Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/08/2026, 02:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
- Size 5.8MB
- Sample260828-cl577sem6w
- SHA256 98ec85f0d98a135b83aaec616f2da133264f5e8b08d308428c98512482745338
- MD5 f0963d3577dacdf32c455281fa94e3af
- SHA1 0196db63349b2d8161961c90ab2ee840e686e774
- SHA512 5944147b9243d550a3267c0638e5d1660b5c35d03dcfd5a9e7e321421a89c96a0a7c9af3865bbbdcb0ce5805e407b0c2ba90f5f423bb93bd1226fd0758204d05
- SSDEEP 98304:/enyzZLvyUP6ZVYsPHpIPIIwy5AG8H4TWr9XKitMQM5SSDntdDpbRZy:/enyzZL6UykYpIQIZBBUYFSintdDFRo
- TLSH T10B568E227603C532D9920170967DAFBB985C9D304B1A99D3F3C07F5EACB11C25A36F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4444 alg.exe 2996 DiagnosticsHub.StandardCollector.Service.exe 2888 fxssvc.exe 2384 elevation_service.exe 3428 elevation_service.exe 1116 maintenanceservice.exe 3856 msdtc.exe 4384 OSE.EXE 3288 PerceptionSimulationService.exe 680 perfhost.exe 3408 locator.exe 4356 SensorDataService.exe 3708 snmptrap.exe 2648 spectrum.exe 3548 ssh-agent.exe 2488 TieringEngineService.exe 1780 AgentService.exe 1592 vds.exe 4436 vssvc.exe 4712 wbengine.exe 3900 WmiApSrv.exe 4348 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\64fc82f6a19fe9b3.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d54ea7c9236dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f34e667d9236dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001406dc7c9236dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000723a727d9236dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082170e7d9236dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3b2497d9236dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001041d77c9236dd01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe 2996 DiagnosticsHub.StandardCollector.Service.exe 2996 DiagnosticsHub.StandardCollector.Service.exe 2996 DiagnosticsHub.StandardCollector.Service.exe 2996 DiagnosticsHub.StandardCollector.Service.exe 2996 DiagnosticsHub.StandardCollector.Service.exe 2996 DiagnosticsHub.StandardCollector.Service.exe 2996 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeIncreaseQuotaPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeSecurityPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeTakeOwnershipPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeLoadDriverPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeSystemProfilePrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeSystemtimePrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeProfSingleProcessPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeIncBasePriorityPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeCreatePagefilePrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeBackupPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeRestorePrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeShutdownPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeDebugPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeSystemEnvironmentPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeRemoteShutdownPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeUndockPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeManageVolumePrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: 33 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: 34 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: 35 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: 36 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeAuditPrivilege 2888 fxssvc.exe Token: SeRestorePrivilege 2488 TieringEngineService.exe Token: SeManageVolumePrivilege 2488 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1780 AgentService.exe Token: SeBackupPrivilege 4436 vssvc.exe Token: SeRestorePrivilege 4436 vssvc.exe Token: SeAuditPrivilege 4436 vssvc.exe Token: SeBackupPrivilege 4712 wbengine.exe Token: SeRestorePrivilege 4712 wbengine.exe Token: SeSecurityPrivilege 4712 wbengine.exe Token: 33 4348 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4348 SearchIndexer.exe Token: SeDebugPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeDebugPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeDebugPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeDebugPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeDebugPrivilege 2776 2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe Token: SeDebugPrivilege 2996 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4348 wrote to memory of 2964 4348 SearchIndexer.exe 111 PID 4348 wrote to memory of 3916 4348 SearchIndexer.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f0963d3577dacdf32c455281fa94e3af_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4444
