Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 05:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe
- Size 32.7MB
- Sample260910-fp8paa1vey
- SHA256 964d2438099219beb1bf69ae66469ae17a878279967a41a7662bd71f1497aab8
- MD5 6ce571db0d1895301fb2ae58008fabc5
- SHA1 76c014cd171da65a4d57cad0c6c51039f22da1be
- SHA512 7cdaa03488ce516d11171acb1a733352a80ce698b965006db5caacf6619392f5d8712aa7b245c5a04a3e83109d5df7e88f78af316fcfcc2983c3f6e147449ee2
- SSDEEP 393216:1+Ep1zw6t7P9YoRMeTsqr/yF+g+kuiL7YWdRqtvJsv6tWKFdu9CyF9Q90HaePVpF:31zwSr9YoRMexgDu47YWygK0HaePn
- TLSH T13877CF92F285C036F4D240FA556A9B764B28AD201B6152C7F3DC3E6A6A309D27F37707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 4544 alg.exe 732 DiagnosticsHub.StandardCollector.Service.exe 1592 fxssvc.exe 2052 elevation_service.exe 228 elevation_service.exe 684 maintenanceservice.exe 3032 msdtc.exe 4816 OSE.EXE 2356 PerceptionSimulationService.exe 2636 perfhost.exe 4508 locator.exe 452 SensorDataService.exe 1792 snmptrap.exe 1724 spectrum.exe 1056 ssh-agent.exe 2608 TieringEngineService.exe 552 AgentService.exe 4416 vds.exe 4720 vssvc.exe 368 wbengine.exe 1848 WmiApSrv.exe 1312 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\bc8b76d22d44b5a9.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\javaw.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000180fdadee140dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba202bdfe140dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003d5dedee140dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096f823dfe140dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076e44edfe140dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9e32fdfe140dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe Token: SeAuditPrivilege 1592 fxssvc.exe Token: SeRestorePrivilege 2608 TieringEngineService.exe Token: SeManageVolumePrivilege 2608 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 552 AgentService.exe Token: SeBackupPrivilege 4720 vssvc.exe Token: SeRestorePrivilege 4720 vssvc.exe Token: SeAuditPrivilege 4720 vssvc.exe Token: SeBackupPrivilege 368 wbengine.exe Token: SeRestorePrivilege 368 wbengine.exe Token: SeSecurityPrivilege 368 wbengine.exe Token: 33 1312 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1312 SearchIndexer.exe Token: SeDebugPrivilege 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe Token: SeDebugPrivilege 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe Token: SeDebugPrivilege 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe Token: SeDebugPrivilege 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe Token: SeDebugPrivilege 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe Token: SeDebugPrivilege 4544 alg.exe Token: SeDebugPrivilege 4544 alg.exe Token: SeDebugPrivilege 4544 alg.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe 4688 2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1312 wrote to memory of 1476 1312 SearchIndexer.exe 113 PID 1312 wrote to memory of 440 1312 SearchIndexer.exe 114 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_6ce571db0d1895301fb2ae58008fabc5_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ma.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4688
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:732
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2380
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x45c 0x4181⤵PID:3784
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2052
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:228
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:684
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3032
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4816
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2356
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2636
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4508
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:452
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1792
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1724
