6Q/lFTjN4:AoqtVjnm+Lm
TLSH
T1BBD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3ecc9d8f1b6fc92246543c679368ffbe24f9c8fb3a5e8e18e2504d8331383133
MD5 da589ff9648a108896d27ac2c72f4f1c
SHA1 5f14dcb3a2cfe68ca7ccf802bf5f02c0062bf191
SHA512 a9621bb14ea24b4ccf7c11cefb6e02c1915892420cb1585e89bf624eefd287ce3cd754c29dedadc392dc65ecce089aeabb9878a916c4bd9bd6d8a1670f4ddd0a
SSDEEP 24576:eAhGLJIFoiwtA5l7S53pnQ/tbw/2Mkjy6Fr7g0oF:eAMyFoiq55Q/lFTjN4
TLSH
T14535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4158b03b7cae6c393380000137de5f19cb8e6e83e916ee14621984fd42bcb26a
MD5 b182382e6495307555eb651fac32f79d
SHA1 3f6633ebead3ed3bb667f793ea8f4d2b54c248db
SHA512 953d7798e5b882b1a84738002e27bba9ea36ecf616745acd0afca706e05949b65f24ff2c60facfea345993955590de6cb44fa7ad95be685c7f712496bae907ba
SSDEEP 12288:tmw5HEjsChN2BFgl0WDm+CdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMQ:IwuHOWGnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T15965F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7e299137e613b321523b806227bc07a1e825e80bf286a173c606310fa938073f
MD5 d87a1a9bf52a6ebd1e74202fc389a2cd
SHA1 5154a8aa4bb77c6570d2586539f7bf63102c4b92
SHA512 03ab2f984b7bb8bc1f6ecacae60e2240d7df16555974f80302dced7e92fcaed2dd7177ccab99176fa5c6486ab54e18468fc0e0481de20994a6f697910af36c3c
SSDEEP 12288:kXZ1IyKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:kZu/nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1A455126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 04d86958f71c261c3e9e54c3cf318b5293d66ef9768f8ba9138114d46c8a8732
MD5 bb44ef7615d51818da2b4da7487fa259
SHA1 6218f2a875ab3c5f98837b6c7600b14d0e270039
SHA512 835c695976d94f46091cbf275d2f5f949eee663d4bcb468cb72cc60677bfcd8fbf3c16410f805aa3831867ea0990723ebe80270dd9804c9bb66d738bf4fac89f
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:WQRQyi36YOcPQLvw2gAf+PN3LLm
TLSH
T1F0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 abc1c7b52e435279fbdfb7ef3d46a44b44482bb9d85786175989d3b235e77e1a
MD5 76c2071a700ad7bb89f061a9189807c8
SHA1 05eb993f2f23f15262b5e44c81d4f2612fe8b163
SHA512 dbf75143ea64e41af87621167069c5de4c40fb05ceb0aa4d216ebc7f906ed0b0dc117e837402b003b6d5dfda6539060eb9b039c04649c1ade20edc8d159ae901
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:2QRQyi36YOcPQLvw2gAf+PN3LLm
TLSH
T1B6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e40c3edf21afd9b64fc294689fa18c17d1c22564a7d36bddb1dcb9fc10580d7f
MD5 99eb93d1f7bf6b8c92544b9c96275334
SHA1 20ce8eb775fdfb77d0d1d3c96204e738598e49fe
SHA512 a480b1f7aa8689c1264490ef9ce3645f67469dd618c4d0c1c6ba500b49624df6b89b03e30cfc858968d39263e84f39843683038116c9d3679c78e7fbe6a46c3d
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0PnQ/tbw/2Mkjy6b:468Qg55nhheWu7PNU3/qQ/lFTjN4
TLSH
T1A1B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 25ace3892cc25e6695abaac7cb54c2b2369cf385134cc8a56470ee54901f46aa
MD5 4ea90648f3528584d316984ba4ecbd20
SHA1 4b1d37bd6696869ea5e739ab638cad13a2fbbcea
SHA512 d0ac90567c015e685ffcd45226a335c341f30756068fb10aeeef77bd320da01a06ad3d89c9f35c7d021bbfe09d9ea13b56f30b54819fdd18dc72b82ecdf72429
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99I:Iy5112gYy5azzVvL69nLKnhZwLm
TLSH
T1A1167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 71801e8ad23940dc4315b1ab08c85e87b78773609eaff4283043709dee8dd529
MD5 2be923662b1889d5d5516718abb34f3e
SHA1 c7de6851fb0a3c045c580dbf6f3f1dd5668d0f34
SHA512 4176722d30fab3622e76c9891afc278047a5860dd69f32048ad72e696ca5f7313dd6a264233610149fbdca9885b3e804bc252fb3c0ac4531bdaef7c2678a6eee
