5d304149e940a87ea202acd63f9949b18d62cb92751c2e6a8f764fc9950de002

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Size 2.1MB
Sample260820-ter6faed29
SHA256 5d304149e940a87ea202acd63f9949b18d62cb92751c2e6a8f764fc9950de002
MD5 14bf284b4d772edd7b561f567abce86d
SHA1 cc9b3bc4d9f047d541880fc96b3948710c667373
SHA512 88d48f2b534919f3ce54777fd2ff3cfaa0a5f90c006162b0f8871e183e396b258bc8a5122e7c9b983d524742ce81eaee153e29d75510a0d6a43f212cc4b6732f
SSDEEP 49152:c0pxcrSD204a1CdmJR9n+/Q8kJh9hNhBX3iQ/lFTjN4:c0pxfbf+/4h9hNhBX3tLm
TLSH
T1D7A5D0517DA04436E431013488AAC761DA9ABD768371A99F77E4343ECA3FAC3247726F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3560	alg.exe
3476	DiagnosticsHub.StandardCollector.Service.exe
768	fxssvc.exe
3136	elevation_service.exe
1456	elevation_service.exe
1216	maintenanceservice.exe
2412	msdtc.exe
4180	OSE.EXE
1656	PerceptionSimulationService.exe
3676	perfhost.exe
4088	locator.exe
4064	SensorDataService.exe
2268	snmptrap.exe
4204	spectrum.exe
1372	ssh-agent.exe
3952	TieringEngineService.exe
4524	AgentService.exe
1648	vds.exe
984	vssvc.exe
2756	wbengine.exe
5004	WmiApSrv.exe
3768	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f8ce72257c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081867eccbc30dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059a7b8d3bc30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bcc15accbc30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0bfb7ccbc30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085af47ccbc30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
3476	DiagnosticsHub.StandardCollector.Service.exe
3476	DiagnosticsHub.StandardCollector.Service.exe
3476	DiagnosticsHub.StandardCollector.Service.exe
3476	DiagnosticsHub.StandardCollector.Service.exe
3476	DiagnosticsHub.StandardCollector.Service.exe
3476	DiagnosticsHub.StandardCollector.Service.exe
3476	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeAuditPrivilege	768	fxssvc.exe
Token: SeRestorePrivilege	3952	TieringEngineService.exe
Token: SeManageVolumePrivilege	3952	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4524	AgentService.exe
Token: SeBackupPrivilege	984	vssvc.exe
Token: SeRestorePrivilege	984	vssvc.exe
Token: SeAuditPrivilege	984	vssvc.exe
Token: SeBackupPrivilege	2756	wbengine.exe
Token: SeRestorePrivilege	2756	wbengine.exe
Token: SeSecurityPrivilege	2756	wbengine.exe
Token: 33	3768	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeDebugPrivilege	540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	540	2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3476	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 4704	3768	SearchIndexer.exe	109
PID 3768 wrote to memory of 4984	3768	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_14bf284b4d772edd7b561f567abce86d_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3560

