ec1376b4ad66b8bf0a9b015d1eb20a5dc3c7a777e48bf22064f8430f8e7d9c0b

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 2.0MB
Sample260910-fbffkszzcz
SHA256 ec1376b4ad66b8bf0a9b015d1eb20a5dc3c7a777e48bf22064f8430f8e7d9c0b
MD5 7b3ecdccc65738283093cd3ba53c1c0e
SHA1 f2a8bf4033c7d3cc3951a54b096c680dd552fba0
SHA512 bbd610dd9bfc1d76ffc23e60fab543f2a8c766c8807e7417f19665820a62487f813c6bb976a86066ec9243a7bed0e1990060e000b5dfcf1910f6d3e3ce34de5b
SSDEEP 49152:MJ0kHCMIX0z96GhH9hi3ZFfDuYkjsl82ot4+Ej2Ez+lneVqGhiw52LlOpbeZB7m:hAYkjsl82ot4+Ej2Ez+lneVq8ycv
TLSH
T107A5CF60B9458427CCD162F29B5C7766445CE8A4473598C7E3C81EDFA3A43D2AE32CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4524	alg.exe
5924	DiagnosticsHub.StandardCollector.Service.exe
4104	fxssvc.exe
1292	elevation_service.exe
1484	elevation_service.exe
3688	maintenanceservice.exe
3712	msdtc.exe
4808	OSE.EXE
3808	PerceptionSimulationService.exe
4396	perfhost.exe
5976	locator.exe
4960	SensorDataService.exe
1704	snmptrap.exe
2496	spectrum.exe
3140	ssh-agent.exe
2076	TieringEngineService.exe
5824	AgentService.exe
3284	vds.exe
3452	vssvc.exe
4364	wbengine.exe
5508	WmiApSrv.exe
220	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a6e43a945a3b5d25.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfb50ab8de40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c10854bede40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073e60ebede40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054200abede40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a52fc3b7de40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9d01abede40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035cd58bede40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c218eeb7de40dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077cda1b7de40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f3f14b8de40dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeAuditPrivilege	4104	fxssvc.exe
Token: SeRestorePrivilege	2076	TieringEngineService.exe
Token: SeManageVolumePrivilege	2076	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5824	AgentService.exe
Token: SeBackupPrivilege	3452	vssvc.exe
Token: SeRestorePrivilege	3452	vssvc.exe
Token: SeAuditPrivilege	3452	vssvc.exe
Token: SeBackupPrivilege	4364	wbengine.exe
Token: SeRestorePrivilege	4364	wbengine.exe
Token: SeSecurityPrivilege	4364	wbengine.exe
Token: 33	220	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	220	SearchIndexer.exe
Token: SeDebugPrivilege	1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1748	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4524	alg.exe
Token: SeDebugPrivilege	4524	alg.exe
Token: SeDebugPrivilege	4524	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 2092	220	SearchIndexer.exe	111
PID 220 wrote to memory of 2664	220	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3580