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1056
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:840
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:552
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4416
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:368
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1848
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1476
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:440
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 458a97f7e765849cd8f6d252b85be83920f6ea4e3b92e6915274c04c2522ce91
- MD5 01f97dd4134ffd7e5d0414787177e88e
- SHA1 7694121300f35a9a1be040ae0047ebbea683d5ac
- SHA512 b1742e3ec5fc656c93cb22ded5d51f8be97ebe338423695f8c0453abb70ef00f3b91159922eb50f8681d6da08bc266c035ab3155bd41cf52bb05f70fdf2f5a81
- SSDEEP 49152:vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnQLNiXicJFFRGNzj3:t3q6sjBb7wRGpj3
- TLSH T1BCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 45d1d5e97fad4bd099f301387c638756955f0d0626a4a148778667b7a9c11ae0
- MD5 aa878546c413afa16a2f1b5eefca5d17
- SHA1 cb7c467276a3503f142d61d478741be506f348e5
- SHA512 64df545f9104def6300ab5ead05c5068f3d89774368ff72aae5271d34af99ebc91a355fe2c959667cee000feba772829f94f6e468e1afff2e62aa6b08b0f187f
- SSDEEP 24576:YXYfDtczAv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PtcqLNiXicJFFRGNzj3
- TLSH T15775012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 146c7ee6fc443493bba01567ded61f415e056585f9bdff632ec9d011da1807d4
- MD5 4f03423f113e65a2cf6784fa400a9c48
- SHA1 1c6295679ec733cb5e9a0e48e79979a3b6f02a2f
- SHA512 84ef6bcadf17f463203848bc3ffbde66a7ea2b25d4453dc8ea902cc8d0ec55ef1bea24fe66416d326c194099910d5a222407e45669e2ff54e3bc3fe44bafc4b4
- SSDEEP 24576:A0Le5ji0hmxxrM4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:APji0AjNLNiXicJFFRGNzj3
- TLSH T10C959E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 108123d20dd8e3a4499977690b3be172e3919ac178bff4139193fc019d3259d0
- MD5 e2dd111481d8328ba8bf7cfb8af816db
- SHA1 307af7b497e6d7ffa108a08015e2cca5a4280130
- SHA512 b4286cc49de8d200036e23ddffcb2de82c8dda013edf060f0d4db7d9a46cf8dc1178bb9418e7b10f19ec9730bdb7de19b070ebec93e99249934d25f8f55f23aa
- SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWn6q8wyua/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t/ezSC6vUzPveHjyRLNiXicJFFRGNzj3
- TLSH T170756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 124a1e508e21fd7a49550c1d90a427933766ce0f265847f7c4fee363271bb29f
- MD5 f56e567ff5c134aa228ef8ae84e9ca3d
- SHA1 774367a832ecd89b17b7e5ebfa33ecdc3f818c23
- SHA512 437b4ec7eced19b28fbfe1edc939183fed4e2e729396e049ecfa5e22d9d1c078e875337aa7fa485fd5e861db8ff7553e2c5ac0c4cc6e9c02a236141648ba490d
- SSDEEP 24576:RVbqPb88hv/l+YL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RVO88hXl+yLNiXicJFFRGNzj3
- TLSH T14E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.3MB
- SHA256 136d240021047ee7b10a086be6478d7961b61b60e2cbc5115155a9dbfcba35e1
- MD5 726e6cfeb8ca8e8ee69408629beac5ab
- SHA1 ca1b56f9e468a80f7ac2985ee09491644a63e918
- SHA512 794e497619682539ccfbe79fb0456aaf7563f1f2e92fab136a1ce101f6524074032ab9cdae6a493959bedac3f47315b9c4d9c9b9476e4bbb4d5970d29c1183c2
- SSDEEP 24576:hLk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SLNiXicJFFRGNzj3
- TLSH T1715523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2503E5E927CFEBCF39123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 6cc325f0be5fdea1006333f641bc3721c13ff5bfb5f96fc8fb758bb08f93ed18
- MD5 3373463e7c843b52259d18a4c54e46d9
- SHA1 5faa2ccc9aabb4c721d0d7a8598a4adf9fc7faba
- SHA512 eb36fabf2b253f7eeeef9d6ecabb7a32caf41300f98e7fa9c10161aae1f6a49c784b2a461e89dfbb235a6cdacab13e78ae0adbaa4baf73edd45573e82a01fbc1
- SSDEEP 24576:6JIUT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6JIUTLNiXicJFFRGNzj3
- TLSH T12375CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 55ac2717c9c2dbf28c8497ab27eaa1fcaed5aad62cfe59ae35b349c7defc7b5a
- MD5 bb4decf7d0470dbae0cbc60da77212fd
- SHA1 de8bc901e2c3a1584ef05329a9a3e918a0f6456e
