d62a1f9739fb949d218ffa59cdb60255446ff5358f0d68b7e492e5140e3eb9fb

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Size 3.7MB
Sample260820-se4c2aea93
SHA256 d62a1f9739fb949d218ffa59cdb60255446ff5358f0d68b7e492e5140e3eb9fb
MD5 9399a0cbfed90ee4824e207dfb1fc7f2
SHA1 55dfa1cd6789000292afad77d26cdc37c2121139
SHA512 48e8bdc912bd3d71d2a67c6026205ebbf24bf5a2b5e57622bd8df7ca8cbca0011007d860d8defb731d09ede72606ea11c3c74b78c52839cfcbf97b49fa51f574
SSDEEP 49152:wKABc3HsllZqMFTbT296BT5bVMvdTsP5NEobui2GBE2pIzTGHniK3HDQ/lFTjN4:kBc3Hs0+bWsPsobuYB+zqkLm
TLSH
T1F506B003EF81C071E592163E82BAA7BA8E7DAD106325D6C3D6943C148D775D2E63A34F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2304	alg.exe
4332	DiagnosticsHub.StandardCollector.Service.exe
1364	fxssvc.exe
8	elevation_service.exe
4624	elevation_service.exe
4600	maintenanceservice.exe
2668	msdtc.exe
1932	OSE.EXE
4492	PerceptionSimulationService.exe
464	perfhost.exe
2300	locator.exe
3776	SensorDataService.exe
4220	snmptrap.exe
4828	spectrum.exe
3492	ssh-agent.exe
3468	TieringEngineService.exe
3012	AgentService.exe
3852	vds.exe
816	vssvc.exe
1212	wbengine.exe
3416	WmiApSrv.exe
3536	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2e2ffc2468b29bb.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079846e1cb530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7940816b530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c3f4c1db530dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fe31616b530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000124c351cb530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a357e31cb530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2d43e1cb530dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
4332	DiagnosticsHub.StandardCollector.Service.exe
4332	DiagnosticsHub.StandardCollector.Service.exe
4332	DiagnosticsHub.StandardCollector.Service.exe
4332	DiagnosticsHub.StandardCollector.Service.exe
4332	DiagnosticsHub.StandardCollector.Service.exe
4332	DiagnosticsHub.StandardCollector.Service.exe
4332	DiagnosticsHub.StandardCollector.Service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeAuditPrivilege	1364	fxssvc.exe
Token: SeRestorePrivilege	3468	TieringEngineService.exe
Token: SeManageVolumePrivilege	3468	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3012	AgentService.exe
Token: SeBackupPrivilege	816	vssvc.exe
Token: SeRestorePrivilege	816	vssvc.exe
Token: SeAuditPrivilege	816	vssvc.exe
Token: SeBackupPrivilege	1212	wbengine.exe
Token: SeRestorePrivilege	1212	wbengine.exe
Token: SeSecurityPrivilege	1212	wbengine.exe
Token: 33	3536	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeDebugPrivilege	2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	2624	2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
Token: SeDebugPrivilege	4332	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	8	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 1476	3536	SearchIndexer.exe	110
PID 3536 wrote to memory of 4056	3536	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9399a0cbfed90ee4824e207dfb1fc7f2_coinminer_darkgate_elex_glassworm_mafia_magniber_remcos_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2304