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1484

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3688

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3712

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4808

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3808

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5976

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4960

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1704

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2496

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5320

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5824

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3284

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5508

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2092
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a05b50631dacc676ce17d1bcbe65dc9cf7704e522fcf3c0f863e3a292dd2dd37
MD5 35000c48ce008ae4bb6e1eaf83cf2a74
SHA1 c44ec4592e56a958950fae7f52b743678f534f7e
SHA512 67b801e0aabe7dc8ed7c79dc2a758a03bfc925591e9599f8976366ec2a6f3c87b92266fcac4c5abffa117415a244736994db971a718155baf87286c03f132495
SSDEEP 49152:gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnq2LlOpbeZB7m:K3q6sjBfycv
TLSH
T1E1D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 9911274936b21bed3cc4958bfb9c492219730ba208df626f4172d509484c5064
MD5 fcccc831b60aa0353821201f8f0a5324
SHA1 88233a9f048e22c27402419c1be750432175795a
SHA512 9464cb295e845bfd373799c9914f07d9d9800d8228c0df07dfa412c69c389943b86679bcdb19c65d471b8204c74b4a04985713f0054b193243a2278790a8c040
SSDEEP 24576:YXYfDtczAD22C9+bmOmbTk3reZCIT59z7m:PtcQ2LlOpbeZB7m
TLSH
T1B775016467D408F9DC6B823CC9A28411E633BC9587A0E7DB03E489661F737D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 031af0ac3a513d6e47632b06c2f3670ee0096c5658edd9283ddfd2c1ea7ce001
MD5 e189ca7ea84576ca5143420d1b1b7234
SHA1 757bc9e02946f4239a2d871783735202645c7328
SHA512 c1dce29ea13ce379cf2332b66b454a76645b879ef1884324d8b0f9102107c4d36156ba2e20e08725b85bbbc6952f6264ac3282a274e9d3ce942894e6d4b9902d
SSDEEP 24576:s0Le5ji0hmxxrMS22C9+bmOmbTk3reZCIT59z7m:sPji0AjV2LlOpbeZB7m
TLSH
T18995AE56F6748371D073C0B9C5D2A69EE97130865B308ACB4286C77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 56c37c4096c79252835fb9be5815b3243afbea8d22f07f3ff3c0f5a7d2c62e97
MD5 7fb4edaadcf63d8d7f10d9add1e123e1
SHA1 80d6ad70627f7d3d28eeff281aa3ca7c93545c23
SHA512 b2f13efb229036292c045cdcd55cb0b8aec6b9649951c45e8fb394a48b7befb65f3a2e08b46137fff25221ab190df18e7cc77e52ddcfcddf3dbe1149a72edfbf
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWn6q8wyug22C9+bmOmbTk3reZCIT59z7m:P/ezSC6vUzPveHjyZ2LlOpbeZB7m
TLSH
T121755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bc1e7b75deecafb5ba649a83a8e7c859849b573aee6592828ddbe93f8b744a10
MD5 b1c98a56e3ee44ff90f14e169f99bcf6
SHA1 deba1563a1017a6427c483da3e7790dd918d9f8b
SHA512 8e9832d6cbf856daf9a7b6e9c0af24d71d3e757ae1c461c5ad9805d13ac0baaf3394f17cdc7ae2057529a492daa04f131e081b60e1ed06c204995d4c0dbf3a58
SSDEEP 24576:xVbqPb88hv/l+Yv22C9+bmOmbTk3reZCIT59z7m:xVO88hXl+Y2LlOpbeZB7m
TLSH
T1EC559E66F6B48331D073C0B9C5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 4ded4451b41111bf991f09aa341b4f3daa4d42cc46a8d16e8aedab6db27929c9
MD5 dad7d4f24170e03240d8b61b4332c089
SHA1 21e95dcfbcc7830c30f34658705be5e125992eb7
SHA512 1d44f1bfe10c59e0fb15c930a4c39fe1632127f28900a9329016f6e44dc398af32317f85ea4640bf4345795675704928fd586ff13140f9510839ff6b51976d2f
SSDEEP 12288:1LfW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:1Lu22C9+bmOmbTk3reZCIT59z7m
TLSH
T1005523C18FD8C8FAC6BF1230569164F52635EED8DDC6B55B81891ECF18F1AB8D44A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 e2c55be5ff46239c36a6ae117cdc2e577b471964641b470b15daeb5a1d3d5f12
MD5 cf6732714d785b0c1f532a625e6f7f5b
SHA1 275840d5af5cde65b4c77d8e736d22dcfe05c743
SHA512 3b5599d6928bcca4119faead3d258c534edfc3b1ece36521cf0a0334c00475250f8264be038dbe6361eadc78e405fe6430b99f20c70d5c51e0995e20f7a98642
SSDEEP 12288:EeBNUbTVO86U0W22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:EJIU322C9+bmOmbTk3reZCIT59z7m
TLSH
T11675CF7BEE28FCE2C27E4D7857918640E77278708F52A3CBD165820E9E235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 24a7f2cc016b0805e0af259158af6b1d7c7cc3a0365da13a8674cb558ef2f44e
MD5 cc1f9ec12efb40bb5c5e953dbf24b590
SHA1 541140a9a6e4c897d3830938e8f36c78c55073a3
SHA512 460f99cdd70c1f59548d3a96e34425c2dcb82c2a729d4b3db91486168a4db8a4705daf99efb30eb2e0651f6518dafd58acba924e153db73016bea015b648f2c8
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THl:VQvGAdlCEL8c/DRNw5Cwycv
TLSH
T1B5266C656BF880F5E0A7E134897AC5B2F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 8355c1e9fd58601616d4a3b0048482de2473475a170d409ee1ef4d6a40dda798
MD5 ea171fc7ef15147363f6a571e5a6b721
SHA1 0f8be38f34cfc3c3298cc25bcb3b58156573257e
SHA512 15387a55fa7cf113e8a0a106cce1d177e9adf2d1c3b777c2a02e460231008a4e0396a1cc50f634e385fd34e328a8236618247c79f3a69598959356c755cc814d