- SHA512 f0932d9fcca341de5e1a93ee92aa59b95466ee731f958467ef250a8c16200c2b3972101e3f1f8d6b540393f51c9c4705ca533a525668bf4615101e10c875fdac
- SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THX:UQvGAdlCEL8c/DRNw5CK7wRGpj3
- TLSH T1C8266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 c71f937103babe08da528e431bf17ec4ab51b86dfc8a76f5c5c8a7f69412e05a
- MD5 79721229fcaf69bd19928ed843d4480c
- SHA1 4fa200dd0f818e60fbab2badd89440bb76d654c9
- SHA512 7d7073856bfd65a704d68470ad053582cfec6d3a133fe1853bc01ca658965fc1c8b0c3018e0e40a3e044b455507b2a2a86690b634c9ef9ec9deb9bf2cc137759
- SSDEEP 24576:30ewsAj9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:klj9LNiXicJFFRGNzj3
- TLSH T1A775E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 0eadc2555ad92fcefabc1e1d668cd3074c359b1c239bdadf913237cec2c71d78
- MD5 54e883d5d0d6eeb5da282452d3ddbce8
- SHA1 f25221a907f968a4e37f0fbbeb8d75c1753dbaff
- SHA512 a5bcaa45a38659b093e68862643fbd33671ebd70645b31121cf0415b6cf27de853d0846dd4638cc3a20464ebcfbc0e61a0aa66e1513a44735c8580955976cd43
- SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHpF9:DUEtQevvqc2W1cpV2tI32v9
- TLSH T14D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 f291f62e73c8aa17b0551d64de687f1a5b0ea0032a51975e5b63cf8c168c8252
- MD5 a6d9f972eb93d9d856c5d83eaaaf91a5
- SHA1 bbf90f00c5ec553b71edc766f466814a233a1185
- SHA512 f0c7fc21799dd123ff53d9162b472a6be36c61569323d7b8f3e1f402d397d52bd4abd8185f0fd1f18944660278f55eee5a6de29004c157ffc03df9cce90c4e6c
- SSDEEP 49152:fCbRquA/m2yL5zifFiV+XenmE3/zdLNiXicJFFRGNzj3:4oqHVjnm+7wRGpj3
- TLSH T1B0D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 2532196b8e85706e9078441f9ba99fd7b9b0ff21b5dbc12b6915c6feeab0abe0
- MD5 27ce225402dd6f6b8b77703136d156e9
- SHA1 0ad1ee1fdd87d8efd05e37508c4e5ac1fcec6463
- SHA512 9f2ded92ecb6564ddfc13a0c8820c65b8d78562c8ba2af0638d71493e043403bfe03155d7bf6002fe6d6e0668f660ccf8bfb3efc52d6fbccdc82db27f1eb86dd
- SSDEEP 24576:wAhGL3IFoiwtA5l7S53e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wAMUFoiq5uLNiXicJFFRGNzj3
- TLSH T16F359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 6e9b3a221917ab4f9f0e2a09564a3e690723accd5d7f338a9f8c8a332becc5b2
- MD5 007b552ee6a08c62b1f5056fbb3a948b
- SHA1 a2fc09d1a7a414646453b79b5302aa52eb93c506
- SHA512 020e689a87177fd1bd36363d709f8779056a0f0c3e3cf8f61f43ab0968060618e068611922e50bbf57396e08fd8fc230d074ceed49031c12579561f3eccea431
- SSDEEP 24576:Lwu4OWx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LwvOCLNiXicJFFRGNzj3
- TLSH T1A875F18632940CF9E9BA41398657C035F7F2BC152A25DB1F5360C65B6F37362AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.4MB
- SHA256 77d040b7fac474b4c505302fcb95af1cf0681edd18428dae286a335d49776cad
- MD5 57ba9ee6caed3965fbba826dc55b097d
- SHA1 c9ad3ee65c17ac2ca260545da911c2830fd13743
- SHA512 385cb4423f31f63e14819705b5352130426c8a1fc8bd35fbbeebe76e29a0b9e7f3a3a01dd44f5bd3afbfeb914d4bc86692fb2a8ad310733b0984381d4ab958e5
- SSDEEP 24576:PZuA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1LNiXicJFFRGNzj3
- TLSH T1CE65129622D420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD68E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 79fd589eec70981e49daefd2733e95006c5c509e098f554228c3d33e4b3c859b
- MD5 2c6816778c3048dce86c72a54ff47bb8
- SHA1 b77c0382d871a7a0b72329ac2c6f9acceb957f55
- SHA512 729c6dfb5318c1a4ba97f3466609fbab2c6d7c068d59a9df446339fe1a232e52cb5948b22cf1be216aae1de4a33e31b078898d291b855e505c0cfa692823ef14
- SSDEEP 98304:7QRQyi36YOcPbLvw2gAf+PN337wRGpj3:KQyiKa/X+PNbF9
- TLSH T19B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 a8bf7485283a6854459201ab55c0531ee661718792890353ef2590c8cd027638
- MD5 9de6007107c341656e2c20501dc8cc81
- SHA1 4decf8ea234446d8c84e43a660aa0a24d7ce0a11
- SHA512 2516fa24e6761f7f0f3bfbddaefd29814df569a2a36c06fb8b5cbd96ee396626f721c9195917c9439293ba20cfc94c8e023d96f363ac213ea882611243379657
- SSDEEP 98304:EQRQyi36YOcPbLvw2gAf+PN337wRGpj3:LQyiKa/X+PNbF9
- TLSH T15A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 a5c6f98123c5c44139e3f9a30df01b0c0deb9e77a23f092c3a7cfa8cefef75fe
- MD5 3110c0915a0115215c843d85a916a629
- SHA1 58a4fd819f60a9f7abdb3af5d30dfb2c583ee134