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3176
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2384
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3428
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1116
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3856
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4384
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3288
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:680
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3408
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4356
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3708
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2648
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3480
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1592
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4712
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3900
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2964
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:3916
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 410750b7b072e24ff06e250ed3be5926855793b7ac293ca4cfcc51d5bb980954
- MD5 7dd27c86cdf32ac379e7b17fc1cf3c5b
- SHA1 05037a90ff7e4b27b253f14d1897f4bc2547b0f3
- SHA512 72b69d267e3a5978a18fe102111e4b31e4d2f730028fa30a8dcf442c97a4912d759d938aca24d4dcfa65961873739108a698ff12842047950b012294efebefd1
- SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnF5SW6H8DS52tdDpbRZy:K3q6HjB45SSDntdDpbRZy
- TLSH T1F6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 12762ab71d1dca4cde5f1eece4cf4c6d2be1dce5c724940cc8ebb2445d71e0f8
- MD5 a4588444b7cae503e056b2930fafaf7c
- SHA1 47830764c77fbadf0afb90d874f828207a1177c3
- SHA512 127edd6dd48edade21293e1c73eee5ec34c8f29a8689d219451b5eab2dbaa45f7e1277fcbca0fcb21da150965b61868e2c97faa1658aecceebc0c7613680b74e
- SSDEEP 24576:SXYfDtczAc5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:5tcb5SW6H8DS52tdDpbRZy
- TLSH T1A005022873D008FAED6B8279C8B28511EA33B8554760E79B03F495664F337C95E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 a904083c68417da2aeff3318bbb3d6464c80a7ebe61ef01f8fe41043d58a399e
- MD5 658f0a308d9bb4afa2d7d85f078e4476
- SHA1 4a040502598d865105acb324cec47fb15134a121
- SHA512 83a038ce624ee2ac95e3fb262236f261dba40025b5adb06898698f96da028ab22a54f8931e6b03649354fa3d6495a5461611377514edc6f05901fab4d332c9c3
- SSDEEP 24576:a0Le5ji0hmxirM95SSiVw6uAX8DS52tpz9ZRzbPmSZyo:aPji0AcO5SW6H8DS52tdDpbRZy
- TLSH T13735AE55F6748332D073C0BAC5D2A69EED71308657308ACB4286D77C6F27AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 13368730a7a96ad69153add387d465d012834f88465b135fa094a62bbe3e9a13
- MD5 7323193667d192dcea79dbc73ff5d9c2
- SHA1 80276216596082e484a4a4f20fdbebe47b905ac6
- SHA512 5fdf0a605237569579d7d6550c480f361f2122e927264dd7add145d3502a3657eb193fddb233f3a78cc6175c81238835aae90395721d0989811c7c42e896009a
- SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyuL5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:D/ezSC6vUzPvxHjyS5SW6H8DS52tdDpO
- TLSH T17C755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 1a9ff5b3c3e4d2f1cdb98673a6e22aaae48865e9a4da3d0d3ae089728523438b
- MD5 514b715a35df57ae3327387f75dd488e
- SHA1 f09cb83efa69cc6d999aa3facf220e5e7faef4be
- SHA512 3a5cc1d2ed76fde397eb3fc4661cd87618bb412119c82892b3d4a66094d3c278bf267e34c3671960bc7339c68eb973fd51036289725abbe8fc11829daafb9318
- SSDEEP 24576:JVbqPb88hv/l+6o5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:JVO88hXl+R5SW6H8DS52tdDpbRZy
- TLSH T196559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 7551e1875f3a4342b38514c59604d429ace14d1f61aa64f982a1a204f3854d8c
- MD5 4e8025135427b6de1a8ec327f11e658e
- SHA1 504f1730d0b19df96612b0a5f3a1a87534325311
- SHA512 79417432565c19d63330cff951435d482517dcd4f3476ced6afc262d9e0a706709abf3904167c00b09597613467c52889c4f721366cb35e737ad03d2ab9e6dab
- SSDEEP 12288:iRZ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6a:iRZ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T106C423C4479030A7E31F0AB3F1FA96D4DA18EDED8408663B4E717687CA3998BC577426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 e30c3907e0239c93a277a4e11f27bdb88c360bea4d9df9679ba326f6d42effb0
- MD5 98b4cf88a42b0a31618cbd2b3605a348
- SHA1 8576df5a83290aece3fd7a61e61b914c2afc7e2e