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3860

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1456

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1216

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2412

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4180

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1656

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3676

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4064

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2268

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4204

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:556

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5004

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4704
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e3da5339376c17c4c15d4760bf255a959c714ccf07b0afb7ef80c46732851f37
MD5 f967550a9d349056c36e4f4cd4c76377
SHA1 2d1383b5e3f58682becfa31a98670582d1d78534
SHA512 5c3dc9959acb8027a620f566fb8482ccb058c01c1e84702d7d14d3d0bb7db196a4167c853f887499048fb5772d1c4049096e4c2a1d3c66ff32ef22b6e6c3a6a6
SSDEEP 49152:bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9Q/lFTjN4:p3q6HjBdLm
TLSH
T1FED58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 05a63f4bbe08eaa3b3e038c0518c4dd07da03f282bd896e10435405237aec144
MD5 59b10786d1bfdd358f113b39c87c3d0e
SHA1 1313caedf0f69a8cb2dc7fff25c8a12fc234af55
SHA512 91507943f8e9e43322ae339b4915a73dd20a3de8428bcd7c4903b076dc7f00180e03789eb4a1237209e18e31492ad18017f713af0322afc718d0415804dd7fae
SSDEEP 12288:01XLsswWkxy2lRq2czA+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:SXYfDtczA+nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1FA65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b1c38b67867a081bf1906e98bc280a6e58b9d35f511632155728abd5e359781a
MD5 0d553f095acc1b1c4e4e998f42009f2c
SHA1 3f1be67802462457c3dc4c78628622a8a3dfab3a
SHA512 e6ec65e9b6e4e721a35e8ecd746660c448e1b25543a4640f00ae1300aa9db59c069110c840393d3f49fb4379cb6b40dee162bac306237582518fe8729655cd9c
SSDEEP 24576:K0Le5ji0hmxLrMVnQ/tbw/2Mkjy6Fr7g0ox:KPji0Al0Q/lFTjN4
TLSH
T106859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 543aa1d78fa1678db8f25cf1a690498cd6ec09cd16a052fa0e31ce037afb9538
MD5 df14f3dbc1b3b9b28f5b775d2406bd10
SHA1 5fef0b91d97eb03a71a914baa04781613cb9b402
SHA512 384d24d28c577623a54443bb5fc3bc94b9664675995e618500eb7dbdd8bd07bf8140b4b39e95dd3bd15581e20efc8eb5245c0501f421be3f5c52c5c96796edde
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWE6q8wyufnQ/tbw/2Mkjy6Fr7g0oz:a/ezSC6vUzPvxHjyAQ/lFTjN4
TLSH
T105755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b74d3cbd696d8f11ce33d569c17517036ebeb39eea53ec740bd5c7d3972f057b
MD5 b4fb2f7132349513e18f1f79ac54c527
SHA1 741f050e129d723b16a7bcba001bacc96a585428
SHA512 f6bd2ed4f377185e848d289d08a452c084ff59d0126c9ddc58ffa8c396a23110aaa0e37826c2c9dbe345557fdae79af7dccdd84620e84249503173c4bd884ec7
SSDEEP 24576:vVbqPb88hv/l+6CnQ/tbw/2Mkjy6Fr7g0ob:vVO88hXl+xQ/lFTjN4
TLSH
T139559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 930c2dfa601405fbd7070e682e4844343dd65fd5c0f940caa3ff676d3e6dba5f
MD5 0ad70788fe558ec672f2a3c0862d0777
SHA1 1cbdf74f30dc3641a569e8850e55afc94e57ce3e
SHA512 105f79b7adc1741fd8099ac21a768776f0d88b272e0c5eb8bbe74ea8d908edb029f1e3816fc7d7c0078a1ed5f54d179982e938a836ffe77f762d68f25463ec9a
SSDEEP 12288:izpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:iz5nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1795523796A24F897FF2B06B55CC284826B3B0EC1BFD0AB4E6744322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 75f9cb0e6064c392c3c90783e162c902cca6bca0398e43b112813d7ea028ec81
MD5 91309aca61d8ae99e7a10dc7f4780420
SHA1 db7e733fe488a36bac5e1dfbc575061dffb78022
SHA512 a8be406ccaa8612f3fefda77e5fce8cba70a178714f8b0e9dd5108ac14c2bab033f5db52746253a6ad9262724c31ded3bbb0f35ea797949367edbb0fea888f73
SSDEEP 12288:weBNUbTVO86UaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:wJIUanQ/tbw/2Mkjy6Fr7g0oo
TLSH
T13175CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 13f1f57c2a40e57f93824de13a0ca559ae9e869b0a9a4c1434eebdd79b6e47c1
MD5 e0b09afc4109d3279af13db9000ecda8
SHA1 0a2659ce3594613bb589fa9d8f4d25dfa6acc92e
SHA512 201dca91f795133310f7dbd0db86d444ad8112d2555c8ab7b55c55b26dc0c5e3dcd4ef363aa21fca9487d1490f208bc1c7558335045e6b5a9dbf9e21ab330173
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:CQvGAdlCEL8c/yRNw5CELm
TLSH
T18A267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 17b2b39cd41f755c49da7a09b6733fb27ec6df5c10dfe63317a41deb645e2261
MD5 99a688529f648a67d4fd8387ee2a52a8
SHA1 357b62b081907d51eefba932e308c30b222fb890
SHA512 1b3d92606bcfdac650bc3fdfe72df3c490cd9016a3a222e5e33eb8d32ae20712199840790467732456ffd6f2c0623605c8beed4c1b8f3ea7e3229d48c20a3a58