SSDEEP 49152:bB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glAQ/lFTjN4:Nu6JmVxd2dTLm
TLSH
T14AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d400e66b70ab252debd4445638228cdb099f48339ced9ebd0adda68a8a9f89eb
MD5 456496c25c411ec2b0aa2a81e866b2b0
SHA1 06b0027339c93b6fd6bc4feb00f2ea1fab2d5494
SHA512 d07a305b53a9d9b0cef6db0572d0c1a991d8f20706c96614e896a785b619d68a5bbe7b6d5252175cd8a4f35d39f5ce748846907d7a70382019c34124eceb7295
SSDEEP 49152:H1hpsNoJpF1A6UU44CwH7R4xMQ/lFTjN4:HmifPbR+Lm
TLSH
T106B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cd2fe104571c30cd1b5c262e3dd9a46581523f8443de20aaca88d1a5e5276980
MD5 bef11495b4f6724ea1171b3b4cd71052
SHA1 5e953aaabdef79fcb22216c76075f04230fbcc3d
SHA512 a1295d65fdc3afea5efcc318f7932218dc5c2a97147c60c6670344b30d2756f17831491d7287445b42044d40872b5458b9e9867c9761b2ac0bd67e59d6ddb330
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHq/Q/lFTjN4:G5dKTi610Lm
TLSH
T10DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ca84b2bb7e263c8e80bc8f65ce305aa8bbd2ec9520ac9ceb3656520d62ccb283
MD5 70d70008958158bb875441c4e7d31125
SHA1 773c852e9590f8ca219ebb8713ee9f6f42741612
SHA512 d436d8d0d1bf23ff49a475ce76e5ba93684f7cd97a6a3fa8c1f29e67da05665f4fe26820e0c25e8c520c24059144805502abd40cecd9b2071081160ae0e2cf84
SSDEEP 49152:KhtSn8EApI0figngiDn0AP5wwQ/lFTjN4:rX2iyph6Lm
TLSH
T19595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 59f73362074c5cf6fa6cb89ba523b3f301ce61a5425b3ddcdc7b8f8f39f71d03
MD5 4675ecd59790aa8f9bc4389751157d1e
SHA1 1cdc620b6ae8f46ebcb859e69c6cdd0f355c3832
SHA512 f7c67b8237855470172ee7e97425c94f9e07798751a1519e5c7c9598441305dc005f32e1281e467655a463dd91d74ad1cc66636879571ec41adb529ef56be1cc
SSDEEP 12288:qjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:qTnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T15A5523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c3d62d9167857990293b3f573b043716aa4782ce2dde77bb828206e08d765ca2
MD5 352fb63443722aad51e2922e49d154db
SHA1 4f5a268db32016c88aa00912316729d0adb56f05
SHA512 2b14a60b01115de10ab2e07530c879dbbca635b67cd3b3f23460502d433091df0b3fb844aa33a122f97aa7efa6fbcd590734981d8c9e7ac22c7f4a02277b3064
SSDEEP 12288:OOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:OOnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T19E5523697965F98BFA1706F14C828182AB3F0EC6BFD1938F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6933b0df4341dd515af3eb7dde979fa9e50ee9186e97b93e25d127c11108ed6f
MD5 c16deb93baf0b30699b0f77db6eb1c26
SHA1 026f4621fafcc943bca8927146feb2a6b34a4b03
SHA512 7fd072b8c2e9c2c97c17d8a198d6479fc36c3f3d62c57db7704eeb390159e25eb7fd9fb1322e2b48594de56c58188b8cb45112b4ae70e0f3140f1616a417c6f9
SSDEEP 12288:nkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:nEnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1335523697925F98BFA1706F14C8281829B7F0EC6BFD1938F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c3272438334a67b350ac3ead1ce7a3b9d3b5915b783c8de7eed8661cb1831e6a
MD5 d8742d6b22e615b80906a105a036d87e
SHA1 154d057bed0036a8d355bf7acee1bb50fff902b0
SHA512 7376020e945530f2d90dd0e4e28fdc5c18f7af059fdbd4dce5f1470083d7452bfad52e8030d7a69aaddbf8dd5d3ef6a6badc9cc235e65a431f63389fb96fa623
SSDEEP 12288:ZV5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:lnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T15B5523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 84b0f09c31da6d3464bdfa03b20883017ef80bd1295676c88c0212f814fecd6a
MD5 9d0de3f74276583a533841ba6e8b7a9c
SHA1 f51c4cb6e91eb31149fa05ab0ce649d3b14dbb1f
SHA512 6fc5465c975c1b6f7995c135eef9243d4a76461af5758318a210a50229ea83ef23c73efa3a0ce35eec68403989b04bea1e2c09407ac876ecf988907a2c87380a