SSDEEP 24576:R0ewsAjl22C9+bmOmbTk3reZCIT59z7m:qljl2LlOpbeZB7m
TLSH
T17585E071FE74D436C2BF0DB11B26C716143DBA604F922AC3E3A84E9E59702D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 619f2e0d35e4baf40151cd476a0dc32096f070b52fc0514fa6e7b9d22d0d47d0
MD5 d4df2228d9d8225deed59850662fba3d
SHA1 0a1127127cf85a950b655b16fe59785f0defedde
SHA512 bd9d02b93c5612dc3f23d9d5587b747ffee37c8a12f70bf7f68717ebf94f32e6889bacd85e4293c8cba0a7dd67540d80b06de8cebfedd7c41928dce144cd4152
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHTv:2UEtQevvqc2W1cpV2tI32T
TLSH
T1A9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 011d8508d830e3b917664eed54b92376d7acaeadac4b359ff539b31494b297fb
MD5 57e732ad1bfe50ade7d81e34fe9d86b1
SHA1 22c6788a59a138cb90845b0b32326c26a38f2abc
SHA512 032ae6f62638e566e5a6650b28d26a059659d7ab66a2b9a6d077e91f47e3fca5962f31e8fee54ba96eb737f24b94a415e1f383bb01d43e8f48e5a233e8c108e8
SSDEEP 49152:dCbRquA/m2yL5zTfFiV+XenmE3/zF2LlOpbeZB7m:aoquVjnmUycv
TLSH
T12AD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dfc6f3534b9f0174c83dff4d073ea7d403070cfe983f72a034e09c197e92425c
MD5 5d0aa34e3b78436faff93ff1bc471aa7
SHA1 e76146e69ae7ff87029c6abfc459784c21953edc
SHA512 5d581f1fa8d8e5c31baa353d3bfc14a21dacbbc37a43bf148938491c4e619031aee12ff0bc60bee6f67b0262f6f29907f9796ac6082c2a3ed1880eebd9ace33e
SSDEEP 24576:3AhGL3IFoiwtA5l7S53022C9+bmOmbTk3reZCIT59z7m:3AMUFoiq5k2LlOpbeZB7m
TLSH
T13635AD81EBF945D4F5B7AA7899B69171EA76BCAA5E31C20F2150C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7eb057cc7c7da5f039d56094837fe5b428ba04864dbd27ff34d34b27a0d72e3a
MD5 7336a476db2ff7ff7267fcb3f5d6c3ee
SHA1 d918cfa00c2681b8e0005d130ecab6d4d19b6028
SHA512 c8f8ff0aecdb049e909f20dcb544171e0a4af7a13e219313a499ca68e8f47b12fc8ad0a5ebc435cb60e5ba5075abcb09a870198d8104da309e19a6b016245861
SSDEEP 12288:6mw5HEjsChNVBFgl0WDm+ChW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+1i:Twu4OW522C9+bmOmbTk3reZCIT59z7m
TLSH
T12375F18677E80CF9E96B823885578136F7B2BC152A65D71F0360CA5B2F73361AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 01a17b5a9b428cfec820d498355967858e54fe49cca7418c43a78c650f3dbbaf
MD5 8b30155f9aa31408daa9700925fe76cd
SHA1 35aec6023b8f06876b86d257221a3e04fc4bbd06
SHA512 9ab3fb4faab1cf8a2202cbe24a89386d011fb8fe53d287d2e16cb6610c3732b3b85192d9f3d0001c38c7c980b0c621e1d77411b31f8f3dc7576a7851533f11d2
SSDEEP 12288:8eZ1IyCW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:lZu622C9+bmOmbTk3reZCIT59z7m
TLSH
T1226512C527E860F9C1BB4238C9E15545E372B896ABB253CF02540A9A1F73FE59D39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 46d23a9ad1084cd4473e06b9619f47ae1e3cbc7bd4825bfd2d3084c76efdef64
MD5 4b0b9a8d45c1f6701820ab42b9ebe21f
SHA1 ae3076b787d0fdf917ca0fe4d9f04b5cc758d416
SHA512 9f62ccf7e2f1b8c43bd2b6cb18f5369a6ea650f34f3d3c3da1b27a9f02d7d8d7ebaeb96a86991b4c83eba6d26fbc514f1ab1fec2c7a90f0a1179d0a95ffad55d
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:TQRQyi36YOcPbLvw2gAf+PN3rycv
TLSH
T128667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 89d1c18201fe4f25a61e4e39111b06603a41fbf81f179c2163bb50b2c460171a
MD5 65fc81dbac5df2e2bf0946b3d7485895
SHA1 35732ea69715669815fe8559785500a8c211d30a
SHA512 2ad06624e32c0a4ca2e08e0d5de1248fff6699a67bbb1644b0636fe2bfc9e4b0c5d9df2e3d2fcac13d2f5d90ef87e38d55550f82fb86b0e668835abc9e29683c
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:cQRQyi36YOcPbLvw2gAf+PN3rycv
TLSH
T162667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e7523480cd7f1d53786165bf08d30d446e40993bdf415da5a5b3bc7188013c2b
MD5 fd881e5e768d6abb306831c358656a69
SHA1 9147527c14ebaf0656bad3b55dd73e8b1ec19af2
SHA512 5119ecf701bc58d9f9b2c6ec206c200e88cf24dcd2799320d790e89ec5dd539d071f44d54e533a34bde345a7fb4c5c958d3c9cc4061ba6e497d7e70e08dfac19
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0q22C9+bmOmbTk3p:/68Qg55nhceWu7PNU3/V2LlOpbeZB7m
TLSH
T17AB54933B2F600A9C44DE1769F46973196D27C758FE1E3DB8105720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c17a4dfbbd885abe72c770af606c432ee91c50143568f4e94850761fb858840d
MD5 e9ea812f71762a90bb8624dc48da3648
SHA1 8f49e1d4f606a4542298fcdc9ccc1cf0c4ca51d4
SHA512 984b8236596eee92f3e072452ec6ccfad79c4767bb8ac3f6f14c0b25e383651308f615d5f3f8e53356086e114cfc0ed5ace10a12363256d162a053e12180a460
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99L:0y5112gYy5azzVvt69nLKnhZuycv
TLSH
T10C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9cdcbc2edaa82b71a7f9617211cc8aaa20998d06a5d2557e27fc66e29b0b4a14
MD5 1d07d957c89ab7d4a203e3951935599a
SHA1 dbcdd702edfa722573380aa30b77ee7df4195276
SHA512 aa2b252f01be36fda30bc8b6bc4b625e86972b44b76bd7464ff9360da3237a064539938de74916cf1a4b6fdb4f68cdaedf2bfef2892ccc2648c101869c8330c0
SSDEEP 49152:AB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glz2LlOpbeZB7m:au6Jmdxd2dzycv
TLSH
T148D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a65984ce5479b64b777dfc737c4a3317c2a407171e8c510f4f0825bff505851d
MD5 bc791b5727046217f662f8b37da030fb
SHA1 4edbd2d1db0d7255ecfd5713d004c34ac59f1143