- SHA512 815ed1e31f59e77260f8e09367936259c1ca42aa0c454704ceab4e48da0baee81f25249a2a445c9c6a3e6d6109529f667448761a01f697a8e135df90af31bbdb
- SSDEEP 49152:468Qg55nhceWu7PNU3/NLNiXicJFFRGNzj3:CthLRc/N7wRGpj3
- TLSH T1ACB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 327afb3f34299c9117e012c912c33b7a38ab81c85617c160351933b29534182e
- MD5 315376618ae7edf5c47a930bf7a3be70
- SHA1 e3a116fd92dc1cc7bed3d336694cbdbce3028433
- SHA512 7043e6b44c712e1821dc13be1099d3f205313fda5580c9b9e4279cbbf5f2a413ce60002bd955d7695d763f3e56af13a8a8f0d41c2607f1668b7bbc3394933c6e
- SSDEEP 98304:Jy5112gYy5azzVvt69nLKnhZk7wRGpj3:kLIHEWh6F9
- TLSH T1CE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 cf360a536414b38a3fb040da2eb1e8216dfa517c6682627856d5c21a69b3a0e7
- MD5 8a6fc3bdf76ed216205a022983b95ba2
- SHA1 e70ff5cb7fe35efd662b8377eb0bc76d6e439d35
- SHA512 5e76001bec6d743328f23b67d2ec421f0491ef17ce001a47dd122dc466372ae4029df6b451cfef349ec66a7761b623556ba2753bf07dbbee949ad840e0a7274b
- SSDEEP 49152:NB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl/LNiXicJFFRGNzj3:Tu6Jmdxd2d/7wRGpj3
- TLSH T1BDD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 c7a30e4d8cd4c918efef98097257c5b0054cfd051f7967e0d04322dc20aea638
- MD5 e66c2ffb6a22eceeeff87f64790806aa
- SHA1 13b5b7df2c1ae0b130132de6631e6996693250c3
- SHA512 a68578f32aa168a40b62108cf2bb6fe6bc958a6ba7590bf41edd9825fc8794db47955a825e4ed9c75d55b013a7e9287197ee99ccfb1fd4fcb781e1340482a841
- SSDEEP 49152:j1hpsNoJpF1A63U44CwH7R4xzLNiXicJFFRGNzj3:jmifPWR+7wRGpj3
- TLSH T165B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 58b9fcf07faafc4e0db71b565ab5d44b7f290b11a1397ca7a4be24a669033ed2
- MD5 8d5ee90ec1590a6e4dd58558a6ae39fa
- SHA1 2e0b7452ec8f7e61a07e3bb6f84a2438fec59199
- SHA512 eb915b7236b57364a09ef2aa67946061afdc9f49225ec4814b2a441ca9b8c5fb66f9d55ca680af9cc4d3afd517e0ecf7f048fb44a6b19d66c6b5e5c44f16e60a
- SSDEEP 49152:pSuZQIY0Be2KcRVtOnks6NMHqALNiXicJFFRGNzj3:n5dKii61A7wRGpj3
- TLSH T137C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 6e324190c0c62516265208dd0cc78d8e8c7434c64d086762d55fbe2e7baafd03
- MD5 0146a97268c5762dacb8e9e14dfb7472
- SHA1 d361614465f9b8da5c800ec1a035dedbf8e1573f
- SHA512 3b1a3fce2130c1b1d14301c43d0532e0933c63370ff9b546eb272ff5cb5acea9f816869b0f4fb9fa56fc9371c9a98c4e5c6debda735d44c8c277217a6129afde
- SSDEEP 49152:ghtSn8EApI0fig3giDn0AP5wvLNiXicJFFRGNzj3:xX2imphi7wRGpj3
- TLSH T14B95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.3MB
- SHA256 bd781af63963e3a4388e446a53dcb50be807234965166622eb12457465ee9e25
- MD5 df78dd2437e4c254bb62a6eb0b008a1c
- SHA1 e0d864766b79e72ecdc1450edb71c733dc31f07d
- SHA512 1721025d6eefb9d408b1c1fd87be9e3fbbeeb1a17a174efb3f56750dc44838f4e0e4c7c5dbea7c036dc1cd7328dd6ba39acc8205f1d78f25ed8535d8c4ab4a31
- SSDEEP 12288:9KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1D85523D3548955B1FAFC003AC6755428F5881E2DEB5618E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.3MB
- SHA256 9036714a4844a918d81037c5a86be7a0c637e26c84dbe5c9461c99f6522fd3c9
- MD5 3fccb71d926a342317e8f169f4d6888e
- SHA1 dce548360022f9cbda91ab773390dab2a0b04301
- SHA512 018ea06be7a83f073e3ae049db0c862e53320cb467706cbbb9766871f1fbb89613868e3434bc206e1b37288d95127a2992558ae49d9c81a4cc93ae1fe82f1075
- SSDEEP 12288:KliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1815523D3548955B1F6BC003A86755428F5882E2DEB5618E3E3483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.3MB
- SHA256 9fed901cd9d7e5ad7220adbe78c08da7ac997f87d30cb14490dbbfedc08e3e99
- MD5 bc3beae9accad57ba675bf9b369498fa
- SHA1 ddab557e46295a97b9598c4ce2a9505844aba7f8
- SHA512 4a934aeeb5e26118e4ab5baf3fa733e9fe13aa1975a1ba906096c1a454b95dd6bafb4f1b533d9366d99217700b8a8e983492277ea2889d627dc807c94e121031
- SSDEEP 12288:5viJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1AD5523D2548955B1F6FC003AC6765428F5881E2DEB5618E3E3483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 73f8cb5c586d8afa0daa49a7a58703605c9b7633b11ac631c230ac002f34e49a
- MD5 da43c85c59437b5475aa0196de2102e1
- SHA1 4fa79d757839d47f6b278c442b179fb15923231c