- SHA512 dcfe40e8085480bc04af1a5012c3344e6395bba59fa0724d9c3e7139bffc118546281429416f5d367efcdfd54883d3eecf67477a76e80ec7980d18676548860d
- SSDEEP 24576:EJIUA5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:EJIUA5SW6H8DS52tdDpbRZy
- TLSH T1DB05DF7BEE28FCE2C27E4DB956918640D77278704B21A3CBD175820ECE235E54E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 1ded50bc117824e7816d0d6208a88caa45891ddd1117e14d41dc53f9cb62a708
- MD5 7d9cb14f99b6f0e9769125628f0db839
- SHA1 3482c15e7fe1dcc785add859d72ece85fe3e9911
- SHA512 fc957a2b6ac3342a053aee35af3b8533d9ef31906f27f38b46087ae70c56e893f31025d31d234ec723cdeb563b67572d97bb961c029845093fcd776e6e8cc60a
- SSDEEP 98304:kQvGAdlCEL8c/yRNw5C75SSDntdDpbRZy:5vyEYc/y3w8NSintdDFRo
- TLSH T147267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 f0461d35e5492704753b469fd12b1783366ebceba2dd00a3769b1945baa6dfe2
- MD5 7508a58a5031b7d1b8a734dd93b551c7
- SHA1 6b594af6a7115f9ac67eb3fad96529e60c2cad74
- SHA512 5eee7d18bec62e376addb6a6221584f16448df3b5634cabbff5d78c7436ae324c47566fd8fa7c20bc7f400a64fabbebe197714365b44462ee16425393d1e05d0
- SSDEEP 24576:xdewsAj+5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Plj+5SW6H8DS52tdDpbRZy
- TLSH T1C115E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E99342D26776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 5e278787c321a760b79211ccb164c374626a4bbb29318899d5b87789627a2f7b
- MD5 f5e7cdd6a4501107431cf21978e4d8f3
- SHA1 adecb86136db0239e33d54b4e8c2dab908db2dd7
- SHA512 2cd5368f39b42851b6d1906ca1e9808715e0bdaae11a33065e34995f7f835950bf428e0359258a9c5b8afefedc946e72875e08e1695b7401ab679d3e1b9f4f2f
- SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH8SintdDFRo:TUEtQevvqc2W1cpV2EI32ZedDFRo
- TLSH T106474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 19f2178acdbcca737aad3419bd0f221cd83175a12e0eaa543fb22aa1582fd5d6
- MD5 62720d2177183feacb0912b0c7c8c4f7
- SHA1 063e4dc56dd2f03ed7e3875efca614a970495950
- SHA512 f62176bb542bd3beb9d4bd583857c8e8d449bdebeee3c4bb178ca301299efd7b173f327f685971308188f15ee862ddfcfbf249a85184cd8dae33566c2761a671
- SSDEEP 49152:8CbRquA/m2yL5zLfFiV+XenmE3/ze5SW6H8DS52tdDpbRZy:1oq2Vjnmf5SSDntdDpbRZy
- TLSH T1B6D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 f49f94414cd3461cff7b5d101d05440351bf7d632f4172d2b4e242444a003603
- MD5 f6e339e5e541a582027d7aa89caea2de
- SHA1 becabdef769156795a054cd97df16a6a3ab1f32c
- SHA512 be4e2a567a098290365ed308c3f2935443b1b20492ddf3c2b3612d5bc37b1eff7e2c9657c53933bd55eb821d872825ed03fc3bbda7b16d4c16441690d3770323
- SSDEEP 24576:FAhGLJIFoiwtA5l7S53/5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:FAMyFoiq5P5SW6H8DS52tdDpbRZy
- TLSH T15935AE80E7F955D4F5B7AAB899B68170EA76BCAA5E30C21F1160D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 ba2b0e482d58c1e51d982892c3c43689d6ee78f072e0c055dc407c6ca4851753
- MD5 d321aabbb9060261202034eae5712fed
- SHA1 45ea8180fdfbcc2c1f7c0955e4347346148733e6
- SHA512 ae52896c9bf53d72b61dfa2aa4c5355977dbbe1a16a2e108da1c918c5a0c9cbd9a9d202a7c2b66e7625f01b34a152767093bb4f6a3edd6a9015357712ae7afb6
- SSDEEP 24576:fwuoOWy5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:fwDOj5SW6H8DS52tdDpbRZy
- TLSH T11405F14533A41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 6d003909604d722b315347afda9c0fa037bb99cb7df17c2d7d2045b1259a21d2
- MD5 a3782861568ec184ed76e8ac97625e3d
- SHA1 a09e9f63de8e7c349c5a67f198010a558312cf01
- SHA512 ec3c599f7f3e09ff21edb2c6a3198f1be80079c1be437c42cd49a56e0bc6ede9f9ebe374fff265d2ae1f0689ed2cba66c11365e7fb08f3c7040fb0ab77985fc9
- SSDEEP 12288:DBZ1Iyu5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6T:tZu15SSiVw6uAX8DS52tpz9ZRzbPmSZP
- TLSH T14CE4128923E030FBE25B42BAD9F54685D771B4A6533443DF0A60429B5F33AC74E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 4f369bf9f13879fb064be9b08b419428b36d5101a197e6609b52d1881e32a5eb
- MD5 58cbd09ce06448fe2770809f55ff23d6
- SHA1 a0f37bb4cbc1a65706f75e103d2b6a9e748962c3
- SHA512 7a9ba5de3c3f6d8e2cfcea8c3c5ed8be2e5aaeb19fa84ab4b9ce52e31214bcaee51091159b1d48b15d354755ee476b1dc7ed9dd12752cb17982c0f3181fbfd00
- SSDEEP 98304:9QRQyi36YOcPQLvw2gAf+PN305SSDntdDpbRZy:0QyiKayX+PNKSintdDFRo
- TLSH T120667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 ab2e3883b79eb49118fb369d019f741c6636f163bd78c76634f4ae1eb7e1626a
- MD5 26d25f3dcbb6c5228a03252c801c153f
- SHA1 4fb3457733d8a07051bc324b778c84c11e1ddf38
- SHA512 78a7f76d086a7307713ac97d4b2b1040c86a92dfe0abfc5af17740e40b51312698b9b83d69f77dfba79668f7fb33dcb328f4c6e0ca19b1fa4024bb02d6e9c71e
- SSDEEP 98304:WQRQyi36YOcPQLvw2gAf+PN305SSDntdDpbRZy:dQyiKayX+PNKSintdDFRo