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1224

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4624

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4492

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:464

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2300

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3776

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4828

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2160

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:816

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3416

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1476
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a39014cb0dc90ec07caa1159b531b42f893b783d4885ae9c7df27f12b2bcdc52
MD5 62a59451ed36dc1e0b15487d665ec065
SHA1 8d52e4f61e238f18db282ce131e1fcaf20bc7152
SHA512 93c50cdfaff58aa719dea7dbe55fbed64c9ecb9ce6fa766a74af41c8327a33e802f95409380832aac615357315dd524e0ec1959d2a06b438fe0394128fdc8875
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn3Q/lFTjN4:/3q6HjBnLm
TLSH
T140D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 bc9600dc4eb192997dd2b2ee0de5a49ececb1828bcde907fece1bc2d2ff0af1c
MD5 995d1eabe65ac3a93b49e98fabd0bb5c
SHA1 7a2ece45b45d071e9913160135cb94d868634fc2
SHA512 b9dc0b1ecd37fe6fde8f272e8c88e40486f3234b903cb74b118c09c29e26db53bdbc8550fdcbfad16f9822ba6fe0d176abb61f2df8cf75eade938c0562542c8c
SSDEEP 12288:y1XLsswWkxy2lRq2czAwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:YXYfDtczAQnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1F865F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 42aba6bfa1ce4be8712275eb6a16afc7c24f1fe57f0b46c81331fc3925255e92
MD5 52f600141540f5c393ae11d9d18073b9
SHA1 40dc4989c1e8c9b0c7d42218f6411d9a31e16f9a
SHA512 7ce162b5b542a73afad22baab0869665fd473a39e29e3afbeadc0784ff2b91ea32de7682759dbaf3111d6541a177eadf8b92b9a3153257bc99736638134071fa
SSDEEP 24576:O0Le5ji0hmxLrM/nQ/tbw/2Mkjy6Fr7g0oU:OPji0AlKQ/lFTjN4
TLSH
T19F859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 af534baef92a6bc55ece76d379d5fc476f5ada3992bec4742a4d0e3e46887185
MD5 b93709dc23e440433f6453b2e26906d4
SHA1 91eddf3ce148d8f92e6cd5e7e7d640f018492237
SHA512 16602852194ac6ae718da7d8f364bec8bc69065e9726c9a6d43d5c51c20ed66ef5f80e03ba60dce589f9fe6950a85060c5c391b44dd8bbbad55c1495c6183aca
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWE6q8wyu1nQ/tbw/2Mkjy6Fr7g0oF:i/ezSC6vUzPvxHjymQ/lFTjN4
TLSH
T1AA755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f79e1d66667e0a291ebacb6080cf9693bea5e449fff628e671941e5e4ec3aeed
MD5 a0015dbbaa7f1238250246fce23cdccc
SHA1 2031b8ba15f4cc91ec45bace819c225bbec4bd1f
SHA512 4cd11f862d1ae0459cd1b7589e0aa35621fef3a74fdc2e38d961e2a4b549cf298d6d35c91425fb61a97dddbfe08ec8b264f16174f000ea7cd6c5457f2ce56658
SSDEEP 24576:eVbqPb88hv/l+6EnQ/tbw/2Mkjy6Fr7g0oz:eVO88hXl+bQ/lFTjN4
TLSH
T1D7559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7ad2ae8ee0b5ae7fe97e9fd8859222fa41f71a1de9bed2dd356d6838347f75b9
MD5 25296224274343f31d48551eab7cfeae
SHA1 efa144fcf35c9f8445695efda5eb37e4f798ae62
SHA512 04241f0550a654ed9556b98191d15b35686e6d75b3292f56eb23ea576dc0f8acf55e59e85aac45bcffcef1cae60bdb394144bb3aa1e73b91bc6c1ee1397289ee
SSDEEP 12288:wzDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:wzznQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1805523796A24F897FF2B06B15C8284826B7B0EC1BFD4A74E7B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 fa2065a7367b62b7002aa5fc790dd936084f620bcc4f2dac4c0e8d1cb0480f37
MD5 39d64ce6bd7729d0d596c1e628147ad2
SHA1 95bfb2098395e736951dc5ec5a79b003deda9ee6
SHA512 a92bd133aa478c516e8b48925b84993af4a8666ea5359556283dc50764e90e0cad70bcc7fecbc3b3cc4d4c1b9e60d768f6f30da74bb9d3884d7090e7106f479f
SSDEEP 12288:NeBNUbTVO86UsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:NJIUsnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1D375CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9860cdbf2911eb306174feae8f9f2f67c4dc16b5177854fa05fdbaa95eb7185a
MD5 ed44c22f51c77f87db62ae50728ce7d7
SHA1 51af027bf79609c544c53a37dc6c2e5c01def48e
SHA512 53ac4851ea3e38c3ee244f726ca0b82cf9705587191261a76247d75ccd38c37d83b1aefddf4cee5a82269bd6af9574e90a296fbe11fcd92bbe708e0b20868e1e
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THK:LQvGAdlCEL8c/yRNw5CqLm
TLSH
T19C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 071e6099e91ff9e84d5bcaa0153587fd5f94e8ce116a47ae1e6f9e6d6fd98e96
MD5 2112358273cee2f319e6bd3727ae8ef7
SHA1 a82cfa5f92cdd418b3b5032a3cfd502bb3dde104
SHA512 ba346cbccdc705f65e7925797fe1f6f185b83679b60842014d8c1fd4be76401bde38606adf92c6ff8697337facc144705e0112fc97968b49bb394228cc05d6cd
SSDEEP 12288:pAwSfxL/2Dc39DLLmt0LDQewsAjaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgJ:aQewsAjanQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1A775E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1d223a92fa097e5cf4eb7f8d853e184231bac2ffaa47ccd7589685eb47f78d2d