- SHA512 2af958beae41d4155968857555f58666d2fe4fec0274796d3869bb5eab6513f07e6a3be138f707b705d84808936d716660c90452d2d22c08793c877c4c7951ca
- SSDEEP 12288:LVUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1B2552392168901F1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.3MB
- SHA256 af2354a92937c149c79f5e36242c6181efa65486995daf95f3acbf4d3485d2f9
- MD5 8adc9f72dcc491b887e8b06478676fbd
- SHA1 f9879f581a55c5b9d246efb3b064b63aaab26e1b
- SHA512 de021e63a78c745ad46371f426f634e7d8397c8abaf8d1f6ae8afdd5cac43a9f3c35ad62c9cf5e232c7c84afbc1e6c0f719b443aea3c496f10bb721abd32b93d
- SSDEEP 12288:LsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1F15523D3548955B1F6FC003AC6764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.3MB
- SHA256 0d3baa6364465b505cb546b85ca5179dc75b237bd4d0eec35868cc355cea7808
- MD5 23953f7b2451de1ca2df86b5e8982fa3
- SHA1 80d78ebba9a1b83016ccb48434ae794d2f095cbd
- SHA512 e2549cde2d0bdfec1f9a39197828a89ead7f6431719b01769108315aaaa048ee5621a8962499002db0edcee62770d572f6f1d1316c2f9b78ef08bf50ce1a95f7
- SSDEEP 12288:vZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1B65523D2548955B2F6FC0039C6755428F5882E2DEB5618E3E3483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.3MB
- SHA256 708f6cb48b6909b64e83f2540cd2c8c1d02735bfb0e2220181a33388afd7b3f8
- MD5 8a71bbc71835e50ecb96476cee2d573f
- SHA1 fb4167229bc49e91004a86a883596108df9fddc6
- SHA512 ef1c5eac911e9ba91d7394cea214f56ea18027e365a00b22874f686409a46be03c114ebf5006091b2e219585a19f029241e7aa718ec545d1ac03a55f5f4849bb
- SSDEEP 12288:WdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1D15523D2558955B1F6FC003986355428F5882E2DEB5658E3E3083D1EE27CFEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 d2f7dbd87e87a2de1e73aa6a8509ce0a0002dbb45065e7dba901610031c05bb0
- MD5 d13f82139af730d1abb63ddbfb5b1026
- SHA1 88dac69588d253a54fcfd7300f9e3cb381104f05
- SHA512 38803103bcba73047833c8f9b8d948ea6ad9a3fe882d4c8122496de78458a3515956ad36efb5f572cb1eeeae9342c5cbb4ffe710c8fef7acd4f29f9fe1dd5a8e
- SSDEEP 24576:tZMRzFVSOJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tZMRzf1LNiXicJFFRGNzj3
- TLSH T1EB750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.3MB
- SHA256 2b68c89857b282ad7d6f1b7bf2953d659baf7aaee125cb5d4dc4b1c2766dcacd
- MD5 e87ebffcdd42707013f7e879fd8ef824
- SHA1 e8e23f486a9f7e34b9a96b0328e543d825d40be2
- SHA512 a3e17bd251f8f32f825316fa689b19b26ace47fd8f8f16419edd2933208b0dcc5cae09702cce864bb153cdf0dedfca8bd277a085fc9eb533c9e14a4f243a07c4
- SSDEEP 12288:CGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1805523D3558955B1FAFC003A86754428F5881E2DEB5658E3E2483D1EE23CFEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.3MB
- SHA256 1c272caec7a63e42a2946520bb2abe016deca2a89ae33decd6b65082d3c68c31
- MD5 d1990029b9f6472670fa850bf0236f44
- SHA1 feabf6f774ad1e5c458650f6d30e7063f5a3a784
- SHA512 724e50c136424af40652636590282ffcc379088170e17f4af26cee866769886ff366830454920ad7eaba8f9c7d1f22933882dfd23b77e3e45092ee45bfbf31ba
- SSDEEP 12288:uyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1CA5523D3548955B1FABC003986754428F5886E2DEB5658E3E3083D1EA23CFEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 3635e3c3f243f65c05e2a7babd52155489c780ad38143d115dfb015f0b8a01bc
- MD5 cad1396c5b01faa8eb3d2ef9658017b4
- SHA1 6c79138452add2fb582408fc3769484226ef6697
- SHA512 6b2dbc31b1d20031ce652355e9d0a457ae43c6bcc78112346c736517973aaa40de37a56e4c2923d8cdeddf1902c2939123b58231c5d310b179295e343c6f8ab9
- SSDEEP 24576:vzyt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:viLNiXicJFFRGNzj3
- TLSH T1CB650247729530F9E17A4139C9621911F3B17C3647208AEF53642A7A2F37BE19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.3MB
- SHA256 4308eb279240cf122e91032d86802adea6473c13c248684ea9b83cd1509aa218
- MD5 43aafed35611ae6b0f5945895615aaae
- SHA1 4a1cc7640bb58846fef7e335ded7cc89ee218ecc
- SHA512 6af72d22701c5b603ecb86ab8380bee30f04c446ccfcbaef226a5f2037c3fabc55eb387281f8cb275c8a68dc2f72e92331340af45ac2710caa003cf466d497f7
- SSDEEP 12288:mGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1335523D3548955B1FAFC003986755428F5882E2DEB5658E3E2483D1EE23CFEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.3MB