SSDEEP 12288:ZBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:ZRnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1A25523697965F98BFA1706F14C828182AB3F0EC6BFD1A38F77481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9a9758c8cf2ec8a5587f2739826d34c82ee10654cf9337e59d6ef8302e1afedc
MD5 4dadbbc773af298ec3f30ac13eececb0
SHA1 939e1c2c0d748db01d99ab77ce43b96d643d7818
SHA512 2dd8ffb48ea8f9ed8844aeaa19dc2ed7cbeed72ea9a36749f28096428f64db30ce54eab14b28dd6735e0db019ac76630a5b92a0a5394918b72dd80213e7ab9b2
SSDEEP 12288:PyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:PynQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1A55523697965F98BFB1706F14C828182AB3F0EC6BFD1938F77481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1f4d3c62c232f78301520b3bd05913a2f1ad37c643c71612f448c5762d6a8343
MD5 33c019d9ee58c98101de22cc81b6bbdc
SHA1 56dda7e57eb67cee8a4097877aa1e025edd6d5d3
SHA512 f91ff30c88b927704665b9ff93967ec5b4476ee901ebd5a3e9957f8e7d33a6e017fd99a7646710bdf924f4eaa0deff73e006f81130f3e590246c0ea2ff397506
SSDEEP 12288:q2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:qWnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1035523697964F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a8e1847849d4cb4760d14bb6c4b688596e47edee93b033f944f3e3b81387eff6
MD5 9617b8eb15802b96d904a8400b01a094
SHA1 b56a80b96e022a053bd924d4692864e6f394e04f
SHA512 ec7f4036cbda6f8ad5527fbda302659bbd7f505b6370ad69224cf4c70636cc75b8d3ca6ab27c8f02149e121a33eba94c4f34eab6a40d9b000799b153f5fe474b
SSDEEP 12288:eiZwbDzzFEoS2cPvyuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:BZM3zFVSOunQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1C67501A5B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7a81443990dea1ba6f9b3cc907f9bfc78c9831e7d70ffd261d1b6638955fe6e7
MD5 8550a919ffc0833abe5f54859b7f5c15
SHA1 d5fff7ca75ce4e3faa5cb7c77d01cd434c03fd88
SHA512 f4c307bb6256c11a28652c1097659d130dd160a85780f5e0ff77b8a9f0b1819b12500fb9d2be1adeb4ef051f593f4ddc33d9ed9504e5f56034471eb9f112e7de
SSDEEP 12288:vPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:vvnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T10F5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 383b2be58fe4a92ec7a8f3761c01e73b525126bdb718ac66e0eb907df430f076
MD5 4cc1abd75dbc734c62a44033c8a21662
SHA1 53856b42251e269d1f5106c6806222a04581aba8
SHA512 04203eac4a44d43700e2f15e817fbb2668d2dcf52eacd4842773017050fcbbfb578bbf2d7adc0d332d05de21c5dfdd5cb92cd5053bea078b69b35aea468cf80f
SSDEEP 12288:h7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:hrnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1965523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8ea3487a5cc18c53d1ec928b39177b25a037203baabccdc6f86b9aeaf4760947
MD5 110a300ebe0ccfc26ff50e3d7aff1582
SHA1 7231425b326801aea8df717f9f8314139ef9a50a
SHA512 d859f6654353f2a3c74a719bff5f6d67ebd82a3c43cd8ebbe5641c4f4aad394a2e734c3f07760d8f8c9f5c7d42d255869ac4aedae5d362c84b9ad15be824f996
SSDEEP 12288:/yPz5L8KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:yzyKnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T10065021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f09a871354b3634e2ce355a23c9b8c69e46d4d1714e7f96c17bbd133afd72f80
MD5 c1e5cf5a952f7679c2c6ca6507da187f
SHA1 754d4382042fc2c8c23b377113c5719ec8e51491
SHA512 950d90b4abb7b34e1044a7baaa308f6dc38f0bf55328017de9ab7441aba3f1c6e345923a1a9aeb11e487c7365feb6835c0ecdbc8e6c9c74346c6ec242be0e8a7