- TLSH T1BC667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 d56680696ddfd6d725bc182c0a2c590846988201ccd11a0836bbb2f3589b08db
- MD5 5c6049cd248d4e655b9931a122c93616
- SHA1 0ac5c19997028cf5b6a267821636bf26811897f6
- SHA512 c9e717606f1bf3d35a214a7d1543bfe13a2424a4fb25a8ebf4c7737b5d4b17e34fc85a6cc0664ac6af662860733c9fb390c53bf832793ca1d5b840a7e6a400fc
- SSDEEP 49152:m68Qg55nhheWu7PNU3/O5SW6H8DS52tdDpbRZy:EthWRc/O5SSDntdDpbRZy
- TLSH T106B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 71d85f3d43632b7e3723a84214cdd8b6fbc5c020a14cefca5862a44ded811080
- MD5 3807b9c5a8ce5c2175b7ad24e17d4400
- SHA1 3555334d48c3926bc08db46e45ac305b1ad52f29
- SHA512 8f0f749b120bfdb621c4d96a434e1916ade1bfd72f2622678edeb1c549544358606849bf853f0caffa6d11bebd06e12ebba7de60bfd8d00519d161f061b5bb83
- SSDEEP 98304:Vy5112gYy5azzVvL69nLKnhZZ5SSDntdDpbRZy:4LIHmWh5SintdDFRo
- TLSH T19B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 d63eefa2e56fe96714f6e37f98dc546873f5c84e760084cb9e885ce68a8e7cc3
- MD5 0b88232dfa90bc16462fc3165c02e36c
- SHA1 0bf5c02bc6640f3eb3959f0e7050e9b20a15d34e
- SHA512 41b22ee7f305187cdf15b6d98f68847f6787dc5c8c4187a237e6d7f0bb523cb6b2829b4f9e2a482cfce06c2988d3bded3ea7c9dd6c5e090023cd992f17839236
- SSDEEP 49152:zB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gls5SW6H8DS52tdDpbRZy:Fu6JmVxd2ds5SSDntdDpbRZy
- TLSH T14FD59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 d4e45aba97b2f4eeca0fe0e5976e328a7fc03c92096092a10f05272064366ae2
- MD5 143e59afe90017d47789a4e7c0776710
- SHA1 a17eeb88559b14d95cd1f47da31d0cc87d23ca4e
- SHA512 8d989d106886b679490940aefcb75e320e36f62efa75f63a41d52af89412d4605598ac57fdd86a67fde9a0004378943da0828a43f47837b4c959b42451d88e8a
- SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xg5SW6H8DS52tdDpbRZy:SmifPbRf5SSDntdDpbRZy
- TLSH T148B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 4df8798a38536f8bba87cfcc167561614ec09316595cc6a66179d33f2fcceb5c
- MD5 43880f892e428074be4718c95a396295
- SHA1 2d61e856eab347a6d49b89212e070d21f1ccf5cc
- SHA512 2a4fba2e403a9a33b38db632b875c2785f6f74ebca85049838c5db000a427a5d08d02a5d9c6c19a550bd1884317d4a14a6f6f0d46ed93600c1b7e337edd04f97
- SSDEEP 49152:bSuZQIY0Be2KRRVtOnks6NMHq15SW6H8DS52tdDpbRZy:J5dKTi6115SSDntdDpbRZy
- TLSH T104C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 e0a47ea7047c31daaf088f1e46160556db17f0b287726c1219d032dd8eb0712b
- MD5 295631b62558258998a525b79779da2e
- SHA1 b8e2497b0b0b540655f1724c384ec92344e5486b
- SHA512 dc3d52ad66b1b3d2db94eeb6ef624f86205697949143c98499a3362e81a7ac777afe42acf701841220efb94a116e9915fa70a87be015bffdb7944d7b11628b50
- SSDEEP 49152:lhtSn8EApI0figngiDn0AP5wc5SW6H8DS52tdDpbRZy:UX2iyphD5SSDntdDpbRZy
- TLSH T1E095BE13F2D900E8D05ED175C7568632EA62BC160B38A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 85117d9f844c1ae499c3d1f3d673975446823ea1dcdaca400dda6f6ddfac4f45
- MD5 328fa42d32139728b1b87f65a326f2d2
- SHA1 cc3d6dd558820119ab9c996cdfa70fade6c2a71d
- SHA512 1351b4a692686fbd98e54d9958e172f7b48ff6f4783e430afcb03ba0f086e6c75976973e31e51d143301b3165f3e03cbdbae8ed9fc5a08f5b151a623f35ac3b5
- SSDEEP 12288:TR5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Y:TR5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T1B6C423C457A121EBE30E0AF3E2F686D4DA0CA5EFD408623B5F716147CB3598F467A429
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 e7431950e58be11551404ccffd794ed20350fb93276f3542c6bc58fb2ad06730
- MD5 c15cbcc4850bf5b089eeb24320bd0d9f
- SHA1 bd4c939894ea05df220d2bcb5b5d963e73d0e86c
- SHA512 105ff6c6195ded1412f1a1f588a2d13bfab4abd447f4184bc2b8ece2cfe6d633e1f4dffa0f11b01067efc793b67e83cc438924f6a2b8aab073494d53127a404f
- SSDEEP 12288:y65OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Y:y65SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T1E2C423C457A121E7E30E0AF3E2F686D4D90CE6EFD408623B5E719147CB3598F467A429
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 1e8c64f6df91035125a127c7f6cb9498c309084eec893c588baaa7be6f566af2
- MD5 5d00ffb968013c7108a003240ee1fa3e
- SHA1 159a087be3c4561f7a1b0719914721469108dce9
- SHA512 92a3dcd17ac14551d1ce5ea167530c9af488857a5340a83214ff346acb3ddeaaf8019354f67ab1a21418036e2511a03dcf1447353213a5dc9c8bb14f237d7c3b
- SSDEEP 12288:i45OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Z:i45SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T172C423C457A121EBE30E0AF3E2F686D4D90CA5EFD408623B5E716147CB35D8F867A429
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 a05177647abfe480977fe9426287257d039789b5b28d00cbdb8115b08eeb906e