SSDEEP 12288:8AwSfxL/2Dc39DLLmt0LDQewsAjEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgk:hQewsAjknQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1F775E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a8e23f6e06bbb263d520c246886787a4b3a0a9ec9bff91a1f3c8b80190478ba4
MD5 82f90774f2db3a2471df398121303ccb
SHA1 ed592d6b88684f6109419c43def831db3fef6af1
SHA512 ca1103f700dfb3e90597666e9858907014083a5656999957b987021a103f6af216a9d1f5e7d030d9e078fba9fd6818f7db905993322826062d7a337b3a8f0aaa
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHvL:sUEtQevvqc2W1cpV2EI32
TLSH
T11E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 89ca42a243327eb16b431f377dc53a800302fac1ffd1b6b2306193d94a55dead
MD5 008a03f5c79aadbce3062add39c6a200
SHA1 dbf1b4c4cbef300466bcb2ff853d5f74df12d344
SHA512 923be6a5b9193bec81d79894659044469db60ffc326f10edbf489991bd0b7171eddaca58bea6754b5e12eb15ade5efd77e0c7db50b61433b1b9fc35c5fada4bd
SSDEEP 49152:NCbRquA/m2yL5zQfFiV+XenmE3/zEQ/lFTjN4:qoqtVjnmQLm
TLSH
T142D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dd88a2cedbff6dd2f1383a2030c0b3411ca28177dfd5ffc69a7c5ba60ff2d7aa
MD5 7b070d31043c7e1bba217867a6c9116e
SHA1 183c66df05df6fa413ffb84217db7b44447e9d62
SHA512 bdd4c2f178e95999750b80d1b4bace473f7a769f6829e0fccae5ce607cfc4c83f8b0a1b7cf2f0f12e038061c119092af9f89fc727e9c54654b2388808fa0cacf
SSDEEP 24576:1AhGLJIFoiwtA5l7S537nQ/tbw/2Mkjy6Fr7g0oR:1AMyFoiq5LQ/lFTjN4
TLSH
T1AA35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 86bab5e363e171308c3c6317e438efab854ffb7dbc1804ca78ca0cbb52a2964d
MD5 7034d1d117dd2f7f1a9e1c2194bab9e8
SHA1 317c99e80486b02128f1872810e0f77c67e72a6b
SHA512 14a76ea312e2d4fecdce4d57d96210e415300afbee8a4f8e8a507c0a2fb95beb582162e0b54d8c8bbf90b849767a3fd8f53720c033ea5eccfd8553dedead5e17
SSDEEP 12288:nmw5HEjsChN2BFgl0WDm+CfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM8:mwuHOWgnQ/tbw/2Mkjy6Fr7g0od
TLSH
T11D65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 96c5a95468e194e988d560e9a5fdf97b00527ef9c88b560b5c2f7557bf3b8325
MD5 4e87be652a6523308df0b2dad82b851d
SHA1 d41bdc18ff3ff7fe5206d095baff6d61d171f823
SHA512 edc0a4e992a29a772e7925ccbd8be5d2a477ab3db106271f7638e78088237cde5fa48da1c3ce69493eac881b25a2b848b087f9fe2e1332610cc1dc620554b84e
SSDEEP 12288:kXZ1Iy0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:kZutnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T12855126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 45d7c95f6f03df015a17d01a4aa7f2a002a67d6d12840fca4bcacbdbbd1c3bb7
MD5 6966ba10acc8a4cb0fe929700fcfede4
SHA1 e75ddd5295c49ab6a945e0029dd56adf7ffed85f
SHA512 7921b9a8977b6e93ef334b236a035394df98d246d30af2284fe1b9735243a7b95fde9a3e443d0a891e2dea8476a42500e02a026f87b8f82da6c3c565de360f63
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:KQRQyi36YOcPQLvw2gAf+PN3hLm
TLSH
T16D666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a3c52567ee48252c08c846ebb38764ebf93c878ec54dcf6a2d9d85c396ac57bf
MD5 77220f69a5e9eca23dee618224d3b2da
SHA1 3bec029cb2173d5439d5d1729591ed61daf81ac8
SHA512 7feaa26de4d8c8422b4e224196dfa13cbe6127864d70f01ab6039e9f3a06fe06e5d7b4d94e94bf44d8a2bcac24fcb63e1a7cfba9e03e84a31d2cbcf130ab6b37
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:cQRQyi36YOcPQLvw2gAf+PN3hLm
TLSH
T115666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a1f03220476f1056af3644f4c6a85c87fb33686f7d4496d7ff55cb766eb9caae
MD5 32ffde9973ff08e7496e6ebff9a2d500
SHA1 c9869fc64b5e056b5fb1570d19fe0d6023dd312a
SHA512 ff16358ffda36875ad3aa47284b4b58529318067875de8fcd98c05b9c920370e0125cdcbfb677fb5c1e277b3744ab1999e75c3c5a16a0ef4384696dd3beb1462
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL09nQ/tbw/2Mkjy6m:F68Qg55nhheWu7PNU3/0Q/lFTjN4
TLSH
T141B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1367152ab2f01199b607cc3a1525c1d6ecd0602addd36972095d0e21b90039c2
MD5 d2956a3965ef50d94d27ac2c8bbb7161
SHA1 6bafc939b54a7b5cb16ad8131c6bd8c733ee4f0f
SHA512 4e5ae78feee6b543cdbbf12eb9f84a0a8a5ae7bad14356f5d9dbdf80e5cceb589753b3e4adbddae0af73b4098972f8b6624d92a9534c11673f9f50076a553a03
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99K:Fy5112gYy5azzVvL69nLKnhZuLm
TLSH
T17E167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 31aab06d9fc9130167b37e3c5cfbcfbd2289f171f5e5c9cdb0ff048accb57c0c
MD5 b83c98babb0b4de920e0de41ab80ca50
SHA1 998be1328a3bad9ba8f3927a79effc914e60afff
SHA512 af022444d754bb369603ad47921abc7fc59129c6b3fc4bfde702c30df63a2becd6774e270dfc432d2ad163622b2f50a0b8f1f214e98a871cf65b2a351769c8fe
SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOQ/lFTjN4:nu6JmVxd2dpLm
TLSH
T11BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ce9e8fdbb3af85716ffb1844280106ef663fdaf190809fb7dff0fd41a3f6a628
MD5 ae816a2a3c86564bea659fcbf3016a8d
SHA1 10f02351fb8c4f5e93442200a33157c0b4aacdd3
SHA512 3fe05eb8cdaaf9598a27db75a8c62501360588aea8d8ea3ab470ffa231d4c2af2dedf5f209070d6c663519d4759cb3454d0ddcc6de4b527c345770f907b047a1
SSDEEP 49152:w1hpsNoJpF1A6UU44CwH7R4x6Q/lFTjN4:wmifPbRQLm
TLSH