SHA512 0eae63a301d6697971388361fe5ad652b911d89704302c3c50e582ffeb7f5d5fe27d4c3291d54f843fdd897e4a57615995853ce572b7e13e10aa9386e8654933
SSDEEP 49152:m1hpsNoJpF1A63U44CwH7R4xX2LlOpbeZB7m:mmifPWRUycv
TLSH
T167B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a65dc69a07be0b9448092511a2f24604584fb1b9995b21471af2634a15e55fce
MD5 7d650024587ee9d499bf2fffe6e99f78
SHA1 ae27fb141a9582bca9eea2efc8e6af037ef0e687
SHA512 789fa24cd2c79d755dc832c8f031ac8ae759d55c9b438c1215e2a8b91618fac511166fa3105314f5b111e36565cae0bc1e2d0dd221c89db0b38e03f24d9b38a4
SSDEEP 49152:WSuZQIY0Be2KcRVtOnks6NMHq62LlOpbeZB7m:45dKii616ycv
TLSH
T1C7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c633123124390fa7223be0fbce9bdd88f1f9c160f401ee4f5f6071cca94fec6d
MD5 d97312bff39069a7b906bf6e1ba93c39
SHA1 aa0032cda48c96e535e6c8c09c42a911320f2fee
SHA512 8a86712620f3eb31c86e47a9b6878cd4d4f14f67c4b19875548cdfd5c9d1894db45e5e50a177fe21da7ab20f77649e51205b060ac3d8d3016f8f8273dd0476c7
SSDEEP 49152:uhtSn8EApI0fig3giDn0AP5wD2LlOpbeZB7m:vX2imphoycv
TLSH
T13A95BE13F2D900E8D06ED178C7568632EA62BC150B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 030a16acb08abee5f2718bead2b8dfd90d6a3cc2d76900266ce1f483797ffa24
MD5 e298163dad027c3b2b6d5db31f1489ed
SHA1 63f9e9470136d4eb1f33c03b431d6a582051c06f
SHA512 22991ea98063d9031dc69bc9da6d2d553bc7008492b2d15ae05564fec88d120def3c72e4ac5fe04c349aaef491527ce7ae4018f9bfa0525ed090d471bd7660fe
SSDEEP 12288:vHW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:v222C9+bmOmbTk3reZCIT59z7m
TLSH
T1B15523C18FDEC9FAC13E5230865120E56529EEDDEEC7609B428D0D4B26F1FF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 d43fb5d3a9cb53d5e8e4e874be2d152c926658e07f8a5777fb590eeaf0c9711f
MD5 df41c70629ffbc906b2f17c8019844f1
SHA1 af3c5f36e33d080bae9f1dde581226af51c74057
SHA512 90fc7a44fd58f4294084e8e47f6924a4256865db304b81644018ac2696538675b24c8783a578388e6faff26f474352da032663a5b4629bd65bfe044d1875db43
SSDEEP 12288:MuW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Mx22C9+bmOmbTk3reZCIT59z7m
TLSH
T1255523C18FDEC9FAC13E5230465120E56529EEDDEEC7619B828D0C4B26F1FF8A44A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 04ca45fb4659afbd9cdfe835d6f1832302596e837d11f335f3bc229610a4d2da
MD5 b029250fc503d2e962a9418bfa5d3a44
SHA1 ab3ddc9754b95a98b5e6c45cacdc90bfbef8f853
SHA512 6a66a25be66aeac29b9af9c9fb2d86e36b63587dcd4e2f879d06df036685b8d085c24e93ffc791e4835dd9225531e237a333339a0d421e528f96b9ee81fcc988
SSDEEP 12288:T8W22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Tf22C9+bmOmbTk3reZCIT59z7m
TLSH
T1AB5523C18FDEC8FAC07E5230465120E56529EEDDEEC7619B828E0C4B29F1FF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 8996bcf29f103637e796037a3fc39ae0a8e9e1ddd90af0a4d5a5622bfa83015f
MD5 ddc8e507328a16ac30153094bb6ab058
SHA1 23216c9a53b65988c8e05071543b87ab15a9edfe
SHA512 126793e705bfb324444105c75ae6632e6c5685d086f269975ba18b0fe7fbded4b38383858264610bc52c4e9d7a76d4150ffec9a447e1348bbb6835be98362d3a
SSDEEP 12288:lV1W22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:022C9+bmOmbTk3reZCIT59z7m
TLSH
T1AB5523C11FD984F6C47E9234C56150A1A275FDD8EFA3629F82440D8B1EF1BF4A829B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 2e58873f00ddf8850b75c99aca04a6eaee60811a402bd7575bf91e96db8c56b7
MD5 098bd1d8f6f49bb40a3ccaed137d60dc
SHA1 9b3d40457e2f4148712eb802fbbe24d063796839
SHA512 10debff0e72370d8bcfd8466ff0ea70734aa9ad8550ccc02da7d0c8c814221bf77b81376462c7bac1b72b03cddaa99152dd4454c623133e5b03f52d524b81b88
SSDEEP 12288:8NW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:8M22C9+bmOmbTk3reZCIT59z7m
TLSH
T13F5523C18FDEC9FAC03E5230465120E56529EEDDFEC7619B828E0C4B29F1BF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 985d97eb587b241a0bfff4cde5f7df80e7b5b0592980df817633686891e26a15
MD5 a3e196e8d9048c2d3b57c3d9fc40a64a
SHA1 57a55dbda77066ee5b602113f501ad97003a4364
SHA512 6897bae492cc613122f4ba2a77bb6156e226e18a1a0db750fa2ff9916bf4344ef2684ee528f6602a52beb9f2beb28bf8be6f9f08dca9df072f61f86cbc9e5b39
SSDEEP 12288:qaW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:qt22C9+bmOmbTk3reZCIT59z7m
TLSH
T1F35523C18FDEC9FAC13E5230865120E56129EEDDEEC7619B428D0D4B26F1FF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 a3fbe5e8cb4561417c54371ce373333b46b78d4051478fb667b7b8f0a982dfd7
MD5 7367be0544604f1bc7af795c50ec52ce
SHA1 3f03d935ad91fd246f99a11bd76500d35d358927
SHA512 1bb254563b7b838cf2c30085e18265dd86c1083fd37b4e2bbc2139760cbdf82fcc8ef3da9604b337e38e9b01fbddab7cae739b41eb619e50dff83a013b0a8528
SSDEEP 12288:qGW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:qp22C9+bmOmbTk3reZCIT59z7m
TLSH
T1E65523C18FDEC9FAC13E4230465060F56529EEDDEED7619B828D0D4B26F1BB8A40A54F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 e78481b39d5127a4a9dc777e6e6ef9d9b5dd3d1260cfb9724d9b562fc3337c13
MD5 0f679177552d5e31f74dc9c74057c9a5
SHA1 9435ce498b7af1cf83b0e8ef34139c5d5f59e048
SHA512 d8108d97b290fdae8e6a9ac9df32292631af1512db2e1c23ed5b94bfc9aee40a79a4fc42b1acadd1d394da32ed8ea07f80c815de385dff031250cc5d05731ab6