MD5 0bbd895e533d057f9b894ea5ddb41f9a
SHA1 ff2e61b8f9cbea4a54ffce50930ce7b4e38624bd
SHA512 96de248037421fd65b557e450f38d9e682c07d27b9519f0fef02de58bee4d2367ec7001feec7e3cf034b85ec16fda566853d88968e449ee5eaccc1c3b3e41a11
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHdL:dUEtQevvqc2W1cpV2EI32
TLSH
T1EE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 16db3c6a4cbfe2196f9ad4ff5d1aa556504ccb5481707adaaa874b00f7dd5414
MD5 90c91af4cad442a5f14ba526b49e0c41
SHA1 4cbd28ccdc35784625645827c890e7cffe846fd3
SHA512 f8b56d422db26d775c870faa561ca5e794c59f87db585f4e0681c3509619e855eed71f1df9ab14a7adbee6619cc86e318b8e39848c7d27d54ffc46ce9327a353
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/z6Q/lFTjN4:ZoqtVjnm2Lm
TLSH
T14CD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 52840a2ddbebfd417c00199df44711e80fc253c8f569e2418517b4056ed9b36e
MD5 59f0781d71fa51ac317eeac9a821552d
SHA1 2a10fa5b5d5f6987a029d2f2416e739f0367fb82
SHA512 95aa0397ba47fd742da2aa0ada88bdd222c36319b7aea7fa25599f0da1bd12e17acaf13b7636e83e4e49ad94340431fd4568b9e1d5f0cb37815f481c5e22a0b4
SSDEEP 24576:VAhGLJIFoiwtA5l7S53xnQ/tbw/2Mkjy6Fr7g0ox:VAMyFoiq5hQ/lFTjN4
TLSH
T11F35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 88de4ce473203452e996e04bd910e09fa8986b50254b7238401dcc4621df304d
MD5 0576f8c70cbba1ccf6d61b4068a41fd0
SHA1 332cd96f76e82c17e0d0ee814c50302482af73f4
SHA512 e54f482cd4aafe6bca7354899727fb2374be78ae5ce7eb8504fc7e02234354b82309dbe2b037af2dd9886dfec14944bf6dc5cd650c0d9f7247a18117f03eb1fb
SSDEEP 12288:bmw5HEjsChN2BFgl0WDm+C1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM0:6wuHOWGnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T11265F14A36A45CF9EA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7662f0067336497cd2d3d75b4e7c8f8088fb49359d8915a9217453ba686398f6
MD5 8c6be830a0f2fb33d41600e45d3f9df1
SHA1 a3dc34ed4fdeb334a58feeb6992f9a1f8537f87c
SHA512 fd4af9db7174a544bf44b2687e8806e73af5bdfec0a22178a087dc12d8385cb1365da6102fd807b5f7bcc5762b4f0cf56957207875880e63f4ff2e47fa04c248
SSDEEP 12288:NXZ1IyqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:9ZuHnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T19355126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0a11165a6178f68e4ebeb796a300452be0b619c103da4b0f7bcc284e26f5d110
MD5 0157d91ec8f038bdf72497c69b0da21b
SHA1 7ef8e9a364bb98268abef4ab00eee32f1fd88dde
SHA512 9605ea252b8eb625355d8efc1d1300513acaa049a3b7db54366e20fc39f610a66550c38602ba9bfc4e5acdb633f2a65bef4400ac6e2f6c9fc08af6824df98284
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:zQRQyi36YOcPQLvw2gAf+PN37Lm
TLSH
T1E0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 40bf26a67e3b8595fce397bad6f1e07c6ae503a1247efe747228d3832e5cba47
MD5 8a90ad5dbce278bd2a00d7c119c47381
SHA1 cf1f2fabe1c5a9cf4e0179c7904469c0ffa91745
SHA512 8e3fd3844b7ac0cf086dd3c35774b2df4be2127b9e0a35737d1b967870db12d0fc4b7054a3f369f109caed9fc9ad050c2a5a9af420cb8def6ce7fa7de647d556
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:PQRQyi36YOcPQLvw2gAf+PN37Lm
TLSH
T1ED667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b8105f32d5f29506497f03cbd17f6578dacd3533639b3a34794a626ac41e7990
MD5 b68f2bedf090c98fa15bbe03b925ab87
SHA1 3a6f0f26fd0476f3dff1aac1554793716eb0ec86
SHA512 c9a2263d460fec325719e96c59cd5ad27a76a3aae1097d4c60fad161921c5461a5c307e8c5489b2967c136373b96d5fc893385bbaf0e7a4d5b16bb077bf22c79
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL03nQ/tbw/2Mkjy6G:y68Qg55nhheWu7PNU3/KQ/lFTjN4
TLSH
T162B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4ab2e53caeae2193f54b28df6fa1f8c396ef8aaf856f421104db75ea0f6780e1
MD5 024d23c9b5d8113f1c92d3c6b57ea6b4
SHA1 667b31265719be27db8f1ffe52ecee2ffc49d006
SHA512 58f0bda2209c6364ce943c3373a6f5b21eb834804b4224ed34af60edb461a14fc83e0196184ed7dc791c55dbc4614237b382ab25c7b5010314f4b5855617b119
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99o:Sy5112gYy5azzVvL69nLKnhZYLm
TLSH
T115167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d741c6e2c422d6ae06aa5266b9980f645e4039762e216a5fced3d0e0ec7ea21b
MD5 fdf7327ae79bc48dec69cb5030616ee2
SHA1 3dd8b66435a0418c606bca61219634f597aefb9d
SHA512 f793975edebfe0cc6f7b4480f14371e7a2524065c416b6d4cb097fea2dcbd8db4aaf2a7b7ba50a2bcd8ae52111c715d1909c803ca9dfc01a52ae240dac43eb85
SSDEEP 49152:2B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glAQ/lFTjN4:Eu6JmVxd2dTLm
TLSH
T128D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b3124e25ac4626acf75c935d2ac2ee45d569f159e9580c02bfcdffb13bd08edd
MD5 9fe7065c7594c852b47c5448e2f87669
SHA1 7d3e5cc6becffe400abe713fab89205473112821
SHA512 1c868d05c48bad580bbd202a50843054772bd57262ceb28c51f708dd194e610914f988b79524745ab8dbdb5c656599eb1a659afc0769da03def478825b87fda5
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4xMQ/lFTjN4:PmifPbR2Lm
TLSH
T1ECB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3ea5c16d866d8c489af2ec3c81664a5a789ea604a3d75c6469c536b42c0d4626
MD5 2cdf4e5bbdee9d2653e6f32936a44371
SHA1 981a79001d10da67f0ada274b316cb4f5ebcc21e
SHA512 c41e991e14d1bee298775930b925acb2a9931a5bc4fd602920ba0af7e7658d5b3b862fe23e4489887af6c739c381e50a0cc787727eebbca8717f2f49b9699e47
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqHQ/lFTjN4:w5dKTi61sLm
TLSH
T1B4C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 95bf6bf0fa17da94880147fddb7f9d4d4842edf1440f834d06dff9be1940cf60
MD5 a574b8c8c327aed241e89be59aa8b69a
SHA1 7211465cd7e125ddf642a9aec5f814c11f33f787
SHA512 a6538c62c7417b7f2f408e79b50fb56a0d5d04c0532c4c77e35b6ecafa154fa7e7547f34dcb3fc923557eabde93bbd28e616ee32e4443a622bf7a38a70c9b93e
SSDEEP 49152:NhtSn8EApI0figngiDn0AP5wQQ/lFTjN4:cX2iyphyLm
TLSH
T10E95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 04768562251b5033e0d47309833d98764dcc901894ad5e75ba12d3dfd80a217b
MD5 0d7987df1c9be48d689d4aeff61ff07d
SHA1 43403a26caa5e3a8a423c011ce8b2192801dfa0c
SHA512 9f439a0871ab315b199d425e41f5b0639355044937c03eebd5554c6957f3fdbee5e2de9b4f6e714681686b6b56d51f16d0bba837eb3e7d2b7d2d7aa361c294ca
SSDEEP 12288:yrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:ybnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T11F5523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d6f207c296f016dbff2b2f586f7af7ded9e328a5c5ddd126f3814b6f4cb921a4
MD5 dc60c3dc23081747772b16947c144434
SHA1 e456b21e6b11f39a42a1b61bff14a14d78954e36
SHA512 84b9685893e1cf82aae0c9f85932a0156c3024f4e6fc479561f6a7814007c2e5eef127034b2cc0e92709ca24baefb4798ec0a73c8963711c49c00e85aa14f1c7
SSDEEP 12288:eeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:eenQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1B15523697965F98BFB1706F14C828182973B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0410f746956f80b43c7a34116da6d2f6e7b32a70e7ed82b55bf04b314b47f2f8
MD5 0d703afd6acb3a5388f27099805841b0
SHA1 62ce35e4f09b05208ec7b6fb20621fede6ea356f
SHA512 7808e4b994c39973d05d6cef3faa321f7b153570f1f1995e41649f474bb0587fe94704032f550ca0926df9d2af8e1fb79a9c779de95d6bc6e18039e2185f986e
SSDEEP 12288:ZUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:Z0nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1555523697965F98BFB1706F14C828182977B0EC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c5507a50cfefd725111e4d1fd03b49256162146715637ec3a40ddf37cee1e31f
MD5 8178d22e5b61e5802d98ecd693b487ea
SHA1 c5c82121ad6d6002bd8faa84642648ee1db6ec3b
SHA512 2b570a6ef1b66b2fed6454feabd7f846fed5961d532e72153af388072777a0398dcebddbdf6a52675d04ca5a056b264270cd1ca70ae3f210bfe921d3b367c2bb
SSDEEP 12288:VVBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:hnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1575523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 46ee4d947d04a3e3d8bd32f1cdabf880bbd9ad070e5d37875f91c5324b24de67
MD5 4d02b3209390056f949fbf40b9d52658
SHA1 bcfd93a5ac5397eea47a850145c81eafa8e937c8
SHA512 755264f2e775f2f1ce5a5843123e3aeed5d880af674675395f3c38e87e770f8e9cababf07b0dc224142c4ec1ab500d0ee12eb684aedab7c9c36c310a6db51ab7
SSDEEP 12288:S5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:SJnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1325523697925F98BFB1706F14C828182A77B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ad2723975976d1df1c2ccfe3673a601991769ad7322a68463f68bdc66a1c1cce
MD5 3e04a5bc56c6b04519970dddf7cef219
SHA1 66aa7639ad047a32dc4cbb43823adafb81284f8c
SHA512 2bf73e0c5c7c814b1ed5e9dd39e7f620c67d9364c20cf9e7ecf6f53abda417f638d689aae035d56e65228d6d29660b6630f0f9776f37c0605c6c9a75f48b3952
SSDEEP 12288:RiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:RinQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1715523697965F98BFB2706F14C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 aca90f6f2b0c5b90bd6eb69b5dd88c8e45abc700162055b201c962e471789b85
MD5 497709feed1af7dcac1e712d2382f927
SHA1 79c62f0664d3188b35899edb0dffbd8b3e94ba0f
SHA512 a84bba679b8ee28090a1e9f3bb4f522da4f2dc33e5440737c6d99b28b71b2dc1d75ce8d600d4f9407f2ece53c906016e1517f74aeb8f50bda4b2f816701dda2c
SSDEEP 12288:HWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:H2nQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1FB5523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 704215fcd51c3e70b7d6c03f3050d6d5751e2f8811c91b01a810e1681ddce194
MD5 37d2900a8d75439e35f0f323d1629220
SHA1 4a3500cc87caaa76dc1c3dcaf069b348e964d794
SHA512 31724f8db022ed0fd358cba710b8be62bdeb9422fb18145f2b88ac2278a688deda03ec73613af15166a4c63ac784565bf15ecd21fecc9034db02a51fd841d029
SSDEEP 12288:9iZwbDzzFEoS2cPvy+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:AZM3zFVSO+nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1CC7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6eb1df0276e4da214c92c74d73993c28674116f98eb098c50014eb91d783a33d
MD5 09e2138f90cd0f89abbd8e2b094531e0
SHA1 db1c0a75f162d6c18a253d92dda386f99555ae03
SHA512 8289649e2b68ac9f325f76d69c0cd807b6418a359d573ce41f77a9926a830a76c94096e06c5edf55f5935435749d12d77c94a3c478ac0e3ba15f1681f9b092f9
SSDEEP 12288:a3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:aXnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1055523697925F88BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3a6babdab7abbf4915d13b74c9ec2b1dc78cb2d13538655210dd89ee52b669b6
MD5 87daee80f9f5ff59e9e149f8a65556e3
SHA1 3fb4a6304b903a84d740f3e0ee8f4854c8edfdb8
SHA512 a27a2164a8d55d3ef6dc2ad9a876419dcb0612e661008f574869ea2d7e239bdca31ecb468ae48aab923930723973cb8d7950cb66daf2f9d62ae550d00829cc64
SSDEEP 12288:HTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:HDnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1215523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 eabd707d39d8557c1256b5c2d46b2e769fcc656d35333a917545217e43c292dc
MD5 b3d52751472d8dbf73a053125c1ba42c
SHA1 b191672632d7aa88b85e2dc97b2394b7a168de96
SHA512 9ab65b388405be452cb0908a8443a5c0ea14f59cf5d0b213bbc53c9ce07268c18bbed8c167ff5427bf33f11c9843cdd2f3d640081815e33bd2f6cb1a5bc6cae3
SSDEEP 12288:UyPz5L8qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:NzyqnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T18265021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 683448a3b0ebfa71703f9215d6e997cc88c7b106a90c0619a0042dab6bc57fd9
MD5 1641da324004da25921c4c9e34d28e92
SHA1 8954adf240db8b0b2857019acc409f255a3c07b8
SHA512 da9ff61a208898e181e7d37090b1ae86fbd744aa4895bccb864c6bc6405fa31402d578e21a6136e42f7edc47fd8bb9bf8acdb315992b58a83ca4762882373d89
SSDEEP 12288:13GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:1XnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1DA5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ebf1821d9bab85b50efda9f8814b67449473903505c0b6bc6323036a9f02a6bd
MD5 be4bd372c8f4f3b0bb36336004e7aaf3
SHA1 a6c56152c92f6dbbba466f7faa655703372e73bb
SHA512 545fb43394714248d4fd6eeb39cda7ac592c5217cf75c1b4eb7f3bebf4e799806c0e3756968d8e3d3d19f1598953a7c04d59194b194bf92664d9f073cd45fd16
SSDEEP 12288:k3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:kXnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T13E5523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 5a6a60d3b2d667025beb79216d4379c6d7e31f7179de50703b34c1ebef48abd3
MD5 22e82fb444bc1cda9fa6e56cd3fea917
SHA1 2adb4b6276078d3411c652f0d0fe6aed63ea9cd5
SHA512 9514a763e1565b6dd74bdf4235fa6e47d322cd1c8f3d3f43f726d61249cd2c8dbc83fc42b3bf3ee7355fbbfb297aef3efd61924a34ccb3d8647053c47f60a6ea
SSDEEP 12288:iyPz5L8qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:/zyqnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T14A65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 03181943af72d6442a7e8df4397e55a25d09b03053da519b3291d6c296cb07c5
MD5 184dc907db7997c7cee2a21acc861c10
SHA1 39c6ec48fea09ceebee49a4ea59578608f5cc632
SHA512 cb6d130ddac5e55be39faad08a7efe0a0679663ba0ce42b9c39b57ebdb49c3ec61e52c370e011eac16603e06d09a7e54b251f9f9577323f30c968bc63c32d93b
SSDEEP 24576:rcP4mcvIjkGOxhKP2l71nNKbrh/8KBvnQ/tbw/2Mkjy6Fr7g0oq:AP4m4IpOO67W8KFQ/lFTjN4
TLSH
T18F65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b7398fdb4e40c127a1a36caaf3fa13c4f62e9047174360eddbfaf92ad9866c74
MD5 b6a0dd822e900e6fd712dec4a0e7aa52
SHA1 9bed203abd1f8b03f72af770af7c02452c8edd45
SHA512 d2e7389f405baf4dc99eb48920500bb14f0850a28906a28cd44a4ac6d4110bd44fa1d5e2ff16506084a8cd18dec23a5f49be26d2cdb2f7e30e55ee36195e3862
SSDEEP 12288:WssfnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:wHnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T13965F119E29852E9D12E5275CB828641B3373C9597E1D3CB67C0F53E0F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 50d0eb311118b97d58cd9043ecdf316eb2df2256f9cab15306f66dcceec4cf7e
MD5 11c89da1791afaa320febc0fbc83d667
SHA1 1b87d89b71fdcde0073d4e0e64c001a606d0cdd9
SHA512 b503d076ebabaa982af7ec3f9e63b328e8ef4b730b312624eb1fab87e61e77be40511ae8b02a52e1b50cb968f96bf8ff2eb7b60edf980e2b498da7a4c51c4eba
SSDEEP 12288:zHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:znnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1605523296768F94BFA3B16B05892C151673F0EC5BF90D38FBB08222D963C3D40EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4b1d9bdd258dbaabc2fee776df57b0b4d7a66da8f63a9f505bb4c08e73eee876
MD5 9bf810947ae534cfd23ed2c3b2aa46fb
SHA1 cad201f23fa2613fa7573a029d847e17927f2ca0
SHA512 9c4f5b3a35108899f209dd1e3c4c414c6d547309f94719ad8485fae4d74f1653440a6302a3c07da362fb3a31a19f37722840a5b4ec18b9276dddd48db2cb6b48
SSDEEP 49152:Fa0h2GEkuAe73q3pp46zwwQJQ/lFTjN4:Fa0hNYG4JwdLm
TLSH
T171859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 cf4d4cd5f13faab45de610d89f713c75f5c637a83d98b2cd723e8247eff3c1d7
MD5 cb649187935ac7e8225fb83d7261651f
SHA1 e8af8edb92758b958aeb04e3e8cc068ee1565e18
SHA512 4e4f4006e3326b0737346a65de3132a1c169b770e12b6f600b2a0d7ac08f3fab0649ccc2d889d0ce9873c21e28cc23e69374df6a134751c0c39fb74433a0fa90
SSDEEP 12288:PhbHjfXOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:PhbHjPOnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1EF55027D26AC20DAF63692BD88928546D7327C552B11A3DF2381827D4F3BBE40D79F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 00bc69d28d231652d7a35814da8dbd1815d79ed1cae41fd5c6ee37d685c27870
MD5 60d24296c18e6ebca0ab97f8073d40f8
SHA1 302bf2ed86bf3df76565ea2e4124ad79234844e9
SHA512 ba414c87bacd3cfa30dbe0d250bd869c67bb38ef5acca4cf0b8ee3727ff672f6512321e133d851dc3723c55952bbd6c37275f88ac2af94e63f4703518ac85187
SSDEEP 24576:Q3YgnJcRTk4yti+R5dBR/GnQ/tbw/2Mkjy6Fr7g0oo:QIgnaTk46pBR/GQ/lFTjN4
TLSH
T1CE45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 f60d0aaf624a7024676c3f458d9c326a331c555a7867eb64812a0085bb94f921
MD5 da16f391af884732ca943652b03ad15c
SHA1 18d860cba3760f19604849536ce2dfd4cedb3581
SHA512 e7bf8db87d6d00e2b5440c6f34f13d69b00c34ffde39200952e21016154d21c3ef054339279d9977a4d1696c0df53c9a7335243e875b70077c36d32e0a194311
SSDEEP 12288:0jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:0TnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T15E5523687614F98BFA2B06F54C838546673B0EC17FA193CF7B482129967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 7a2594dd1ac48bfff3abde658d0ba91949a33d0567afae3573651d9c6a4567aa
MD5 96a48d9aa6b1ec16268e3e668ca4770a
SHA1 17b4dd0ea43b5ab1692ea3ec38a412ee60043641
SHA512 3f58a0acd577749a16ef2605703dedf4be2ef7858663be4a5f919db50a766c89ab344e510be0e65148c4ea281bcf4a45fd145b7101bd09cb0f8d5a7d13c1f785
SSDEEP 12288:jOb4A4LWOsvAYFTwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:MwL3UTQnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T19975F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 1afa2bee2d2d303befe0453d79a57894b16ed6eef39064ab3b2abc5396fdd70e
MD5 d6535b3e28f6932c42ac6f8994865944
SHA1 402e0c447c7c314436cb95977a2cbb93eec2e1e0
SHA512 2558d24c785c4cb99a5b04e7bb896048bde3e549bcf38d6dfbcbcef4b292a3b003802c777797c2c2bea622ad8512e349c220df2fce5e8237891779596e6901f4
SSDEEP 12288:vpFtCOMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:8OMnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T17E55022D36EC60E6E53A527C89838249D37278921B6253DF0780817E5F7BBF81C7AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 06213091af62c94accbde6388183f4e96e51dc5ef2fd01a7a78a8c907c762ecd
MD5 7edfd495ec3a863424e9a5283dea0f73
SHA1 0c7434d8796d58b551036ed19ae4854b9cae049b
SHA512 cba543899aa3729f5868a1533cfaa21e1413c3467532692399a76235b2c5cc91de7145c2fd092dd2a1bc5c4fd36b0d8bd7ccc86f2d34259953511e22a9f66cec
SSDEEP 24576:E7NM9YqZqmWMUkPjZM48Mv6bEhsXnQ/tbw/2Mkjy6Fr7g0o3:E7cBWMpPjN8DbEhuQ/lFTjN4
TLSH
T19E659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9ccb15d3265d73627c49cbb83aa4610705c02541abdf09e078c05d1cd93ea359
MD5 4ec1555939cb5feed98a9598d30b977e
SHA1 7d025db8758dfed0fbbf4942db319f64514be6c3
SHA512 17b7409f17d56adbf81701fe4f46e9f5b4fc048b4e1924d9cae2c0c84309125cedebfc51e0e3a37e5d3957448d043d1e18da75e992b46500dfc28cfaa6c2f2d5
SSDEEP 24576:6W6BApg2YuyuNDYTabvcdvNYf8km1tnQ/tbw/2Mkjy6Fr7g0oY:6F2YuHNETovAvNYf8km3Q/lFTjN4
TLSH
T1DC857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 711bcd2247aa251e920ed4e7cacfc73e05716373f5ad0bbef03f0e4c58606636
MD5 15a0432c73efa3eed95a183e2f9bd718
SHA1 1454e8bdafa600a00fe37e37e28c47ded663a83d
SHA512 9dccb384542fc6ccd240d19bbd265ab9a95a2d79f66f7968bd206005a25bda0453e509c169fd0783e511749be8d45e5a9c466ce313e9ed70001074f4f178e304
SSDEEP 24576:+AFs06+Omlf3NXEbTo4nQ/tbw/2Mkjy6Fr7g0ov:3Fs060lVXupQ/lFTjN4
TLSH
T13265AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 c1b7bd026ddd0c1d25b633faa867d63bf96c757ecba917f8125e8b346791aeea
MD5 15186dffe782bfe7c61027eddd243b46
SHA1 597aba899550a7ae1c6fd988410f8020f63d5ede
SHA512 66cf1a8cb40ff03995d87751c3718cc913da784f098af98298c6bb7d1f95cdfba513cc8758e50e58a5d515b5d72243f390f7b1c8fb825330dde635ff45aba0ec
SSDEEP 12288:KCJnJ5D3VkrqzxXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:LJnJ5D3WapnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1A375D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 390b4c374f895eccbf6bfe3675c2c14182f3c760d2c5a7a074701f55f2d7f82e
MD5 ac76e40774efb3effa3f1f5f7e9161bd
SHA1 4b080e2dcf0e53d956d4804f79707685ca73985f
SHA512 6d7a2ca4f81dba2beac2352da7ebf3b8a33a99c9067685b845efbbbf5be85121e1d9ebe406f9bcb13f0d2fd5e7f23b7564f93afbc231a43b57fd0130c607a27e
SSDEEP 24576:eEPghm6/7IIXdwcXrif7qQncjlP65i3VuGnQ/tbw/2Mkjy6Fr7g0oE:5g06DIKdwc+eQnSt65aVbQ/lFTjN4
TLSH
T168955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 c020cd6c434a7f592851e4d6ac201642e45fe43a602a8e113810c0729620dc20
MD5 126dc187d98a60b5184ae114f2e38d78
SHA1 dcd6bd397b7236900e76dc027c8a607825eccc68
SHA512 d62bc5bf33cc43b24f44e4b2999e7f71694c37d2b414d306c96fc4e4f4ecbb695b6065d4a88eae8acbfa94cee42d34db5f3d8018fedeae198f1165e2031810dc
SSDEEP 12288:/EP3RS1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:ESVnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T10155126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 c36b80d0debb8870cf61cfd9a74a83b86ea0da3af1f21015df969b836cc4b854
MD5 92baa02267f094fe8dba80f38a009cbf
SHA1 98026bef7eefcb42dc0c9f44989e8c7fb2692e8d
SHA512 2ae4d5f63e8ad1be55bebb364035b7fe4710709da540e340b44cc83004c6b3f27d41ea50b87f81e8ee1842b75d23c502a2af041ad53eafb90f239f22f39181bc
SSDEEP 12288:0jkyeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:0IyenQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1E76512186398F4CAFA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 05bd5cbce7efb71ca86efbba5b79c8df1ed176b8bea1a1b6487d79017450c690
MD5 eacaea5ddb3efe3ce03d963d7ede0e20
SHA1 431691eb8c3a8546bfc012b55606bf8ddba6483c
SHA512 ccb64405c1a12fad269f3852e78d2d2517c3ebefcf1c02cfab30be5f1ac3535b35f093d05452cefe3e50e2942c25e985912aa4fc6797c49379f92f0a35305f92
SSDEEP 12288:d0cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:qcnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T11555236C2665F89BFE2706F448928542973B09C17F9163EF3684A239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9db3b725c9dbd0a06906819eaca45366456cf093670906d8b27c03408faa2bf7
MD5 f3ecd3879a93f75ec8568e3b1a007645
SHA1 6bbf93e5d48ee070070f2241eb88edc816df928f
SHA512 9282170d81dcaae28b4d7892e86e147d1121e2b046df05343045ba0c186e86866cfd34be43018bee5fd593b8ad6e82cf1269d0410780983369f0c7505b0142e3
SSDEEP 24576:iQ9MxZKdcz9dw3fnQ/tbw/2Mkjy6Fr7g0om:iVKZfQ/lFTjN4
TLSH
T12C558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 c94e93bdc2dd94e1e8eee80d45c833dfdb53e99137ba30a8dbd3f424a009633a
MD5 5ea06a8d0ec0d459a894f636b50ab511
SHA1 1921dc87900c04a7a503e181f19c7741366a124a
SHA512 59445ae475a2a65e6b40567da1830510fdacd5d1ec2e638dee97f598df0683cffb1619ebf15ae76df4192d904a8409e91fd51792c8a4d8e856f3d40a8720a4d5
SSDEEP 12288:xyoKo20Rple9paGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:xyocSApanQ/tbw/2Mkjy6Fr7g0of
TLSH
T14E65E01FBB6990A2E136813C88818745E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 af8e0305bae4686cc57c2a4008e6b1709ad4cec41ecfe11c590441aefd4d2d80
MD5 471f6abd108489a6fa953e449dfa9095
SHA1 5a782dcb49dc48ac5d94311b8e2d009ec58c52b3
SHA512 1f025f600082e8f31bdfc028819a5c3c286db5a08f781c431eb7d92ed732979095a4b1836380f99bd00bc4d9613f21f87d390ee56e33f28600f2d1b904ae3461
SSDEEP 49152:DWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKaQ/lFTjN4:D0zuNIjLm
TLSH
T1FAA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 450bc1fa51f60719a985c0f7df7fc9a4e48e3b5b0199a98712926ace331442f2
MD5 3b77d070ebe3c26973d54b75ebe5a572
SHA1 8a2cf678f7ffe43d97a964a6383ad1f94cadd95c
SHA512 33e8490760089db819bd3b9d44889c83e35404f70735034b7d163706c2feca998ad98723740f3ed83240bb8c5481cc28ca66012603b914b08319eacb3fe16a5c
SSDEEP 24576:51QT7EcpfxR+N5AWAz3ooiYtjMqbVnQ/tbw/2Mkjy6Fr7g0o2:sTDxR+N5YzTfjMsQ/lFTjN4
TLSH
T1AB55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 a31be103c520482f068d899950d7f74c9a7d7369378b0d5eee39e9cc50caaec1
MD5 0d16180b1fafca08a8b1619ce3e4b5ba
SHA1 5cefdb54baeed7df41308a6c5d06c0b896599656
SHA512 2b6c13107895b95675953f1673de5ff826b68e4d402a6bfed71e0f95c8639e58ea18922ccb6439b2a6e26946a541afef1b1808cddf22d5f3530f00bf953359e6
SSDEEP 24576:3TMdOz0FFS+1mSLRnQ/tbw/2Mkjy6Fr7g0oL:F0K+1mSLRQ/lFTjN4
TLSH
T1E575E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 08afa54bc009d757be3348bc1ed0a0fb3aeb68d4fd544489b9b881d40b5246b8
MD5 50bd2572972c6085347ed4d6ddff79c1
SHA1 2c056fe39b8160fe17066d9f3eec4e7490eeafb5
SHA512 98f260f3579e385723d7fdd6f3dbda6306fa692b984c124d2aef45cf49a4d2511376b7e9880de5e5598321f9c4aa353e68756e7467a6ff09eef544fe0a00aab5
SSDEEP 12288:14TwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:IQnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T14555122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-39-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/8-33-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/8-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/8-32-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/464-107-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/464-163-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/464-110-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/464-102-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/816-159-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/816-366-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1212-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1212-367-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1364-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1364-44-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1932-150-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1932-85-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1932-79-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1932-75-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2300-113-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2300-167-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2304-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2304-95-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2624-546-0x0000000000400000-0x00000000007BA000-memory.dmp

Download

memory/2624-72-0x0000000000400000-0x00000000007BA000-memory.dmp

Download

memory/2624-0-0x0000000000400000-0x00000000007BA000-memory.dmp

Download

memory/2624-8-0x0000000002650000-0x00000000026B6000-memory.dmp

Download

memory/2624-1-0x0000000002650000-0x00000000026B6000-memory.dmp

Download

memory/2668-73-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3012-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3012-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3416-368-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3416-168-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3468-148-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3468-361-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3492-359-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3492-143-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3492-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3492-142-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3536-208-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3536-192-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3536-248-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3536-369-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3536-172-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3536-362-0x000000000C900000-0x000000000C908000-memory.dmp

Download

memory/3776-171-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3776-116-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3776-365-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3852-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3852-364-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4056-390-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-407-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-393-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-392-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-391-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-373-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-389-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-388-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-387-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-386-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-385-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-384-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-382-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-383-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-381-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-380-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-379-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-378-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-406-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-375-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-408-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-409-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-411-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-410-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-412-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-413-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-395-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-396-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-397-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-398-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-394-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-399-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-372-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-374-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-377-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-401-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-400-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-376-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-402-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4056-403-0x00000219F6F90000-0x00000219F6FA0000-memory.dmp

Download

memory/4220-121-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4220-317-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4332-23-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4332-24-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4332-17-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4332-16-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4332-100-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4492-96-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4492-158-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4492-89-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4492-98-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4600-63-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4600-69-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4600-67-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/4600-55-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/4600-61-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/4624-45-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4624-51-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4624-43-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4624-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4828-345-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4828-132-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4828-124-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4828-130-0x00000000004D0000-0x0000000000530000-memory.dmp

Download