SSDEEP 12288:DPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:DvnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1E85523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1cd7e9b450348f15f5b0b472694d20af1c3a7ad25dc1483112679769e19be2ba
MD5 11781a5f7782f74784d37eebdb4d5c39
SHA1 35a3dc33192da3d8d8ec700ce5fd4b3b34989800
SHA512 5ed25a2592a1804436aa7cb2fbae73d50aa555f1e8179e385e6e1094f1b2edd99957a377fe481cc7962243b009fa44ef3db879c69844fda4e443e3ceb9b22e6e
SSDEEP 12288:dPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:dvnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1E55523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6a2d19f21fa78c28688c40635642f478af7e6f1ee1ceb018a7b8c3a7a172c14e
MD5 b6e4a50c5bb1d17e7069f91269821290
SHA1 9ce106da368e7c776acfc40bc95d44dac34cd960
SHA512 d1f509e8887f08ef16dd897ad57ad1157e254acb03724057b0d54606b82b975768a49d4e3c7ed0ffe6b9b013de7e43ba644d71ef9bc7d51e3634d86d4cc4c32b
SSDEEP 12288:hyPz5L8KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:wzyKnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T17465021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 d8763b9922d455ff32dcd78f5cf30d50f440fb8b3c3344377d51a9925a09d206
MD5 e3c2a6ed9af973c3511a600116e55856
SHA1 27629e8cffdf2a2f2e84f04277a5683381850bff
SHA512 7bf2d1cc18e5af02512054f4a2c6e5d87791b97036224626230e3e2fc29be78f903ed5171f0b9890117ff3ba2f540951cc9af4523806c473bef7805a8c15f6e6
SSDEEP 24576:TcP4mcvIjkGOxhKP2l71nNKbrh/8KB3nQ/tbw/2Mkjy6Fr7g0ot:oP4m4IpOO67W8KNQ/lFTjN4
TLSH
T1DB65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c63dc2ff4ff3723317f2e3ef49d770353b6f77d8066debd86adc762054c2eb34
MD5 0cecd916c53819746196a1754399ef58
SHA1 128aa3aee7683dc2af5b55a192b1531bd31082b5
SHA512 86567f90bf442eb0868ced0cf0995d2b8d8e528634bd9018902c960c5718c4196122a394c952d4e583e3a153a4f9ba35ff1c5f0da00a486cde72aefe2a2522de
SSDEEP 12288:cssffGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:S/nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T10965F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 557c7ef6cf9fd0c95e1463d9ca2834e0cbd9854e4d34a3df185eaea4ca86275f
MD5 4013a9157416868b45f0e769dddb49fc
SHA1 b59cfbf3fd6094c72be45d21c653223163d91a55
SHA512 1dec5441e1240b5ff4266adb17068a6c917a24ebced4ea90ec0a618b11867cf68e84e149c5da0b26b3d5fb91cdbd4b6b1b3d252d000e495161efeadf9ee2a202
SSDEEP 12288:V/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:VfnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T14C5523296768F94BFA3B16B05882C151673F0EC5BF91D38FB708222D967C3D01EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c32cd1c058a563e5a47f2c6918caddc6b1a52220bf629fc66c63895ee51fc7ff
MD5 9baff044c8dafbe22e376e7e46d7649b
SHA1 d45f23df7cdf9a6c65543534e39d3084235af934
SHA512 6dcc81d119d3e940ae20f5c82a24756b5cbbbc48c755658aaf5c96370b9afa4d4927e89c937aeb26d6904fb650d25ac8240957a18efb0de7c0179503ad0e977d
SSDEEP 49152:Za0h2GEkuAe73q3pp46zwwQRQ/lFTjN4:Za0hNYG4JwNLm
TLSH
T19F859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 11c4670917307f18a7273f63b26c9d2baaa6d79f8a3910d717a77246c0089ec9
MD5 39f0d103722b8d3f947ab7f8e83021d1
SHA1 9c91a8effcba3c51d4167ce6e5d1b3eda4885ee5
SHA512 52d8b5ee901bf2ca704334c0731d8dce3898ea492f153cb80ad6ff3d0af9a08076aed52a7fa431599a1e0c88828d08b2b4a76370581274d6bfca24c11b5b0a69
SSDEEP 12288:KhbHjfXeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:KhbHjPenQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1F955027E26AC20DAF63692BD88928546D7327C552B11A3DF2381423D4F3BBE41D79F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 60a316b6a9902043489a6ae97b493a0d9e06c738e9c9ecccb7a6d5966fe12beb
MD5 92042d52c0969787bad96b9e9822d7bb
SHA1 67c379dc863caf9ccc1163a33efbb27c499a4338
SHA512 05dab1f1489ca04cec2887511404753d0371c0a1fc75e218922e355ac5e6b650d8950ac82e29ec309795707d51fcb8b30472166b5dae5f7e6fa89a62ce33c680
SSDEEP 24576:F3YgnJcRTk4yti+R5dBR/GnQ/tbw/2Mkjy6Fr7g0om:FIgnaTk46pBR/GQ/lFTjN4
TLSH
T15145BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 8c9c29d7a8720af57dc856e98f9489ea841b5e9353051243cf98cc29d5b73825
MD5 04cf9e64dc48587d3dd9e3a5664fc8ca
SHA1 2ebdd44ccfd1b30824a4217c2d95ed6da6380598
SHA512 55b3273812830f7e6ce2efdc2bc2556539116e9d94af705f87b0146592347365d64c30a6e15addc6d4401fb8d6d56fc9689108a0e82bb5df2674fc8717e14f55
SSDEEP 12288:jrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:jbnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T14E5523686614F98BFA2B06F54C838146673B0EC17F92A3CF76482229967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 8ff2a6b7de96037b7375a5266c719385836dfb8d565b419c7d870a9b014582bf
MD5 f04354ce8e93bdac6a74cf5ef2bfa0b9
SHA1 e74bf19ace8dbdbf67b241c8d1f38f11426e79e5
SHA512 5c7cf5a754cb7f7feb4904e082065906c8462881a7522c86492ceff88e7e5b64ac18ca28d33439870bbc1adf909d8546946418c3ce35b1fbd6673548f7d2c16a
SSDEEP 12288:qOb4A4LWOsvAYFTQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:bwL3UTwnQ/tbw/2Mkjy6Fr7g0og
TLSH
T16675F155F7A450F9E92B813CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 b3f1aafde6b70d399ac1694dc2ab98d77975d2f8d3e8a102900c8e906058790e
MD5 3adeb03de65ea26cd6bff2b8ebf8cee9
SHA1 b449d4304ad22ac304e54b9717a7c043895209ec
SHA512 f008da5af2c62a12c1559b9b045b0831806ec120f825e1019272dc22d564066f854ab4a2b6c319cda28b1d4b67ebac9aec2243762e136008bf233892d00e3326
SSDEEP 12288:apFtCOMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:HOMnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1EA55022D36EC60E6E536527D89838209D37278921B6253DF0780817E5F7BBF81C7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4441e09d53bac25760e115bd83af046e09e1c8d76e5aa382c7a2c7749e2a3e3d
MD5 b36b68f87050c7acbe9fa51ac7e417bd
SHA1 5d04ca71b56d2c8f566448ca3006fb82b5fb58d2
SHA512 dd044f89fb6aa0caa29d0a9149f78043cad8df5c59d1c126e018eda29934a17ecf38e6e20fee5fc0b73d90389a9e17762facb9c0a6c01519e450b9e6b5922770
SSDEEP 24576:A7NM9YqZqmWMUkPjZM48Mv6bEhsvnQ/tbw/2Mkjy6Fr7g0ou:A7cBWMpPjN8DbEh+Q/lFTjN4
TLSH
T10B659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 fa0c813945c5a762a121d8770ae3f0c8e1efdd9ae71cf802980d60533de4822a
MD5 1ea0edbc775e865590993fe8d8b8d8e2
SHA1 b901759ea222faea39bb9154073e73e807628e16
SHA512 9bbb4325afb0acd9497b2edea6802305e0bcd32d7431f771fdb5c23208a79943a4ac205f1dece1f3c521524dbc978aa7176d2cbb71116aceeac4b5bfb848b37a
SSDEEP 24576:pW6BApg2YuyuNDYTabvcdvNYf8km1lnQ/tbw/2Mkjy6Fr7g0oe:pF2YuHNETovAvNYf8kmPQ/lFTjN4
TLSH
T17E857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 577e42d3d8dce0459a640c882a2d5817fc2fa3966ea2c680779666c539025731
MD5 dce1ab12d586d03defaad63ede8cc5f4
SHA1 fb34729c1aba05e33082f9ac34a284227b72926b
SHA512 e7d19cbc2eb1b6d34578ae448e4af471df7196dd6a0cd2301e6b87358809c44c82bae6a87e33ab022016f572de9c3927be708cf44f964a7f7a10650679519417
SSDEEP 24576:DAFs06+Omlf3NXEbToInQ/tbw/2Mkjy6Fr7g0oj:MFs060lVXuxQ/lFTjN4
TLSH
T16C65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 0fb32c608a42e8e2c7114590ef093952712c56fa62c4a35105f9e284ddb3f026
MD5 3614cc300eeb4078b3e222c0571a8fc5
SHA1 2bf7a1ecd0d689217373b683ebc89b0f8fd75416
SHA512 4bbe9a1628d47e2817b54fe8c0895bd625f94e3a0dba2055992ebcae63ab1efeec5139525b9251b69d9bf24dffc9395a8696a33182ad2a964467a9d9bd95f4fc
SSDEEP 12288:VCJnJ5D3VkrqzxvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:MJnJ5D3WaxnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T19C75D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5b0d1df4693b64de46822c50c72c98e8b95fd8bb74d42076df5c03ce7e392de7
MD5 da25686eab8ceef3725ac278beebe5ec
SHA1 59377517e9a8e40bfee55264c2eed9d87bf2e775
SHA512 a4ee540a3dc72d11e7031ea8e260e508c2e430de7e85521a0dd1ed8af1263f6a40205aa088892b19764c5b9b614a2afdd40ddf5fb3fe2363dc0a5902e4732d7c
SSDEEP 24576:aEPghm6/7IIXdwcXrif7qQncjlP65i3VuGnQ/tbw/2Mkjy6Fr7g0o/:Ng06DIKdwc+eQnSt65aVTQ/lFTjN4
TLSH
T1F4955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 16ccd560315b1bfe73f8f8ce3b6be6aa5148dd855face92c8f6aa3a540c42093
MD5 35c61a8409fd201b22dc6e306103194a
SHA1 086689e331b91c1a17034df09bfce29bfc912bff
SHA512 2533b8ca5caaaf293b27eabd31fdc027c633525eea67e9e3c23a97c973356097797fd69adc1f53335f2146da7080e741a36afe38dadb166a70ce57fa612ac921
SSDEEP 12288:6EP3RSdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:ZS9nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1A655126D37ACB0DAE52A517D88918145D373F4A16B5267EF2680823D4F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 ff4c479ba8b15072a68427c4a0a197e4390ab8bf1529cf3573b598c60d438d90
MD5 ad33e79126dcde9f841fbe73f7ee4827
SHA1 0071894e16a58d30c325de92edd09dd2dc7eddcd
SHA512 66b058f6fd3957c5ba5de71fcc69124b9f46f4413490ddcfe02ed92df86bf51ba41c052443cc7acc25c212c536fb8b702bc473008058daeb4ec7f50275023380
SSDEEP 12288:yjkyOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:yIyOnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T11D6512187398F4C6FA7A06788DA381919B367C506F2193DF6280B23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 b313edbda2c7d2504328c6da802b0fb0f581b420a7cc6bdcb7a38fbd6cd2f5bd
MD5 5d63756cd356a53af99a5ae8e954d7e7
SHA1 bd71f86491d82a276198eda6f64bb111076fa789
SHA512 ac968ab792591d60af8b3b73ce6169902423abaee79b23f71cde4a22673bf5026eb92144fae153aaeb92025291a74503e545e2422f2aeee4512c9c68699b18b5
SSDEEP 12288:/08GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:c8nQ/tbw/2Mkjy6Fr7g0on
TLSH
T12A55236C3665F89BFE2706F448928542973B09C17F9163EF36886239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8def720b84c4f6c8808af1cf505c41c5282164ce1206a4b3265c21741c90c0f5
MD5 b7cba2ccf625238ddbdb35bcc0ccfa24
SHA1 38358b7259b5fea6769de4fefe450de29112adb5
SHA512 2f73073dc4164ecc4890e68b4a986a5b81eca14fb7fbfbc8c71eed29f2e4a14ff10426b4600f4a85ef887a8d3347cfb4b9e58c44f0f9ef0fbd80da7f5b322425
SSDEEP 24576:pQ9MxZKdcz9dw3HnQ/tbw/2Mkjy6Fr7g0og:pVKZHQ/lFTjN4
TLSH
T166558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f14ef21e00696e1d8b1bae3291f310eb23a8d305429196c97c7f96432ac77d8c
MD5 1b05366435355e73368e6468f84237eb
SHA1 f1b7390476c19a2782dbd097cfc7c62226e700b1
SHA512 5dca7f02dad63331e0309aebce2a31c78e7b54a8f4544b797bc7e0c94d45832a8c9d40f85284be949d77cc95fcd61bfe0b642155a5fb1bdefd1875787c4c6eb9
SSDEEP 12288:ByoKo20Rple9paGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:ByocSApanQ/tbw/2Mkjy6Fr7g0oc
TLSH
T12E65E01FBB6990A2E136813C89818745E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4c627043c014b4d1ac3ff12c9db2f2d40304b49a695198aa0e75bc2179035f8a
MD5 95b77493f0de1e628e3bd9d27fec1ef4
SHA1 b0296c6f80cd5f0eab382d796299b40528d7250c
SHA512 dbddfb9eb6ca26ca7c2aa57f0a9110f77fbca31809723c5b4f61f711737af5c04d2f7e841629b1c719f035fdbaa12004a0e528f7ae3c9aec15cf52206b7668cb
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKaQ/lFTjN4:T0zuNIDLm
TLSH
T10EA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bd441d01fa9ae60ded2ca2e6654c17c2ca0a88fd8aa8675e679ca8043312025d
MD5 98d7a0a7bbea247ba4c078e7c6df5a16
SHA1 cc01ccd7ed0b30ba18fc2573826fd05d1e957b92
SHA512 c71443c1f3aaed44d70191b3a9fcb232aff745ea3bf72f4775a69ccfd469aad3fd23dc09d145c5fed2158d5bfabac58e1f70edd4c7bfe6386abdf8103d851af1
SSDEEP 24576:I1QT7EcpfxR+N5AWAz3ooiYtjMqb9nQ/tbw/2Mkjy6Fr7g0oJ:1TDxR+N5YzTfjMsQ/lFTjN4
TLSH
T1D655B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 fe9927e1da82b7d0f768991459410d1fbf40ccf4d13a66fdfbb625c31065b571
MD5 6c2d87e7c355fbdc1fce55f13fe2228b
SHA1 9c164442a1e1b8e3bd4bd764f8ceb9c2aaab36ac
SHA512 072f2867bdcc001d90d21ce360cd7dad79af5136677679b6c5986efca0e6618aa20033ca0a40f9103af8ca1f91c44a4d45f6c4ca96f5ba39cfc211d7f79a46b6
SSDEEP 24576:yTMdOz0FFS+1mSLJnQ/tbw/2Mkjy6Fr7g0oE:e0K+1mSLJQ/lFTjN4
TLSH
T17775E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 25b9db0605fa3a8a706ceb674ae659db83944af60e9398dabe35c7e267838dd1
MD5 562936143686580f12ca7d83fdf03d9d
SHA1 df4a2c563cd21776c5d6e820c814a11c756476bc
SHA512 6b3274af8bbaede1a3a75ff90b3fda08248d4691a9b844e0bd9a13127f3a0174fa932c2bb194f1d977a36596465a13e1e83cea34932d3ce2c8e6f8701eceb7a7
SSDEEP 12288:D4TQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:ewnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T10C55122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-283-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/788-275-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/788-116-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/788-110-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1124-272-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1424-269-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1424-77-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1424-71-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1480-87-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1480-270-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1480-81-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1548-280-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1588-54-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1588-60-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1588-64-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1588-66-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1744-281-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/1936-274-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2064-96-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/2064-91-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/2064-271-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2792-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2792-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2848-127-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2848-121-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2848-276-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3028-350-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3028-273-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3080-332-0x0000000000400000-0x00000000007BB000-memory.dmp

Download

memory/3080-7-0x0000000000400000-0x00000000007BB000-memory.dmp

Download

memory/3080-0-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/3080-8-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/3080-571-0x0000000000400000-0x00000000007BB000-memory.dmp

Download

memory/3636-351-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/3636-15-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/3636-23-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/3636-24-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/3636-22-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/3788-278-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3856-417-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3856-348-0x000000000C8E0000-0x000000000C8E8000-memory.dmp

Download

memory/3856-175-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3856-159-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3856-210-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3856-282-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4020-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4020-268-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4020-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4036-21-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4036-347-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4288-279-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4308-392-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-358-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-389-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-383-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-391-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-388-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-387-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-381-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-371-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-373-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-372-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-370-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-369-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-368-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-360-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-361-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-362-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-363-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-364-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-365-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-366-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-367-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-359-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-390-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-355-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-356-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-357-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-354-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-353-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-352-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-386-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-385-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-382-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-380-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-379-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-378-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-377-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-374-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-375-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4308-376-0x00000206DFC90000-0x00000206DFCA0000-memory.dmp

Download

memory/4468-134-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4796-384-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4796-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4796-39-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4796-33-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4844-277-0x0000000140000000-0x000000014018D000-memory.dmp

Download