SSDEEP 24576:iZMRzFVSOR22C9+bmOmbTk3reZCIT59z7m:iZMRzf92LlOpbeZB7m
TLSH
T1FB7502D5B39008F8DC7B813DC9519856D2B2BC594BA0C65F03E83A671F733A15C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 d98e406d05f694b6a601d3ee66e1db179822a4c0a6113bc1a828eeb9391d8909
MD5 02ab6206eba05f34b42750664100b7c7
SHA1 93f67925a617c77b634e2ee7ba5005b7ca3ee00a
SHA512 eba8d4be1f733212f925c6d5afc0e1cdfdc8a1333eb14304b4f99d1d7082bcbb6ae4e1a4c09310b36543b090e70824c827fbe2e44ea28bfc91811920b7204a18
SSDEEP 12288:27W22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:2K22C9+bmOmbTk3reZCIT59z7m
TLSH
T1995523C18FDEC9FAC17E0234465120E56529EEDDFEC7719B828E0D4B26F1BB8944A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 12a5ddec5fea46d08af351caf2a2868607c90fa820aacd62e4cd3688c02d8192
MD5 881fc5603f821693dd04f726cde1fdb5
SHA1 39f19f505ea43a784b52737d06e8c1e21878a376
SHA512 8c64bb49ee31000b3f7186ec538a2232602de62a2d961a5ecda244dedc8f169024a49a36b7c24316d08dae3adc5a6c61af990b8b770a5814b6e748af43627770
SSDEEP 12288:8PW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:8+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1D95523C14FDEC9FAC13E1230465120E56529EEDDFEC7719B828D0D4B26F1BB8A44A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 0753af4bc3e8cf9cc771deaf028d627ef0b3b37e9df69c4618fdc234a31f2b75
MD5 9ab73d38b1cce91da155e39e9995c76c
SHA1 0cf9857736325c58d8fe659be2be73a52505a96f
SHA512 78044fee11893c061988f0f7ad87edfd7b0cc4b04de23c989da4df82a0dbc38325e49530738ce21df1f32c4c86be2302b0784b635f43cf7faa1bcc08b20724e2
SSDEEP 12288:6yPz5L8CW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:nzy122C9+bmOmbTk3reZCIT59z7m
TLSH
T1B865128367E520F9C13B8238C9511951F376B8758B619AAF03940A772F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 d33c9765f97c397e224fe548faf3e9fa5b80456d889d8f5b6734c128dd322e37
MD5 3027d9313da11e1b98a4366045bc4c4d
SHA1 2abb449209663d3b320b9d44ec7635a5ae3b3de5
SHA512 9b466421088d114463f810661e62b9d294fd19742135bfdada0aa99fa2cb293d0933674e06fc80175b0611d08b10d0eb97bdecd2d05e5498474ef096c2017b2c
SSDEEP 12288:17W22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:1K22C9+bmOmbTk3reZCIT59z7m
TLSH
T1005523C18FDAC8FAC17E1234465120E56529EEDDEEC7719B828E0D4B25F1BB8940A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 961efe93159b4f36e2dffbe2ad2fde51dd9d750508678a59c8673696492efe79
MD5 54de1f1f963d10e1927372ca5ed7ea38
SHA1 e4dbb82144cc2d2e0057256c6e4449dcef2a8090
SHA512 6f44c2c2ed7bbc8277e275b352e534fe12293fe213e0cf8c8c86f6da9e7926f2d6a38d1d19a8ca0c34539e54c9919bf9baadb4328589e1ae075b40792744a634
SSDEEP 12288:N7W22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:NK22C9+bmOmbTk3reZCIT59z7m
TLSH
T10B5523C18FDEC8FAC17E1234465120E56529EEDDFEC7719B828E0D4B29F1BB8940A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 99c8688e58d32c3e7347e890460b9043a55dabf377a7c727baca86c6b3093556
MD5 6ee67b31a95423138bf0ad306aef8604
SHA1 788b40177fa517a8924c4ed899dddfa63b8a0e8e
SHA512 07de90dee3a6f808dfb4707f533b6211aeb0896d403f3640326b14416546094ae8803493940c7fc080bbcaac195023f8e451b9b2b70c6de588dd3107a53544bb
SSDEEP 12288:IyPz5L8CW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Jzy122C9+bmOmbTk3reZCIT59z7m
TLSH
T1BB65128367E520F9C13B8238C9521951F375B8758B619AAF03940A7B2F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 04c572abb8f2dd4b6e9d2ae52576dd1effa3716b51c3d23d3e92435477ffbdb6
MD5 d71933f44f9351b63128852ee54563a8
SHA1 6e0c73509530a730016bd545b2d39f3454d4ec7f
SHA512 5052e7cabfead39dd49d6cc694ddcd87673e2778f0feb53e29c4259bb8a7361e976a304c861b490317102fe5795a20f525834d0ed0a292c8dd12cfe65eab7467
SSDEEP 24576:OcP4mcvIjkGOxhKP2l71SNKbrh/8KBC22C9+bmOmbTk3reZCIT59z7m:pP4m4IpOO67N8Kw2LlOpbeZB7m
TLSH
T16D65AE2DABDC0096D0BB913885658A49FAB1B42A1F3286CF1160933D3F77EE54E35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 74035288a48f0d188e6495832161692bdd8d6c87da59caf43ca8b9ac4af3ae2a
MD5 db88053f4ed7965d982f9bae5ebfe3fa
SHA1 ae5c14e1744bd73de9742786fadd37e8ab8e1595
SHA512 714cec490dcc1a06d36be2d983dd3934c79f3cd245ee44c8c57575a87b097720690efa17fa9d53aac26e3ac5de8d7338a2745a18998a12270054edd0423216c8
SSDEEP 12288:ubsfLW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:1622C9+bmOmbTk3reZCIT59z7m
TLSH
T1DE65F185D79842E8C06E6234C7515681B333BC659BE2E3CB52C0F97E1F766A09DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 114b7cf86184cbbdd9878db76a04b2e66834171d66a182fb5b3922fb92325052
MD5 6dcf898830f8696c7cb6f7feb3bf8c6f
SHA1 9ff8b70b9da5acaf61dd0da38a63bf67a37125d6
SHA512 32450cd242744dba54857225df77bf878e11c3318c42f71780722f1d9c095780075ad3831e1587dbae1f074e4a3a15136aa1f8f7378d0418764865c2b9a343aa
SSDEEP 12288:BrW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Ba22C9+bmOmbTk3reZCIT59z7m
TLSH
T1C25523C18FDDC9FAC17E5230455190B4322EFEA8DFD6A18B91490D9B29B1EF4D82960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c60dfdb648daef2b1ce24a40b98b7db7f520e21052e5516bfe992a1211f76990
MD5 3863b2be5cb437839c68bc9d56370ce5
SHA1 9f0e077f2129a3e756d85b2ecd6a12951ce8cfbd