T10AB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 04089de4c64b72d573e1488b72008a83952ad82cc3a59f7a54b8caef3519b888
MD5 6df6859d79b6fb3b4d796b689ec0a5b6
SHA1 ba66795f1c50fff53008e34b5c2329f490e360e9
SHA512 340af629ac7c07c7009ff3bff36e979d632d8df5c8484421d0e758c22c99e63532715d35f8b2db57237d891ec9db1747670e07d941b2c2498bfb87f0656b24af
SSDEEP 49152:qSuZQIY0Be2KRRVtOnks6NMHqtQ/lFTjN4:05dKTi61iLm
TLSH
T169C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0a44d45b89a1bd5e906b9937b30411aa31dfa97bee6fc0a3bf8d458948dcdd32
MD5 b3d4c6a82eb81187ab2caf05bdb13576
SHA1 93813dfe4f27fe2dfa4e5444a1fdad3e69fc1537
SHA512 6e26a2992c9a6e3fdd68e27e1647559fe0371c0b07f25bdb4b6ab6f9c945356c0728af272df6fb01488d1632403e555e2081183de96064efa6edb09f62f2d32a
SSDEEP 49152:zhtSn8EApI0figngiDn0AP5w+Q/lFTjN4:yX2iyphcLm
TLSH
T19995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 971ca648e592fd2298fdcfaa37b0628eef3aa525d8a328b1b17fc02bc5773670
MD5 9bbeb8fcfa9503902d0538350c4c45c7
SHA1 1b8600e7926084c2c57b46db03264cfdb998f841
SHA512 2730d29e55a551375210cd45178ff72b2878270624504c855733068f7f79d0f4c153a66bd2616e21724c7e79725b250082abb3b62fbf85b705f424e53648f38c
SSDEEP 12288:VhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:VxnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1F35523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ab5447eb42cf6c26dc1d39cd512f67c5678526862ee11348c30dbfb7f1e92537
MD5 afc107d202c5dfeeab00cbf0e1a6f77d
SHA1 2351529642cef62d147447298774e3539577f843
SHA512 e32978c8794210ba420ab63d046d0d5e853d90033616dae8553724af27b6c85e64980f347242eaede6b30b46c4f89821bd1f1b7ce7994743cd8d9c3b38f8f7e8
SSDEEP 12288:nIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:nInQ/tbw/2Mkjy6Fr7g0ox
TLSH
T13F5523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 75f261ea60d476e31789e248828d4902633787c9bf725bd8226c5376f735b8e1
MD5 e09c2d3a02d8887d9dc6013e797abda3
SHA1 3a098263888b45af8d43aa2f8cebc8fcb49188a2
SHA512 235e309fdee343e0eac618997a0497199708cecef4d6ad8ba5007de7515926090a1fccde6ef5bc7bfeca9bb29cd92d071a8df2165257b71baa553e8551f92c09
SSDEEP 12288:sSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:sSnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T11C5523697965F98BFA1706F1488381829B7B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 29536306c238dd4525964106f0a26dd1d9e5952d983e5719312a0f539043adb0
MD5 78edfafc0f1a024958ddd1dddcabbac3
SHA1 335cf504b7f5eb9e3a3a88bcf93bb54bc42de33a
SHA512 5cc8e50c8eedd3a4ec54a96aa12888151c0ad9c9199f344eda46e576d68b3ef66a51d2e43b06609b4f8941e714528c65d44c37b3955db5cdb90db0db636514e0
SSDEEP 12288:MVrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:unQ/tbw/2Mkjy6Fr7g0oP
TLSH
T12E5523693B69F4C7F92742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 03c2f69bc35bf630d759fd094b32d7527535de2f54a50a185fe5850078d5b192
MD5 81d07e967b5305c5842c6d92f30f02bf
SHA1 bc99ecc76193bda0246f84da449e119b5cf23f5b
SHA512 44b9f5b26b5a4224d561a20ed97e03c470b6a3f55016084569fd1a0ac28650796af5379fb823e201f134b58ce114e521734ef2f947205505510948747b86e4f5
SSDEEP 12288:mTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:mDnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1B05523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 feb34a0f6e6f6ac56e15dd0493bd329e9e525f22c1dcdae8bda00d1d5e78893a
MD5 80cc2f79713b07840dee00beabb6b38c
SHA1 373b617621f1c89d0cbb3311bf20da379b5b4ae9
SHA512 720a912c8bd1cf16b9b0daefb16a9dce84aff30c85559a8684da4e2c45dd9d38638deb8e3511d45d1334aefd1ab0e8d4abb9b3e4c49e19b671d3cecda3160ea4
SSDEEP 12288:j8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:j8nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1455523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8b5b19b0179ab7cb59d3baeefda2a1e0c9b0ccdbca61363655b57a0b93418464
MD5 9a22b9e188bca1adc02558045d072c9a
SHA1 5fc1ac602b337dfd61f1c0e35b8b3453ec0ba131
SHA512 9cf1756000555c5c56870a8f211900b6a8c96c16be2f0a5b34e8d143aff052eaf278edbf0dae95ec4155a91dda1c9df8f3b270954aff5d4a969a227eacd5d7c1
SSDEEP 12288:cQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:cwnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1CE5523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b397c1b135fc4181e32f0e585935177f6a3e917f3de294dff19e49cf92e4667d
MD5 76c4cf40b1af82a434f9952a35a1fea4
SHA1 683b6b39eceedd50b9080c65d73de267625c9f5d
SHA512 1b3e1bced086f7d732983f05cc5a94c7c2f2cf79a691ff7040d28ddcf7ee0799d33e717670beb0ed0294e2c7f59ecda6e21c5b778337767a0110efec1d8abb3c
SSDEEP 12288:ZiZwbDzzFEoS2cPvyoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:cZM3zFVSOonQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1867501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 609143d0d5724eb99b36583dd055a9a07ca89628ea9d02f0b1c4f32c91e3963f
MD5 d36c2cd6eecdb1f7ac31cd58618c5574
SHA1 471938484dfdbec60bff4cf5603e414b89baeada
SHA512 dc41fd9097e240b136aa149884cfddb2ac90fdcdb3459148f188dc46933a6cca72f4538f2ff849a548828a76a851b0841f61e9a1cbf480e4467547d7c54a1b34