- MD5 deee1ede5aa7a89038046653357b8787
- SHA1 0edd7a0c87defa6cdbd78186ffe382c28dbbb099
- SHA512 8a02e161a60eba28728bd65ead40240637c3900e2167f0cffd402886e5e9e4a3a7b08bc21b5252578f738676abd65330f982bed7bc03b3584a1e4ce42b6e86ab
- SSDEEP 12288:YVf5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6s:I5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T123D4238427A120E7E61E86F3D1F686D4D628F8EED524637F4F20054B8F31BCB9935A25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 130fbb04a205e8272999e531cb2016ea0a55f43dde737da02620cfd58e60da29
- MD5 6ad070042f82446fec9925913195e3c4
- SHA1 806921d35fd3dbe28ec6f5ecb97e63f1b2a6daad
- SHA512 9855c4c8165bc39da68c23794a3b05d774f11532dfd469db138d446c270c5ef82a711f8ac50b2ed0a1dea44b93ccbf98f2bf876620f49bc9e61329ff35963bce
- SSDEEP 12288:EH5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Z:EH5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T151C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E716147CB35D8F467A429
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 a93c868e8fc012a964689cc3e798c8b4e24def579dd42ba277c9d7f7dd1e76ad
- MD5 47d4cb89a0b1d060322fec2f484b49bd
- SHA1 6b889f7cd6f418a8d6f15b7ee09f1a371fd816b6
- SHA512 0943cc4fe8df2dbb3d1b45d7e611ec137d42c52b0ec4b8e46c78919cccc05ff9ee30f56fa4cdcc24278c1100527cc50fd7dda169a7f5f2b1c044a9498d412c3c
- SSDEEP 12288:v25OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6R:v25SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T116C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B5E719147CB35D8F467A429
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 1d3c54445235fed50a4f6ca766360e6f798f114a959aa52a72a7d60477449ee7
- MD5 cf5d2a390e5143142b7ac0c1b2c2ab43
- SHA1 8c93fcb540caf3897210cecf419576e823a4e06c
- SHA512 36b84c22a254febae46dbff3e5656b30565fbdf830f5ae318bdb57b59e6ceb72db5fb6fd1754b38293ec12b095a1c27ae6038b9369c29c34a921c388bbb673cb
- SSDEEP 12288:OC5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow65:OC5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T199C423C457A121EBE30E0AF3E2F686E4D90CA6EFD408623B5F719147CB3598F4676429
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 41a83ee84d5ff19591325101b8555d221a70ec03e74739907dc6a1835999ec44
- MD5 4156cf4f54ee928d3c3a8bec42d6cc74
- SHA1 c5e06f7102273fe3b774771ca13d9e455fafe396
- SHA512 07f9bd4b3fcf6505589ef571566eb1ce8e62cd26b2d2c2ef7210f413e86c36d5f2da5ad05e90c4ab0b47db3177576128e5fb33eb0d6658b6be67f5e3df3b8e65
- SSDEEP 24576:xZMSzFVSOa5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:xZMSzfm5SW6H8DS52tdDpbRZy
- TLSH T118050294B39018FAEC67823FC9658945D6B2BC5A0760C62F07B436675F333920D3EB69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 060300dc703a5f68ced44b085d1db460967339c56d7cef12e37636ea5bfe3685
- MD5 7fd3fe0552b79707bd98c396286d4449
- SHA1 a4b7651713a583d4724f140ab385688968f45c07
- SHA512 41054c1030aae954248ca64dd0b4dc346e8de6d4612827947c44ace732db56585848b928c32c92b6d423af9a6e8148c6a3418e92a319f0671ca890ee1e5b6c41
- SSDEEP 12288:ul5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow62:ul5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T1CAC423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B9E715147CB35D8F467A429
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 fa6aeff856189e5e17d4d82e22d47d0546ed8777eca4970b43c8b57272a95fdd
- MD5 6689466d401dcd34965192cc8ba9d09d
- SHA1 4581082d2e6c56c0d481c9b8d2f39c90ac21ee4b
- SHA512 060bea915104dcd5c9f05b0b6b28d3f2b231e199eb183b8f249ae657da6c14713f1e2c8b27c6669d338dc953ecc932e443473829a4723f44aa07c998ada2fc69
- SSDEEP 12288:dJ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow62:dJ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T130C423C457A121EBE30E0AF3E2F686D4D90CE6EFD408623B5E719147CB3598F467A429
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 46de248d3049f7c9a937bee0d58e628f64f78a55bbb0d72a003ef5e901dae311
- MD5 aaf146945747b2a792db88fc43cccf8a
- SHA1 baa70490db3c42c484b93349e8348c4096e171eb
- SHA512 1c985d8496cbdaa9aed8db3b1bf3fbe370b8739b42d4c50ac28cedcea783020dd591c1c457b0bea611c3cc5238aa82d572a842a0b807ef07486f970668b16f12
- SSDEEP 12288:dyPz5L8u5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6b:Uzyu5SSiVw6uAX8DS52tpz9ZRzbPmSZP
- TLSH T1D8F4024773A130FAD12B4276C8A20A41F775B87647249ABF1BA043775F376D19E3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 e82099f055bd58957b80f88825f1f613e982af196b6cb9161e680aa1d0004830
- MD5 9cdea8da7a18a50ac065fe7e2fbe1d88
- SHA1 9c2f9601272cdbfa312af2ad5b4805f74ab18a56
- SHA512 2d724476f3a90eff6f15dfdd4c5f78c52d07895c543fbfe690396485db58737af36f5adec35260af9d99a5947eef164672746fd62654bc13fad87c85d5aaddf2
- SSDEEP 12288:7l5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow69:7l5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T102C423C457A121EBE30E0AF3E2F686D4D90CE6EFD408623B9E715147CB3598F467A429
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 4a0992e18307785dbb3c9d12e6cf1d1510fe039c8595aa8427593f5590ea92cb
- MD5 2f5ca71009f0e6c4be6b7668168b32df
- SHA1 6d89883ea0d10057acc768d42d16589e44596e32
- SHA512 6aba8a925f7d6eef0c2b62010ed264ad745a80b1800972fced3dc272017de6ac32d708f94aabe72eb2d170bf9d824366a058821532f6520c979befbfaedd9bc6
- SSDEEP 12288:6l5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6H:6l5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T1A9C423C457A121EBE30E0AF3E2F686D4D90CA6EFD408623B9E715147CB3598F467A429
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 1c6755fe11af9e44deea7a471e1c4e155244de46282be747c8aa9059aeeb5a71
- MD5 af1f469610e8e6dc241f8106cfd7b946
- SHA1 d53c73d0f43f03ac23326be1fa7d1d376f4e4e51
- SHA512 c7c91f91ddf3e34bf3928e9bff546a19c0f0527f992db45241c9d29672d420eee5515af181836edaa161b61a64c454f16c4b5b3599efd9b0d5dbce586ec1261b
- SSDEEP 12288:NyPz5L8u5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Z:kzyu5SSiVw6uAX8DS52tpz9ZRzbPmSZP
- TLSH T1E5F4024773A130FAD12B8275C8A20A41F775B87647249ABF1BA043775F376D19E3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 4c47b372515bd389e198d2e26ca6e45e97c7f3d6df4db66ba8b69deaa8ee5ae9
- MD5 e88a95c459abb572b9b83c0e27744a8e
- SHA1 6e309a1a95322cbc7cb0c82cda1728c5bdcc56a2
- SHA512 fc12e1cdf47c28dc62a23423ec5a70d28a5346552bb2c980e96f21ad4d9f5d134f1a554351287b200f91823dc3a955bdb3e26a896b1bdce4a28e7222fecb61ed
- SSDEEP 24576:KcP4mcvIjkGOxhKP2l71nNKbrh/8KBN5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:VP4m4IpOO67W8K75SW6H8DS52tdDpbRo
- TLSH T1EE65BE2DABDC0096D0BA917886658A49FAB1742E1F3286CB1160933D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 b6cfb91163df1074924496db09e9217824d3ee88121ec3b6d44bf037833ac60f
- MD5 fe9ead6348871d55703dc9e829c283ba
- SHA1 9b460e7c49138593cd9d8c368b55c9bd76740a69
- SHA512 8c6316810e7552799fe33ec5cf19fb8ccf34b4181117e43587e52d6bef7373505617394011a710d378ca08e395ac37b1f93f0fd377d07142a0d030f57d276d67
- SSDEEP 12288:iNsf15OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6S:715SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T1BDE4F149D29412EAC02E5276C7A64680F3277C6983E0D3DB5BD0F53E0F366859DFAA13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 b8ffaf4d789729e7ea47997a04dddb23a5cc7dd028585274da70d6543baeb907
- MD5 a20dd2faf31b87be8869f3ca314a9a93
- SHA1 2ccb45d8e92de1cdb5c42ed1406caff4f79af635
- SHA512 ab28878297ed315773be5596deaa10d70cd925eb0a90e93195faf993b47f1c111a6d2cdf66d9a497d5bd62495dc5ba4488987ce8ef8f153bcf34f1701d59e37b
- SSDEEP 12288:UV5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6b:UV5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T1EED4238453E46597F22E0BF3A1F6C2B4E60CF6BE8904913BAE6152478734DCBCD3651A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 7c7769f6ca0050159e6460a386f88c9a4a9a17a91382c6b1722387707ed6a34f
- MD5 b4de5d150374a7eeaab7a901858c6306
- SHA1 3d5078c9821fc7d2da890933be65b43c07c4bdee
- SHA512 4bba53e53dfed75c3c5f7623b4246000b36c37e1df36e2642ae8820adcfafa49f6c2078ccc64a94006cf6bdffc474835119f559d46e8680553e25269d943ffd7
- SSDEEP 49152:ja0h2GEkuAe73q3pp46zwwQH5SW6H8DS52tdDpbRZy:ja0hNYG4JwG5SSDntdDpbRZy
- TLSH T1FB85AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 15d5bfd338c32c0d98e5e9c2067f5323acef09c453bace7ff21df09a6717b51d
- MD5 d32ca40af5df3c85de43c55bd21d5877
- SHA1 7dfd067a013f29526af2f8360dea77d2f62f1cc3
- SHA512 408400dda87925c05deb70244040318a80ef2cb67a44676a00c329d69ee8a3140459baf942ea0b6e28989594f3b13ee7a6801682013a53b0e332738ddfc3f7fc
- SSDEEP 12288:rhbHjfXK5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6p:rhbHjPK5SSiVw6uAX8DS52tpz9ZRzbP/
- TLSH T131E412AD13AC20DBF13592BE91A68646C730B86A1710A3FF1BD1827A4F37ED94D35E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 a38f14ab7b389ea6657b3747521398328d7574ea88b13127ca9eeab21ea785e3
- MD5 ad5ad1e811d8a33d4ca69b8432d3cae1
- SHA1 c7203220f6427e9f3ab2770203283718dde0e7e5
- SHA512 6aba000402c4575a71431f87a72115b77b975a465ee4f41de66a679af90dce1160848599bee89c4d1e05790c1ba6944217065c0c0ef9118a53a3c37d605e55ee
- SSDEEP 24576:23YgnJcRTk4yti+R5dBR/y5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:2IgnaTk46pBR/y5SW6H8DS52tdDpbRZy
- TLSH T16C45BF2DF3B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 82e43723b3cb44f2d2ea6a4f6c618fe1b2500ccf1a054c6c674576dd4ec225be
- MD5 0bae379962364dc0b8bf144a6b10872d
- SHA1 613b38914cf37d8b92b71d5826cb82aeaf176bfc
- SHA512 194e1aa5e814630b8667aee1a0de1d3812bbb594a14e727a79feef85babac8762f3fdefd91b356557ca8343be0488da55328916389402b42dbd13f3dc2b16fab
- SSDEEP 12288:a55OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6B:a55SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T1CAC423C4539125ABE20E0AF3E1F686E4D90CB2AE861822FB5D71A147CB35DCF8636425
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 565984d618c85cbaa4431a7c54697e2514586600f54bb35acc1c1d4275ac8eaa
- MD5 1efb771be3cf502fee6252f8267ddf91
- SHA1 c149c4cd0114ff4c993000668cff4f977a898d9a
- SHA512 69076f44b1b91b3545e398c047509e1ca6ee4173125fe59b6ea880c7a24442aac3047cde7cebde0084212a3eb0105c7fd7a327c2c2674a7be96ca91bf2b7fe09
- SSDEEP 24576:GpL3UTc5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:GpL3UA5SW6H8DS52tdDpbRZy
- TLSH T121250254F7A400FAE96B813DC5B68616D272B49D0324E7EF07A84B561F237E64E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 7f2afb387ac1b71b5ab220bedc8e923023389909e5d585439621f7521ac45abd
- MD5 454108293065cf766a23694522548fa2
- SHA1 5a0120f6ad69b2c6ed15143d3789d68a9f8a55f2
- SHA512 14b943bf2e7206aaaf0f098e028c210a8aa63d8ed6955b1dfee5db7bb6251bd00d193d6b336b20f5dbbaf93292002d73af5a81926f0644e38293966716ede789
- SSDEEP 12288:+pFtpOg5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6P:UOg5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T15EE4025933EC20E6E13A517E95A2834DD771B4A6071053FF0AA081AF4F77FE95C3AA21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 e1f02fbb9afcefb17081df717b79fe33f90d745c33811a37b0132564f8ed69ea
- MD5 9dd22d5888a2e06d3aae2f6946b1b0b6
- SHA1 adb3e10e78c503b14bf650824a5ba741c44d831c
- SHA512 4fdb2cec32171a3e121470cd08443e9edc733ca6aef27f402fdeac33c56dd96f739a3ca3a726aed91b249cbb122f1f95c4174668fd7eed107192565154b3db4b
- SSDEEP 24576:47NM9YqZqmWMUkPjZM48Mv6bEhsl5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:47cBWMpPjN8DbEhq5SW6H8DS52tdDpbK
- TLSH T13A65AE2E6BAC81E5D477D13DC9E28205F6B1B4611B318ADF1162833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 c492b1769f20df8372ddd476b160126586c9c93c454098b1bb21fee7e508fd6c
- MD5 acff9ce91b64fc78fc1200a2e6ef3df8
- SHA1 1fcb0e2b80326467529b6d5cd4076b74ba608b31
- SHA512 e502653eebdd326a78c941655751b67662e517262d636b8ac591e34b353c5cd54e27f7fbb740172912fa827014e92c3e717a2b77651e31f82b24292a8293d048
- SSDEEP 49152:IF2YuHNETovAvNYf8kmF5SW6H8DS52tdDpbRZy:N6BCf8kg5SSDntdDpbRZy
- TLSH T1E1858E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 1d809fcb2a443de4549b3d88b27f1f7cc1249d5882fd2d1518f33284eb11d6f8
- MD5 4cbd0d2b23f1355859218c3ce507820b
- SHA1 b38a1f6e087b55bc6e334af7828e68668c6965bf
- SHA512 85d1ff1354e56938b504006ccb0b3b52228d82180d5b301b2fe730308a089fe883b0d90b643888d0d6d19d15cec95f7e86c3d570a91cb70bf9996fa56f576e6f
- SSDEEP 24576:mAFs06+Omlf3NXEbToU5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:PFs060lVXun5SW6H8DS52tdDpbRZy
- TLSH T1DD65AF2F62EC00D5D07ED17E8997C91AF6B1746707255ACB0260863E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 6392f805dcb95e081cb4e7f2c96b5a179217cf2b70628f6d5e32d2265da54597
- MD5 2e52538e1a39a0202de1415bbb3cc6d7
- SHA1 93f260e1b250c59ea6fd768d80fe880cbd6ed185
- SHA512 b69a0383c73a51c24f96ecacdeb6b6dc2a81d928dbe1a36481693cb6605a2ea42d74f6c600e260f41024298d059f51fde636628c883d52383b64cfae4a78b715
- SSDEEP 24576:kJnJ5D3WXn5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:kJnJ5DGXn5SW6H8DS52tdDpbRZy
- TLSH T1FB15E02CD2A810E9D0B7C2B4819A1795FF72347D2F216ACB28B4D5357F12EE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 3fc5318b7c6e0aa41883bc8877d4f1f800121166d31e4cfca0f7358cbc854fe5
- MD5 e6fe83c0ab0565657a1fd5bd831af59b
- SHA1 6d9303f8f631088940c5362161e8965af68c8f68
- SHA512 28ffae33b9d8e55229e6467d474c93ef4e30a84701318820490f43b9b88bb652360a69b4770e98e78986b0eb0e450a6eb0ed325d6bba0154779d18e2ac685130
- SSDEEP 49152:vg06DIKdwc+eQnSt65aVR5SW6H8DS52tdDpbRZy:oz5SSDntdDpbRZy
- TLSH T127956C05B7EA5295E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 4a378898142741f9a0a30fe4a360e37eb34bb366cccbcc1298805a84e59d5680
- MD5 d692b85551d8cfa172f91340d0357fdb
- SHA1 e114dab4b06cef19eb0bf06ce7fc58a4bbb5ae4f
- SHA512 5ab6c3a3f54cb3de7572fa42ed0afd7e77ea2a46c0100f066787978ce24412912fbd57fe99ac6f4da6d82f343f75c18d65eb1cc791509b4b91329a89396e4356
- SSDEEP 12288:MEP3Rnr5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6Y:Hnr5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T16EE4129C27AC70EBD12A917E91A18644D371F0B5571027FF0AA1C27F8F37AEA1D39A10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 1f5787668513909fe264bc51b66db329fbbca1c5704bd83ecf7328b4665c8db8
- MD5 9574b11cea2c260a1c0f987352683012
- SHA1 dd6567ed378e7648fa1288e08fe481d181c86fb3
- SHA512 84fd13583a3e60b3d93a2c32820e7bda9df6e3479c5f8d248834c104109e1cd86551754b3074c57c25fbaa2a4046ed956424df59854a18c5e166f905621be1c0
- SSDEEP 12288:8jky65OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6i:8Iy65SSiVw6uAX8DS52tpz9ZRzbPmSZP
- TLSH T1E0F41244239420D7E66E0676D6B382E4CA38FC705B2053FF5990E22F9F36BD69935B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 a975d2dc7c94a86701291f2a51b670e05a071b0fc4ddd6d4290721998db991e6
- MD5 c71370d1e66aed3d3e13bad49553fc70
- SHA1 4fc5e8b3247b2aa67020a19ed815d33dd73f7c6f
- SHA512 84348f5d80407b994872461585960bb178c9c822222137c99e29ac5256ffceec4aa51eb311a5cb99435985d96b06c924e9cd839853d338253154db683bea022f
- SSDEEP 12288:nyQ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6U:yQ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T1A3D4238813A130ABE60E0AF3E2B68AD4D618B1BE571461FF1DF0E167CB359CB8576C15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 ba0a5dd831e0cdbda77b94b27d8248b1edd1376b7c5871d43c83f71e62e02dfe
- MD5 0fa2697f109558a4051fdbe87daa9b79
- SHA1 f6eb4de01162df63aa5411f35ee8a82e5d215aa0
- SHA512 013c52657235c2f00dec64fd41db292e61b4a8d9af7828c00a829cdd2ff85e271a72cd7d22a61112a0a85f571d4a581885087b40aec2b22e505c8aec79287521
- SSDEEP 24576:WQ9MxZKdcz9dw3d5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:WVKZd5SW6H8DS52tdDpbRZy
- TLSH T1F3558C2DABE9059AE177D275D5A240C3A633B4311B31D6CF2448D03D4E7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 8c417adf71266c98c57816135cdc33f7572a1e5b03ef9a84ad289677b6a09559
- MD5 3df57b7769cb616fe5195ea0fc593943
- SHA1 25553662a3ad00df7303dbeb7444c85a8822449d
- SHA512 c720e1fd71d5cef813d1cfe2ed9f6389249658f1a714f98af861d80bcfe7fd67525d7333e6df6c1b0601932e3af898a3360fd3540c3e8dfa3964a82d63c10725
- SSDEEP 24576:VyocDAp+5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:oocDAp+5SW6H8DS52tdDpbRZy
- TLSH T1E2F4E05FB7A940E2E126823C89858345E773B0745B2163DB5A91C33E8F27AEDBD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 359cc81a6b0e00a7126c6efe3daab4f971d6420b334a29755852a30ea7dd9fd3
- MD5 b1dcc45ebce25f30199f36aa6d18a69a
- SHA1 8f1864e39359b3c608fe09d2d12e13fa966ae42f
- SHA512 842580d3995ba434d47cb7a6ac33a33868be78c1d3ca1ed16240f12c11c5410088c86613112575f2d073955b283a74899a54af5c5108fe139fd6c036f0903874
- SSDEEP 49152:6WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK+5SW6H8DS52tdDpbRZy:80zuNIc5SSDntdDpbRZy
- TLSH T150A57C3DA2F800A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 00d54ac4cb31ad9bd6c519197232dd0178016bb0eee9c2b97a866f00a1ab78fd
- MD5 68e9c25d0adf287426ecc59ce5af93f2
- SHA1 de83aecf04a1e76bf64bd0a3011bbbe0d76a47e7
- SHA512 3b484fc55adc8ff58f2b6fda77e1fed7b4aa1da3c5a155c29c626a8c4dd634e56a489dfb40b6d2d243d9f8a04616968c406a09a2ef3104e353f9965d4ef272b1
- SSDEEP 24576:R1QT7EcpfxR+N5AWAz3ooiYtjMqbr5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:0TDxR+N5YzTfjMA5SW6H8DS52tdDpbRo
- TLSH T1ED55B02EA7F815E9D17E85799A23C512FA727821033193DB42A0C17E1F3B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 c66273f5b19d31a9e17cb47e6a3224b271efa066b07dc81c3011e95654432067
- MD5 c6d3234c2419a0a5a1babff13e01ca90
- SHA1 d3e84f4164a284ea952bf65c30f04509fa59e03e
- SHA512 151d2c668fc115c43a5a85ec67b7026bded5616397820d9d9d2fa95ba0b248eeec9fd9f95d3168a8c822fd2fe2336131d7a7bb4267b1b257593991611fdb84c0
- SSDEEP 24576:4TMdOz0FFS+imSLf5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Q0K+imSLf5SW6H8DS52tdDpbRZy
- TLSH T1C915F17E63AD14E6E53FC27DD6538906E6723466032166DB06E0C17A2F5BFE4393AB00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 061c41a9d88dfd529bca35e12002a1fed88f568b3ccb49ffd3a1d209c379bb62
- MD5 6bb85c25e5ff888e83006a59f214edc2
- SHA1 c30035b2e3631910cb5e4c27cca87eab05370f65
- SHA512 440a38479e56cfa2a98b546b2d45404c777dfc5716b1a1de48633621b83ca794469e95778792be7da4ffb6c8cb3bbe97f8db0351a5afad9ee72f0ad5a733f7e7
- SSDEEP 12288:w4Kc5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6B:mc5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
- TLSH T11BD4124C13E430E7F12A56B6D6B64295C630F87A131466FF2DE0C57B8F36ACA8539B12
- MD5 SHA1 SHA512 SSDEEP TLSH