- SHA256 63afb32c59484239c32de2ac5dc5087cf84d537c0a1745f47a2aad1e0347b2bc
- MD5 dfc224a7bd9a2559cba4bd917ac612ae
- SHA1 00e223f24f742296e4ab144e1ce4c2adb61875e8
- SHA512 30cd554d19e0b29756c44d6b80e2ef1dd6235ade49741e0251e0ba1aafba8dedf83dcc454e7367e09e0cfb5dc9a3dfd425193c4ccadee8e8b02ab08ade3a66ad
- SSDEEP 12288:HGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1195523D3548955B1FAFC003986754428F5881E2DEB5658E3E2483D1EE23CFEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 55ad2cae6e351c27b6a094cd2d9f8ee2efdced8b8324cc789c26b2fe0f67eacc
- MD5 bd60d942befab64a8bb5d1b2b23ade4d
- SHA1 ed5fa71c8518455c9188d4293d91d28d880206ea
- SHA512 562e0924de1001072d11dea73b6642b3966f6f21865a45b4282579e8bf98e745484590bab2d544c3cc487745f11aa350f09af5dc49f082f055965d9e9d320cd9
- SSDEEP 24576:9zyt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9iLNiXicJFFRGNzj3
- TLSH T1DA650247729530F9E17A4139C9620911F3717C3647208AEF53642A7A6F37BE19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 d5fe3ad46c85905a00ccaaace2b20b6eb55f757cc54b6f078ae390a9af998ba0
- MD5 3efca24e745e7104a72bc53274a20faa
- SHA1 3be06c746f867435ea09b94be02bf15d2d266e7c
- SHA512 5bf4d4489592286802da2c1049123b606eedcb9d68fd75fca929099edb2b7f4fbcebba75e09931a2f5e292f700a4c21c8824135b87d14e5ac89739b8b59c7e0f
- SSDEEP 24576:0cP4mcvIjkGOxhKP2l71SNKbrh/8KBI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PP4m4IpOO67N8KKLNiXicJFFRGNzj3
- TLSH T11565AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 d60a5adce08a6e5a067193346969684e323586a5bcad30381296a1300bfc29c9
- MD5 5aa7d3b3ee559edf20e250f78ea6a823
- SHA1 f424a6e43a5a111a1504f3dc22403ff2fe14f828
- SHA512 fe2beedd16d277e4c11abd326606a665868c34e406a29047c15d0ddb05480336822d9d686ea12eaa89bc3b8c347374589343161b65d53d02d6360e86ccacd744
- SSDEEP 12288:tbsf2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T14B65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.3MB
- SHA256 24a65f2488b610938720166955e9e1a20f0c79029f65dd6786a4397d7c834011
- MD5 7c7887ee4d1b973e18341798d6901e06
- SHA1 4c410575cab2c2eef714fdeb078512a140320abb
- SHA512 70f49110732f80459631108713432f498f6002952b422f6b78b9ecbb0c810fb52e71e1b7f37d60f2cdd301391ec47aec6e1e4f7639b2a3e5bb2901abe98d9d69
- SSDEEP 12288:mWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1C9552393968855B2F6FD103985368438B54D7E2C9F5598D3E2043A1EA238FEBCF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 fee0d8d00f1852057824e10a05a31727a7ba99a49a50d1cb29dfa7524c4a2e24
- MD5 e5931130abd40692aa3bcb421cb79d2f
- SHA1 6ffc3e1116797811137806201db5892821aab35c
- SHA512 3e1227ef7c0c32bdd529b48809796ccb6b1eb1a967a9040d903b655b3c82f59c8603118fdb98c226f6b38d51b9f1921d26719acc17aa0e5be92fcb53871b3d12
- SSDEEP 49152:ka0h2GEkuAe73q3pp46zwwQWLNiXicJFFRGNzj3:ka0hNYG4JwV7wRGpj3
- TLSH T18285AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.4MB
- SHA256 c51b7fb6b9ff434a41b8eb63637bf4c8ccd30cb7a47cf21e14416f4749ad068d
- MD5 08afb41f76d3f4a643ebc4e0e53dbb7b
- SHA1 b12f134c4475a0704de14f405bfcd5428caf01e2
- SHA512 dd89018df7ea81e2510598f56981590af0e2ff55d913f2fa142d42d4a8049012f675db8022978c8bd1a69651c09da12296e2517d682f0cbf1c74115a919957fd
- SSDEEP 24576:VhbHjP5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VhbHjBLNiXicJFFRGNzj3
- TLSH T1546512BE129C20E5F6B5903D8566840AD370BC29172197EF6381527E4F3BFE94E38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 01dadc75b0e68cf89815514b303f6c37a59ea1465b5ecaa39121ee43a771691c
- MD5 1b1ab7a9f4775a83de7444be34e9034d
- SHA1 0b96948d2c90a880243d5c4d281a3d3b0939718f
- SHA512 351cfea06e87122a30aeafb5330ac8f1579cf330ab5858802a30d56e10a7d4a16f803b17c2718f2123a344adbcb413b434196f34ff9724b9d3ef4b3af701cc35
- SSDEEP 24576:x3YgnJcRTk4yti+R5dpR/x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xIgnaTk46ppR/xLNiXicJFFRGNzj3
- TLSH T1B745B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.3MB
- SHA256 c00ffed1fb48fdb6c41fba8690f27a67943a642e8244970c7bc6dd321571c6f6
- MD5 df883f89d644b661d0678a8b76237fbf
- SHA1 84b68daef1882fc07122c4a135e16fec269100aa