SHA512 f288588d79a9f56588d8e6f296e514a167f6ee9b7d9c9b2fa371bb7b7138ca31490787e6d5c0c005c707b1410cba53eebbc4305896fe324903f5d8f326437292
SSDEEP 49152:ya0h2GEkuAe73q3pp46zwwQM2LlOpbeZB7m:ya0hNYG4Jwdycv
TLSH
T17E85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 de1a2e76736c04b17e9b33eeef8d6bbbdb3d1e4d4916181cd5e887ad2bd67cc1
MD5 bb0343f4dbad5e62f389ef94c7f25080
SHA1 073a45cb5b2d7bf6e61689c242569c91a19e727a
SHA512 7c4cd29a01b0a95cdaec0cb08f45b40ab1428021e5749cd3119b89a8a660fc2fae374a4f44b20a48c866ab25edead12fe16c85fbcd0bc25ac936e96b589bfd29
SSDEEP 12288:nhbHjfX+W22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:nhbHjPh22C9+bmOmbTk3reZCIT59z7m
TLSH
T1126512AE1BEC10E9E17AA23C85914146D331FC695B52A3EF12C5827E0F77EE45C39B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5617d838065dd3f8a002e4021c3540b782bd1184a1a5b537a679a19d205dfd3f
MD5 309e11e313ed8cdc5fdfffed90455b59
SHA1 5edd2bfee535c41fd5d64f386e8c3afcfa47f061
SHA512 25b19e0348d37d5b822e84eacff3160777ecba740f097adf017fa48a388791480e344e2dd3013b61ac59116485d8b8cef356823f34d0ebbf5a253744f1b90090
SSDEEP 24576:N3YgnJcRTk4yti+R5dpR/522C9+bmOmbTk3reZCIT59z7m:NIgnaTk46ppR/52LlOpbeZB7m
TLSH
T1CF45BF2DF3B910F9C8AAD136450147B5BB71782D1F209ACB0174C538AF16EE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 710ecd73ad95b005a3fe9a50299588097ad5b8e3468858a40eee55f801ee0d4a
MD5 d1c0afb5045f5631a72a4249e6c0ee8c
SHA1 6358ce4be1336252a50e1a8cfbbbe412b770dd18
SHA512 255161f2cfd5e2089329f3fcb94934646709bec10f7e44dd8879a1fda79c90ab46d39f5e531430b1c3fe00db73645d872497ac928a28ab66db68e9d296b8b708
SSDEEP 12288:J/W22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:JO22C9+bmOmbTk3reZCIT59z7m
TLSH
T1855523C14FD9C8FAC17E5234465160E52129EE98EFD761DB808D0D8B26F1EF9E43924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 cefaa7ff186280a8e2a9e6f650ba9d11e3952a30f47ba6cbf0c7fc767b797070
MD5 02f8fa7ceacc9f89996a700a9f9bc72d
SHA1 7a27faceed64db7b3baeea6d63e5ab17737c49ed
SHA512 d25222d9114d1fec8bb0a3b82d8ffe329a78dabd8c6eb9374a7c27d50509c4c0b58a0b5fcedc1c247bff1a28087ef6bba00060917106b325763587ee65564425
SSDEEP 12288:lObfA4LWOsvAYFTgW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxZ:ibL3UTD22C9+bmOmbTk3reZCIT59z7m
TLSH
T1CC85F145EBE400F9D87B913CC9A28516E272B89D0764E7DF03A84E661F637E18E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5ec45d97aa27ff0c75378ea2bf33c4b5597d54b9e46497bf7be53b284818040b
MD5 fbd42d40730c3ffc723dd14669e2ad8b
SHA1 d4a7c28c1a7d7b025a104e71c1f0b2de442eba7f
SHA512 ca03b5d0b77bf339c3794fa07248d6ecad99fffdc7a0f4801fddc03df3988cdabcef82394890a2853892347a669519ae73443259a038133d0f9e98fb5056318f
SSDEEP 12288:0pFtIOUW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:vOX22C9+bmOmbTk3reZCIT59z7m
TLSH
T1696502552BED10F5D07AA13C8A925249D371F8654B6253DF02C085AE1FB3FF8AC3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2eb962aa8119f95b73037c82b951d3b00120b03b6e0b4641a2334ee173ea7cc3
MD5 b7dfb3adaf1762487626cd24e0355317
SHA1 c1f35f5ba071fbaf46e301aac052c1fd91c9d75a
SHA512 0f1aad796d67a0fe0e01bacbe287c4e59014d94510c8e6ff41c34812b306111ebb5cd1f7dfe3799b45606f847b55950433b9a0bdbc48038fafbcde4ad5fcd0d4
SSDEEP 24576:r7NM9YmZqmWMUkPjZM48Mv6bEhsK22C9+bmOmbTk3reZCIT59z7m:r7cBWMpPjN8DbEhB2LlOpbeZB7m
TLSH
T1B5659E6E6BEC81E5D477D13DC9A28205F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 6a2026ec527f2e2147bbf3a0738837033554bd41ab79b5d3bc6cdecbd97cde04
MD5 fc3a838cf69a9100d0e2fd894d8b0800
SHA1 a94c8935fae52c2531fd9eca1d71b43211c6e0ea
SHA512 bc1a99ecd5ecd2a318e61920ee921ae8e44f82016dc2a1d091b92a03177e0c34461e798e69789da05448ac8a7adc2574b130806bdbd08a5498018a1c71f802e0
SSDEEP 24576:jW6BApg2YuyuNDYTabvcRvNYf8km1Y22C9+bmOmbTk3reZCIT59z7m:jF2YuHNETovcvNYf8kmq2LlOpbeZB7m
TLSH
T1DB858E6927ED80E4E0BBD27D45B6D186FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 833a23cfae4081049bccf20c8ccedf090476b930f34a2e99fdee6caf77ab4d37
MD5 a365c9fa5862ee175fe3b8a3a12194c0
SHA1 be1b1b868e611b29e3db7df803603be6201de22b
SHA512 adfb61960338c2adb1a311e828232f4a061b9de364e93df1d8af89380014245e0562ff95d69256227d8b9b1c5b492ec18eab3fb4e3ccfee4a2c7b8faa24ea709
SSDEEP 24576:3AFs06+OmlfkNXEbToL22C9+bmOmbTk3reZCIT59z7m:QFs060lwXus2LlOpbeZB7m
TLSH
T1DC65AF2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E3F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 d660dbb38e6cdca3dfe085055396a253c90ea478d0f55dc121bcb152db3a4b5e
MD5 6e137199210e71d04f8e96613e7522c0
SHA1 d839b19d9c3139ec8dd5f052f2ee6ade3db0d330
SHA512 60ae49f2d5fac50bdc35213aea210c239d41eea9063f94d6d83bb6702f9ee9f29068c4538c62de001235ba8a2e8512c2f797d1c50abe5df0d6c9c144a5b32d0d
SSDEEP 24576:qJnJ5D3Wts22C9+bmOmbTk3reZCIT59z7m:qJnJ5DGts2LlOpbeZB7m
TLSH
T1BB75D06DD2A810F8D4BBC274815A1696FE72387D2F2269CB14B4D5353F22FE09979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ec993860969068a6b9a8460b617cb48d9201971c4220d59193502cab187142de
MD5 48be661e65bddd110d73c83d92686f7b
SHA1 eafb32b019645f15322f4385c044f674aea7d049
SHA512 877fdec7ec2debf527c1a6a96156bfcf1976683aeb0abbf92bbbe1bd3a7de30f2e3d2e01181135b2e9cabbe9abd1028aad3987524bf89cc50dc716a39431e4f1
SSDEEP 49152:zo06DIKdwc+eQnSt65aV22LlOpbeZB7m:M4ycv
TLSH
T168956D15BBEA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 555fabeac15967983a6c0a0499d0c670422043df4c21eab6bd554b371a3eddc2
MD5 9f63d583449b81745a0f68a9cef3c1eb
SHA1 00127e99904f71ea3fdb324e78c207f663cc82fb
SHA512 644184ca9e9caca755fde0e489435491e99c8e73a3a111f0b450f69e2b0620bbe3dd4f60cc9ef76e308f7c250cd88a55e4a07bdcb436a05258b2d8468b02bfcd
SSDEEP 12288:7EP3RrhW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:ArA22C9+bmOmbTk3reZCIT59z7m
TLSH
T17E65029D2B9DA0F9C03E913C85918145D372F474AB9223EF42D5867E0EB3AF96D39A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 32fcfa41950009f969bf9496f5ebb2dda4544409b8df671311568b5fb630a27f
MD5 87bd25f891c1617c2073ba98cd869607
SHA1 689ce9e5426c52f64595ce611b110f79e14c239f
SHA512 c857cb0ae37464df20018ec9b32d63988f9e34fab0222183e81043c74433986f721eccffe2aaf2d3980fd5cc7794c0844607202d585130bce379b04d881ed95f
SSDEEP 12288:ujkyuW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:uIyx22C9+bmOmbTk3reZCIT59z7m
TLSH
T16665128057D894E9C57E42388A6341E49A35FC609F6262DF51C0AE3F2F72BE4AC35B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 8cbfa6de4706b39b0eb9ed14611f020243aa91f0e94224d622521504e54d2ebd
MD5 d7ce83545489e9f8b77458524f6faed6
SHA1 af04974a0c4336a1cb81e4e9090b315d5388d9a7
SHA512 916766e93b35029d5d56cfffa7d89e8743ea3df3cd8208b806d985d4802c549a98c8ab99475ce7e6a3a0177c454ea2a231a3c5530f6c265671d3fdc49e837e19
SSDEEP 12288:cFEW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:qn22C9+bmOmbTk3reZCIT59z7m
TLSH
T12B5523C44FDA94FAC53E4234465164E16135F9B8EFD630EF40C94DBB1AF1AF4A03A94A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 41c0da76704e6b319dfb069464c2c8697233d98e250aa8e2235418787241cec8
MD5 728fc65d5d79053f6de5e02bad6bbcaf
SHA1 d6d6fc119659fb03a841cc7860b0f77051b8c571
SHA512 02f832232489480e1a3ae6e5e02aea1f7c834ded7604f0e8311870c64ccab359feb8bc0730b754d90ec82c49e49baccfdad63f6570e1fd41b3f68ecf92589022
SSDEEP 24576:uQ9MxZKdcz97w3y22C9+bmOmbTk3reZCIT59z7m:uVKXy2LlOpbeZB7m
TLSH
T1AB557C2DABE905DAE177D23595A250C3A633B4311B31D6CF2448D03D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 759702742e8227fb130ee69c9aa192846c6e2aa5dbc8cdd9c0d6e9858c1a16fe
MD5 b6b8f53f983f4053c631c8fb0f6fe4d2
SHA1 1ddea96c5a685505b18e1435a749b646afafdbe6
SHA512 fd20595e3bb6a3cccc1c878a7637bf1004ea13dc9cbc6c2825228136aebb122c2c81829886825c69e1f7f6484c5de3dd9dd85b76bb9a3dce8a2ccc903a13bd5a
SSDEEP 24576:gyocxApl22C9+bmOmbTk3reZCIT59z7m:tocxApl2LlOpbeZB7m
TLSH
T11E75E05FBBAD40E2D17A813C89818245E773B0745B6263CB5191C73E4E73AE9BD38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 be8920fc78e4d12bc2245f6542cc540681f1e0538b887b334976b4757aeaf2e2
MD5 85767cd6af59b3c5a7f5b86dd57b8a0c
SHA1 c323d41f00fcbcbd47ee12f0cf6978c6d98d29ce
SHA512 86adc5d00fd41723c2d37ddfa471989e58a05c4533de568405f55ca56179a3395d32f5314e8fcb30f55c28d01af8c4173f6ab3a86fcd44ff0218814625c22101
SSDEEP 49152:2WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKl2LlOpbeZB7m:A0zuNIJycv
TLSH
T181A57B3DA2EC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 383cccc2ace737f45b5e636d13cdc85a29803cb8d11bb33f00c85dd85036b3bb
MD5 4caf779baddca7ee7b4747f2469595c3
SHA1 2c987b04911ff9de931bc3f86a175ea4dba79e4e
SHA512 3c95cba8ab1f6f5f838050261d6c2e383b9834919430bedec7d906dc5d8b409ae765ea784f6962f90e46a59dc421d7287bc286c7d528b7b9c79625b5931d71e3
SSDEEP 24576:u1QT7EcpfxR+N5AWAz3ooiYujMqbA22C9+bmOmbTk3reZCIT59z7m:jTDxR+N5YzT4jM32LlOpbeZB7m
TLSH
T19955B02EA7F845E9D1BE85788A23C512FA727821073193CF42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 c74eb6fa8b93d0bf9fc3728ed13473cebfd35061991c5aec279228524399c541
MD5 8c4be0dfbe069a15c0dc2670069c3f41
SHA1 5f50d32e80504bdc7d7577dda8063a95d1241953
SHA512 9b1616be7126ef715144eadb8f4f45334fb3da9a13f945dbbdf8ab9a847a26e23ac9049f4db6886f76af166f31b7fb4bbbb2c51ec430533b0b8465dee1c56af7
SSDEEP 24576:/TMdOz0FFS+bmSLU22C9+bmOmbTk3reZCIT59z7m:d0K+bmSLU2LlOpbeZB7m
TLSH
T15875F17EA7AD04F5E47FC27C96438906E6727465032266DB02D0C1BA2FA7FE47939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 52b4b1918edb91a6a942e4c6381c32f9e95b059ce7278e8ba228a3a9ebcdd052
MD5 a1b74027c293d3ba274f3ba358ddeaaa
SHA1 81ada390e38f99d2e638bc15adac0a202446fa21
SHA512 013b629065235d3f5aa707881b85481cffc182f162a141f472e77c1ae96dd7722d82212880a9b7bb2246a2f86896713e3d557926eaa69bd2c50400ffd4f40ced
SSDEEP 12288:x47gW22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:0D22C9+bmOmbTk3reZCIT59z7m
TLSH
T1346512891BEC64F9D47A9234866201959230FC756BA666FF21C4CD7F0F72AE4D439B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-257-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/220-290-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/220-273-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/220-241-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/220-247-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/220-455-0x000000000D0C0000-0x000000000D0C8000-memory.dmp

Download

memory/220-476-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/220-388-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1292-50-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1292-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1292-56-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1292-457-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1484-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1484-458-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1484-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1484-372-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1704-376-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/1704-152-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1704-146-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1748-6-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/1748-8-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/1748-0-0x0000000000400000-0x0000000000602000-memory.dmp

Download

memory/1748-1-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/1748-389-0x0000000000400000-0x0000000000602000-memory.dmp

Download

memory/2076-177-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2076-183-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2076-383-0x0000000140000000-0x0000000140263000-memory.dmp

Download

memory/2496-377-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2496-162-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2496-156-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2664-464-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-460-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-479-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-459-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-461-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-462-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-463-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-465-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-466-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-467-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-469-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-468-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-470-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-471-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-474-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-473-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/2664-472-0x0000024890300000-0x0000024890310000-memory.dmp

Download

memory/3140-173-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3140-378-0x0000000140000000-0x0000000140283000-memory.dmp

Download

memory/3140-167-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3284-206-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/3284-200-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/3284-384-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3452-385-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3452-216-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3688-71-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3688-81-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3688-77-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3688-83-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/3712-95-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3712-390-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/3712-89-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3808-112-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3808-392-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3808-118-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4104-86-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4104-87-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4104-47-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4104-39-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4104-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4364-226-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4364-386-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4364-220-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4396-373-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/4524-12-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4524-422-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4524-21-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4524-20-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4808-100-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4808-391-0x0000000140000000-0x0000000140250000-memory.dmp

Download

memory/4808-106-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4960-141-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4960-135-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4960-375-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4960-452-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4960-453-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5508-387-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/5508-236-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5508-475-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/5508-230-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5824-187-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5824-198-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5824-196-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5824-193-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5924-34-0x0000000140000000-0x000000014022A000-memory.dmp

Download

memory/5924-35-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5924-26-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5976-131-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5976-374-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5976-125-0x0000000000700000-0x0000000000760000-memory.dmp

Download