SSDEEP 12288:u9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:udnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1135523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9111b4528cc3ff92014d6a26ead0a9e9872fd1609249d8cfe047011f24775fd0
MD5 fec5a478971c036d4681bbaf1a043136
SHA1 b6d63646e5dbf98a9cc09328caae5a540e7672ed
SHA512 afaac3af6c6a1e3a5338954a31efcb07912e16090ef916915dfa8971ade658165722a693236e7a298d1c3f2407735fdcb22c2fc4c68d8805937bec25842f5a1d
SSDEEP 12288:8ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:8pnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1AA5523697964F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 fb13a4bd9138bac9f054d8fde501554279e4a4285925967b9e68b56fe8a9a326
MD5 2cba14b242c83d81756ed70f20819481
SHA1 c5d4cd6d59945f3444c20e5f8d73b38f998ca880
SHA512 afa4e2baf8873454e9ed461050393dd7ab4c1430bafdb57c22b541fbc3de7e9c8c6143d6e53f5424419f4c3c3f21c41a91e7008022f66454ac8e6577d32c7569
SSDEEP 12288:1yPz5L80GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:czyUnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T13565021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 613e756e6e04f002df2634aa60917773e3da8009da658e20b6e0b377cf0f26b1
MD5 eba15fcf62d067b19eaaa0e8ea0fbc58
SHA1 11bf1253f2b384517ef544c8b5575052f30cd1a0
SHA512 7ebdc46d3b8137e69f6ab23d2bac48302dffdba018ea275927ab7597c85a411bd65366e9947b43f7b883c3d19be270f08e56c156ea292154aa7dc70761ceb0ec
SSDEEP 12288:a9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:adnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1375523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b5a00585f54c26a44472e5e72346fc2e43e4abcfecd4dd35b17c36b874faef4b
MD5 ac5bf31c69f6cc6c87239400536fc86b
SHA1 c0e4a3375765e8c8bd550832e9a4df9c12cb6ee1
SHA512 c22d5dcbc9afbba6461fafe9ac249035783dce26888f903105aa18d7763ff6b49f9009337ad468ca1aa9d04f2da748a2acb4a56ee5a9fc9bb6fc15d620f62348
SSDEEP 12288:J9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:JdnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1335523697964F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 b21701ab91c6f8f8cc8d68543a08ace10f6d1c985aed73b4334806e8c221301c
MD5 f36b28c411a502bf6d17447a525e33c9
SHA1 2367189525c354ba22868f21abdb2c6d26ef5567
SHA512 1ab1681e0f71bf3b34854d5c98372fdbf488c3faa2e8ce9ef3d517600b092ccf6bb946f0e67bb0fdd5c6928e2b290c034e3b05618f4624ef86cabeadd6e2b879
SSDEEP 12288:oyPz5L80GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:pzyUnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1E065021773A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9ba67e211100e2e414ecef46ffb11ec93187363b44ddb92362b32f8a6b7b5819
MD5 6849314d286a88a0022e70c7237eb007
SHA1 d684674cfcf289e52c4ae667dea7defd8eb8b254
SHA512 63de8a11d508ca6f17c2d96f9c6dc3853fd034954125ca6b2f3c4e0ee369b5e53e4b7600b3e26eec5ea5081191e220ec1842088edb21546e1b7462198dd43b91
SSDEEP 24576:9cP4mcvIjkGOxhKP2l71nNKbrh/8KBlnQ/tbw/2Mkjy6Fr7g0o+:CP4m4IpOO67W8KPQ/lFTjN4
TLSH
T1D865AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9dbf3d9987ae8ab2413f9b7df8d5011d6b70b5ac17942fd3bc929fee07b76306
MD5 b1fcd6aceacd7150043bd7ad943eedd1
SHA1 fff5f951202a00ea484c54303bc993263e2c32d9
SHA512 bd6406f6aa786a65e125ec57078a0f881463fc18a9080dcd21de33f30987edb724f4520cfef8020f1c558ed6efaa8dfb3aa4fad090bb20b66e13b70fc7ed7fda
SSDEEP 12288:AssfNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:OtnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1ED65F119E29852E9D02E5279CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 077091d8d87dfa3d916de873b2bd35fab414a1168eb0e10ad8b7bb6247f140e2
MD5 a0e98d4a26e4d1d89cf5ccba58a62458
SHA1 bd0d18acf916bea7535006c24ed969b814b1b6bf
SHA512 b9bde9686d035aa19498023158325070ca1634012b73f4af61e6aca0197bfe5be00994ffdf32ff532e5ea04e7f924e9146803c3a11c1b12502c742c2798613af
SSDEEP 12288:mtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:mNnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T11E5523296768F94BFA3B06B05882C151673F0EC5BF91D38FBB08222D957C3D41EA6749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 59aaa94e897b62858f75df795a150e736729edd82ef940232ff3ee0b167db901
MD5 07976666178b042a4c9e4fac6ee08919
SHA1 66c42931abf74c21a9ba505cc70ad6ab90d9ec3c
SHA512 76ee47eaece66ef55a061b5a28935eeb9bbbdf3f6994d8bfc0ba2faf07a96cd5245bdc56b79191519e94345918a8c76de3199419683fcb05befcc8f7db11b658
SSDEEP 49152:Aa0h2GEkuAe73q3pp46zwwQDQ/lFTjN4:Aa0hNYG4JwvLm
TLSH
T131859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 55f314d0bee2dfdbd791dd89e6cc3ed51cd4a6b7a89eacac9069f33b48499aec
MD5 24b4b4da4a8a3d0261487293bc7227f0
SHA1 a881b033d0e650e286d0f60af4a6af7a181871ba
SHA512 efe885d512b71ea5c8673aa9f55cebd09c333418ee18474b52b1bcd532795fcf065cdc93caa656720d23d96fc0b6baeae90fcac7d56b4d1e6c454e5c00b5c2af
SSDEEP 12288:WhbHjfXYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:WhbHjPYnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1E055027D26AC30DAF63692BD88928546D7327C552B11A3DF2381423D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 af389f28f5b033d577ab69981dbcc61cd56c2c21461e44f7168ec6516f778428
MD5 c3fd9a35797b5d9eb7da68bfdf381b5c
SHA1 f7b10dc221d11c41e390747c4cfcd9c7d4c8a5ae
SHA512 bd1e37d0d57a49b7dd4caf79f8a8dbd8c4a97a0bf14a0c0baca0df43a41e31c0588a3183b83a7be63d742867510f2752713c16542edb3040f7dfe4cbbe6d4557
SSDEEP 24576:f3YgnJcRTk4yti+R5dBR/gnQ/tbw/2Mkjy6Fr7g0ol:fIgnaTk46pBR/gQ/lFTjN4
TLSH
T17A45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 b63f7b05d323124187c8c06e756011b25cebf55ad865ea80d135f35d28a0dc60
MD5 535b01a1539466f23ace91b2856402fa
SHA1 c1c73addcda994ae2c830dad3b19e284e2dc747b
SHA512 596468fa59aad4f24ea33a7635d28b5094ed8c740fdc0b0a1048ca30bde3361d71e998a5d17ded543d0c956af4455f95d8ba05af07982176f1c9ef46ef01e168
SSDEEP 12288:JJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:JZnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1905523697618F98BFA2706F54C838146673B0EC17FA1A3CF77482229967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 d5d54c84824fcbb43d14c5dd0307ce87d9ba8fb399869ebe76ada005da58a28f
MD5 f52110fdc1b68a53f9e16c72a0ad123e
SHA1 936d5b8544c91eeb6bb28c034ab31842b06b45e0
SHA512 2319d029e3452b712b8d6568d109c4a3e110d90decf6fb1b270e40cacecc82e4d0c90fe6e86e5f3435cdeb64a3217aacc6adbdd1360c291ba2ee427836c280ae
SSDEEP 12288:mOb4A4LWOsvAYFT+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:PwL3UT+nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T18775F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 c40d36ac945216ad37f4184a0aa388db3dc2a9c3ef88dbe9856f60ad5b8d9dbf
MD5 c8a04e4a2b9b6978292f8c2cfbfe7ed5
SHA1 255c1b65f4eec0b5cef7247e4abcaa6bd037a6a1
SHA512 872da827363f65407d1d1bf3e67d083cb7e845d8d3150b9b538baad960aaf45276d78777d64895cc41b4d22c2d5c78cd79d8a32e70929c680e65255d4684bfb6
SSDEEP 12288:HpFtCO6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:0O6nQ/tbw/2Mkjy6Fr7g0ok
TLSH
T16255022D36EC60E6E536527C89838209D37278961B6253DF0780817E5F7BBF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e99bce1c66a93b38cda2d4cef70314db25175475acdb0bc7cb7bd1da3171e5ab
MD5 db04b7201b3bf8376f17f551b47a0c21
SHA1 52736f8e270542591a1fede227b0c1c61fd9f440
SHA512 a4b45247207694fb9b8c678d83cc9228557726db7d4f36cbbc601c357c51ee1a8b1aaf3312d701426a59ca469fcf4b7921e9b31dfd4a50ff7a1974e6a0a22e8f
SSDEEP 24576:E7NM9YqZqmWMUkPjZM48Mv6bEhsdnQ/tbw/2Mkjy6Fr7g0oJ:E7cBWMpPjN8DbEh4Q/lFTjN4
TLSH
T181659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 18233b36f550b4db154240ea14e8657d264958f702e399dfc9dea558bda0da17
MD5 2860fdb5de888fa555bbc23d23f939bf
SHA1 0b94a8b24f720574d9bfa70607c2129fa89e9374
SHA512 7ca45c0c556c1e53e5b1a96762cff47aec4c250bc6968a7efef95f8eeb4662387a73f0e3abf065dce173062287a390c687a6678b11db66f9c3d4c8f958e2f312
SSDEEP 24576:RW6BApg2YuyuNDYTabvcdvNYf8km1HnQ/tbw/2Mkjy6Fr7g0o4:RF2YuHNETovAvNYf8km9Q/lFTjN4
TLSH
T187857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0877a776cfb15a4d20553fec011758ca03e6b82bd16fa697391f3681492cd011
MD5 ebc8b0bd6153be5caa7616ccbb1dbc5f
SHA1 ef2554a8784e22e235f17fe927ed8879ffee384b
SHA512 518946dba7e646d6960e897f9a39dc1bd5836ce944af01ce5462e0d35728e8c7c9475aed211e55acaad5a0e4f03214bad20bcd02ace3e53ebb46e47a89964bd3
SSDEEP 24576:6AFs06+Omlf3NXEbTo2nQ/tbw/2Mkjy6Fr7g0oZ:DFs060lVXujQ/lFTjN4
TLSH
T17965AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 79a640f9661d21104f8c3efb76551d0e223fec810af29ba96fac3cff326a0355
MD5 f4b2dd822e1794ca77b8a89c9065b4fa
SHA1 1b61f3074a682fb7fbcfac48140b20103ee32b96
SHA512 2a46657ce853a5996f0e08b5f1d1a9385326fceaaddf74555022783d94f13669a1d3b8ab854890a85d9d903410ca9e4a72106b54b3b8db9352b388dcf9888c8b
SSDEEP 12288:wCJnJ5D3VkrqzxdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:FJnJ5D3WajnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T11975D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 466bddac6732ccf30d0561f48311af7339926d5dc547aeed5a8bff0302ddacf3
MD5 1ac5a789bc0b3e240dd918ead631f996
SHA1 df731ec8d39c0b8fa1d76c1432a03b4a99afc28e
SHA512 3139f13d2401bef571135fd05352fdc1152af3985465644e63cc5d12cbcfa6cc5d1259b3361d43b45e8d82be5a18c5e02d500b5608f505f10d5bdea03b347541
SSDEEP 24576:tEPghm6/7IIXdwcXrif7qQncjlP65i3VugnQ/tbw/2Mkjy6Fr7g0oo:ag06DIKdwc+eQnSt65aVxQ/lFTjN4
TLSH
T1D4955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 993ec19b13fb039e15817b9aa13692b09ee36d644ffee644ca7ac5f8212be6a3
MD5 6d2ca70a252e848bf5a002f48d1334bb
SHA1 2364a9a153727cb92388eff0f306c2194c4b1c19
SHA512 9fde34afd39a1e3980a9f6c001033efe2d39d09cb443586be5f4bbf9b9ea5cb8b67fcc2e0e20a66e9504c504b64df1683051b362372211153839bf83f47ceb32
SSDEEP 12288:REP3RSfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:CS/nQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T13C55126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 b8dd6551c594ab2f3789680464a66c2d0bf7486a229eeaa896b7494211b6f303
MD5 76869741f5ba81bab65174080155a2bc
SHA1 2e6e9fd806ca4ec89de2f45672caa713437a11e0
SHA512 f467423d3872b9babda6296f0dabc6222db431ece936d7a25cebb4349eedfc18178b027b77434bc4a96d63775817a353fd1ba1ac96cabdcb803fb3e80d9a08ae
SSDEEP 12288:FjkyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:FIyInQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1296512182398F4DAFA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 dafd99369f2e75cac07bf06ebb28638b9792b6d073856543322750d6191f6da1
MD5 2b7a28e4803a707aabb132b4d8319935
SHA1 fb80a43aa7ee3348af6abfb103c3afb3d501b48b
SHA512 5ccf612b5f25f360614f7650a4f19865a9dcd2c4331a53b3e4bd65cd60d5640c5bc446e3a868cc5dad86fbc002c5d4f118e81c36ecf0b49ecd81246c91dbce2a
SSDEEP 12288:t0qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:6qnQ/tbw/2Mkjy6Fr7g0on
TLSH
T12B55236C3624F89BFE2706F448928542973B09C17F9167EF3684A239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c00e94b5292e90b1578bedd3ad931a7a3449632335a90b4c83a818eb21885c6c
MD5 f923bfb133361b4b2432dd270fad7573
SHA1 31fc3acb597f0197e8af81801503adfd7d2f11fd
SHA512 ba0a0b2ae02ed033528d00071e5a8c44e3375d7e52ef5c9ca05f77ee53d8da45d09410db0c7fe749bc9ac7a9c1a401ebf41cbf977273f4dbb624eb5945b10c92
SSDEEP 24576:WQ9MxZKdcz9dw31nQ/tbw/2Mkjy6Fr7g0op:WVKZ1Q/lFTjN4
TLSH
T122558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 5ad8ef041df9d1e5834b65141d8925be1ad5cfdb18cafb838cbc9a074f42f170
MD5 29dc95c796c16f148329d0a64f396391
SHA1 6ed6ca96b8c0325705a97b444641d23deb8d1d07
SHA512 5a6d0607be27a157a816b4057cc5ec804b8203499becb61dbb5fa523eabd99d420cdf525f8d14ee38b4658becd6758f2c578f01de3d30b9049c6c339e54ef226
SSDEEP 12288:HyoKo20Rple9pEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:HyocSApknQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1E965E01FBB6990A2E136813C88818745E773B4706B6267CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 287c0a5a95a0dc685c5e4ca486d1fcb917866d75ad127a0269792142ac2632a2
MD5 9083199da7be236f911f8322399144a8
SHA1 b7d990113fdf563793761da0bf76fa3a7db2c703
SHA512 2ab52c80da986a6cb6cda0624e3993737c45aabb8d6899f47107cf56748ccf68a2f11ce563643eb0fc58a46cdc2858f2f47c06a93a9634bafab53a49da569184
SSDEEP 49152:aWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKkQ/lFTjN4:c0zuNIZLm
TLSH
T10DA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0d2dff5dd2493fe1524733b4d6d06c49418caaa704c6468a2c16772fe3e67d8d
MD5 8eba6e7464663a71e51550009b570082
SHA1 d9ed4604b987238e5ea35c24bf76536938ea3a39
SHA512 765500c78afcc52360e6abf3047a48df5af04be11745c3b4eb9915961bf8b118baca4c028132ed5a0e96524fd5ec70f3cc73f66eb7ff20b16ff41ab26803a605
SSDEEP 24576:W1QT7EcpfxR+N5AWAz3ooiYtjMqb/nQ/tbw/2Mkjy6Fr7g0ol:7TDxR+N5YzTfjMaQ/lFTjN4
TLSH
T11955B02EA7F855E9E17E85798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 bc8e74be0b87e54e1ad6d380053cf5d03cf3b97e89372bd3a6c2b782a4cd406b
MD5 e68c1e09aa75d81285e79472bb28e214
SHA1 6be1e5a896221e7ff8ff947c32b69a42b1c732e4
SHA512 c8dd8470d6d27993a3b7ebcc5fb22100b11f7f84d6e00512581362ddb5ba55d78f595fad0997e31d0e7ae9ffe1aaeb98bc9748e49aef6bc298d568215d446c65
SSDEEP 24576:nTMdOz0FFS+1mSLbnQ/tbw/2Mkjy6Fr7g0ov:V0K+1mSLbQ/lFTjN4
TLSH
T11175E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 42b089d97c62d515bac89743195cd2c660f74811086706d05eebf63159e73b99
MD5 ea79303598abe2a8e4edcab7f013949d
SHA1 d0d5d625b1812bbb7df67a319c9fd116cf60e666
SHA512 03326855749d8a0da33a225b1cf93d2f619299e8c6a0ed346d7c0d8767178a87d2cdb34de2dffac496432897a975d2b831015a2c476cab20918a206283bb4f8f
SSDEEP 12288:o4T+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:P+nQ/tbw/2Mkjy6Fr7g0op
TLSH
T11D55122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-0-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/540-73-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/540-6-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/540-1-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/768-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/768-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/984-196-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1216-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1216-54-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1216-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1216-67-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1216-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1372-126-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1372-193-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1372-132-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1456-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1456-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1456-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1456-350-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1648-195-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1656-93-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1656-372-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1656-85-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1656-91-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2268-191-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2412-353-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2412-69-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2756-197-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3136-37-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3136-348-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3136-31-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3136-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3476-23-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3476-201-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/3476-15-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/3476-22-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3476-16-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3560-188-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3560-11-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3676-104-0x0000000000660000-0x00000000006C6000-memory.dmp

Download

memory/3676-99-0x0000000000660000-0x00000000006C6000-memory.dmp

Download

memory/3676-189-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3768-351-0x000000000C330000-0x000000000C338000-memory.dmp

Download

memory/3768-204-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3768-154-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3768-373-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3768-199-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3768-170-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3952-194-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4064-190-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4064-354-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4088-200-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4180-81-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4180-74-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4180-80-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4180-355-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4204-192-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4204-121-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4204-115-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4524-139-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4984-388-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-361-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-382-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-378-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-376-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-377-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-385-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-363-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-365-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-368-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-369-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-371-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-370-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-366-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-367-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-364-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-362-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-360-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-359-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-384-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-358-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-357-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-356-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-386-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-387-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-380-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-392-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-393-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-394-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-396-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-395-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-398-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-381-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-397-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-389-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-391-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-390-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-383-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/4984-379-0x00000203C7060000-0x00000203C7070000-memory.dmp

Download

memory/5004-198-0x0000000140000000-0x0000000140171000-memory.dmp

Download