- SHA512 2ee73a60f0736412a45af2d7d5d4be7e94fb60159bc536ba4b1be17a082843e04966540e241979d485674bd9cb56260cc25af73da10eda761216acde57a22d42
- SSDEEP 12288:RCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1B25523D2518955B2EAFD003E86768428F5442F2C9B2619E3E1543D1EA27CFEFCF38162
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 8c1ea7f65ba808dd33ac1b8d0770fd97fb9837a03be1bcf40178c6d44a59e043
- MD5 438e8d8ab3966b211e977f710561c8f5
- SHA1 5e06a2e6613b03679d3c67d4393ba8cadca81d6c
- SHA512 ed8d726ce1d02c47ffa6ff77d440409d4696cb7b6cb0cda9783bd02e47c660f16020f067bd5def3785d53f620b29c9327f145899011d8d029e9608dcd695fd1e
- SSDEEP 24576:3bL3UTv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3bL3UTLNiXicJFFRGNzj3
- TLSH T16C850155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 94be4f3e6c29d61fd6c3c7263ad94d9249bfc57024779cf63fba79ae8ef23bd1
- MD5 e164bd9585f37510af331d7c8a547e7d
- SHA1 b1acc71627e9afaf7b88aba83d19110b2f7154e7
- SHA512 7a4a0dd451cee840ce9b201b3e6f897c0a86f1cc1d1eb53f9fb9350c4ecd172422b1bbeac2b31d8ee32eeaaf419464659f865c09111e96adc2b48d02c628af15
- SSDEEP 24576:DOz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DOzLNiXicJFFRGNzj3
- TLSH T1B865125A32DC10F5E5B9903D8AA2820CE371BC29072257EF4290517E5F77FF89D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 e0fa429f81ebb54e9bf48dc40e831a75804ac8751ce0db0b8a71ba17a3e92a7c
- MD5 9b611d894eed4a3bc1aceb63ff9caf30
- SHA1 0d8fd59c106b4a43dbf4c8fd97fea91629cfca61
- SHA512 23132ddf5d88b9c1c21598eca553605ff55e9955ff19b8f759c4ca6b1d482a4fcc9b47624148432848a7050b4e42bff913ffbe4cfad13ae81807e4aedb9c2aaa
- SSDEEP 24576:27NM9YmZqmWMUkPjZM48Mv6bEhsw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:27cBWMpPjN8DbEhZLNiXicJFFRGNzj3
- TLSH T1F865AE2E6BEC81E5D476D13DC9A28205F6F1B8611B318ACB5162833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 0bbd756c14eb68b76adf28efc41ec9bf2f2b302b4abe194403d5e7c52167dcc3
- MD5 03b27a8942dbc95bb24d4e8f244392f7
- SHA1 1e16fa9a5431875c82578e5544607537cd0c5f31
- SHA512 57da4e8fe20a746ea1a77532eb99c69fbb616f5d72ebb38b22a2f061e3bc90561037afd36db541ebd6fcbb22776fe9437ece5338670cbebcaf474b9a0de5a6c4
- SSDEEP 49152:6F2YuHNETovcvNYf8kmQLNiXicJFFRGNzj3:z6tCf8kz7wRGpj3
- TLSH T100858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 2cb0304cb55c25519089ac98050e3c92ab3c59291c8e6742f89ca1f363f1cac6
- MD5 4a2b8cc293fc05f1f6fd57f501f20e49
- SHA1 eaa07f820c2c111f66446b2679b477d25968d1f6
- SHA512 8d5fffae691dfdd7cc3e62ca0e1d62845fa91aaec3a5edfd33603440bd83e0939feaa977d8dd58b500bc448762bf965ce42def0a11bfb18adbf23b6accc2ea28
- SSDEEP 24576:8AFs06+OmlfkNXEbToX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RFs060lwXu2LNiXicJFFRGNzj3
- TLSH T1F765BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.6MB
- SHA256 913bc0f0885f2fabf25dc1cf27336adcc4bc4d21cfea4fbfaf1ee7da79dea3e6
- MD5 b0ac3649c7c54323f22e9285ab4f4b61
- SHA1 4dafe2b6e6db87287ee0133d7435f82468af1a4a
- SHA512 a76816add0235edcc519eecd44862f9491cf5ed7f24bedc288a4e586c969b7c78065cd65778a86dc1db3cbfaf4b3f4ba916ca011539e9efc72dca2fb1635ef4f
- SSDEEP 24576:iJnJ5D3Wt2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iJnJ5DGt2LNiXicJFFRGNzj3
- TLSH T19E75D02DD29810F8E4B7C274825A1A55FE72383D2F2269C724B4E5357F22FE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 10c69806e11a2026a03eeaa3271e72fb64640a78fcb37372525b903d76b73054
- MD5 0f5e46aa512f132903cafe7f547bb8ba
- SHA1 6cb22afc9097f5c0bc20a18df73999bc596fdf95
- SHA512 ded34c69659691c44cecd62918646ae6be810d30858e80594b8289c29a4e06775e3039b253d9cb71d84930a8b11c3a73312653ea0b66b713a2c1bb9e79262385
- SSDEEP 49152:Wo06DIKdwc+eQnSt65aVMLNiXicJFFRGNzj3:vS7wRGpj3
- TLSH T119956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.4MB
- SHA256 2eceece9c02a36705177be5fbdc97084914478688d33b654e3290e4d25635e23
- MD5 82288b2a787739150beaea3a37da8ee8
- SHA1 c408afa89cadbc3f34957c4a5b69d023283ca6b9
- SHA512 cd9f4efcb9767a40a16632bd9aea68b88658754f166c5b5951991cda3020939dfeb031f3ebf787d4dec9b6469d40ab4dd0540fcc633cb414f2c9a94ea1221b05
- SSDEEP 24576:8r6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8r6LNiXicJFFRGNzj3
- TLSH T1866512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 e0d214ee31d4276b1fcde78aa90b6dcf01a092c953474657250694b208b00ca8
- MD5 6df1e9195f91507f33d5e90ed9369dc0
- SHA1 a1ba37b6fc1de540d820074ad7908a71e4c74241
- SHA512 b2eb3d2062efec9810461c7bc0eab09df3eac24b1eae3f976795eb6b1681a7ff247992b8a2b0e97e9624cc616d70eff99c23a7ed9f55d68705a65fcdb0592518
- SSDEEP 24576:rIyp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rIGLNiXicJFFRGNzj3
- TLSH T1E1651245538850E5EAB9013CCA778064EA74BC349F2156EF9180BA3FAF36FD59E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.3MB
- SHA256 e0f820e486f749c4db4dc14d81ca44ca3527c43181e11b81cb17842bde980398
- MD5 a4dcfbb06c5778350b9e07e24b626d43
- SHA1 f06960663399833d0e32236193f690c3c5c2bc09
- SHA512 f14e5a3932f026d9b63645974658d0b7a762c2a454d232c359374efe19084c03c55a359093b8db42a55540d08613151ba15606b7a2d161b9bc6edf320119c5ba
- SSDEEP 12288:BFXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T12155239A118965B5FABD003D86364824F1543E3C9B2628F7A194793ED339FDBCF38852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 4def1bdb8cb50d7b5b0d8ef63b9d8071494f07c6401e8176fea0a7f37e106ed4
- MD5 ec603c675bfcc829ba9d13ed1fcc7099
- SHA1 b2ba7bcdb35461eb332a7f95f30344363fbafdd9
- SHA512 c4c5a58422e0f6bffc16e07d227afe5867dc82c01775e450689f71325cc6b16acedf268a1acb1eade160f3eaa52a0be2790b9f6f4f660ac3c08ece04f4bd089d
- SSDEEP 24576:LQ9MxZKdcz97w3Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LVKXYLNiXicJFFRGNzj3
- TLSH T15F558D2DABE9059AE177D239D5A250C3A673B4301B31D6CF2048D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.5MB
- SHA256 80f630ac987613ed61c113b9072e34ba10ef04efb89ade7118205d606f476d4b
- MD5 7fce30d6a9fa34d4d06cf5525c259783
- SHA1 5c67438a1b44c57ad467877b6fbac3d10c1b1fa0
- SHA512 09f4ffc7cd718ab2364231597a9cbd5d80bf4050cbdf326266c52fb86851a8d44489494566994f03479fc71ed8337bb408324ef2e86e274d628999b09b32b7b1
- SSDEEP 24576:iyocxAp9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:focxAp9LNiXicJFFRGNzj3
- TLSH T14965E05FB76D40A2E176813C89858204E773B4345B6257DB6281C73D8F37AE9BE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 c6c92d223022bfef8acae0b8f726848654e2995c8f4e6ec5154fa216d1a9bafd
- MD5 0794f18b0c1be76dd78a9be4328aff5f
- SHA1 b372ee0960e9c7ba0b88616a93730a3e3c1c69ec
- SHA512 f1db292841ac42a5f295bd6c412e22a37cd8ff9feda238def228b1aa78b9f9321d6cc98adab0cf8f14a1bddaa6ee7d1c7ec9733cd1b70d38e45cc1821ea43b85
- SSDEEP 49152:EWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK9LNiXicJFFRGNzj3:u0zuNIh7wRGpj3
- TLSH T1C1A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 4f33c3aad74473ac1afd336fea09f42d256d50405960e96e905904c3148c85ab
- MD5 ec146ed949165cf79852e3d284295de8
- SHA1 8906457e3dec76bacf5578a1fb1afda7b32b13e5
- SHA512 0c83543d7a315cab86ee0e307c8fd0bf331a683a5a03e5af3345c170bfcf204fea08c305b45bec9fce32dd17a85c983509772128df74ca9c11a04a48eb33456e
- SSDEEP 24576:w1QT7EcpfxR+N5AWAz3ooiYujMqb6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NTDxR+N5YzT4jMTLNiXicJFFRGNzj3
- TLSH T12355B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.6MB
- SHA256 d0b78efdd208f83324dbf9cc5341a8a4f09896f6c1b0a9fbcace7b497c091a1b
- MD5 e4f4cf24f7885039fe6942f147d33aa2
- SHA1 47f1786744cc9f863ef6f8c21332540f38ec21e9
- SHA512 f9c51fc0a504283fd198c2813740f6f6177e685347c616ce20185085975c9c11778f1eb3a51dd15dc2853a2c09a5d37378c0858eb346fb1ceec932368f16469e
- SSDEEP 24576:dTMdOz0FFS+bmSL+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n0K+bmSL+LNiXicJFFRGNzj3
- TLSH T10575E17EA39D14E5E47AC17DC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.3MB
- SHA256 dd0be545c9fea02be803abc26ba2f2c049ff64498e31c2456affd8c46e2d8c8b
- MD5 885b5226b71f5f361d32dca36af619c3
- SHA1 eff87e59d4424245d72314a125a4fc8132f5ec69
- SHA512 d23248c094bbd79dc936d1bff613f60e632ef48f8a8c4bcebc3871d932e79a60f24c3f087d21f9a41bc10504608b173d024f0881b063677aa8b73d6bac8be5ca
- SSDEEP 12288:V477iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1F755125A13D830E0F5BA5139CA364014E660BC3957251AFF31D0A97E9B36FDACE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH