Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/11/2026, 04:29
Behavioral task
behavioral1
Sample
2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
- Size 2.6MB
- Sample261114-e4kqbsvw5n
- SHA256 75018adc32647b537b57ed3b1df2ab52a6a15223e58feb3a1c1d27b915450f5b
- MD5 5029840dd42cbd645ff5289b5e861d9c
- SHA1 d7726cdb097300db157b65269ec48138cc435b46
- SHA512 43e580ce4f9ad91752b17b9157362e4b569eaea76a7e81121d98ee635f1ec1879c3f4bf0669b1e38ed89da327526d5695653f8f6e04412df391d1f8ba50843df
- SSDEEP 49152:2nsHyjtk2MYC5Gnu3T5xGrt85svhqt3kaGrt85svhqt3k:2nsmtk2aTGQsvhiRGQsvhi
- TLSH T1CFC5E122F2D18473D1731A3C8C9BA3A59839BE912E34794F7BE42E4D4E397812D252D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Executes dropped EXE 16 IoCs
pid Process 4544 elevation_service.exe 1944 elevation_service.exe 2656 maintenanceservice.exe 4648 OSE.EXE 1336 PerceptionSimulationService.exe 4556 ._cache_2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe 4200 perfhost.exe 3140 Synaptics.exe 4032 ReFsDedupSvc.exe 4548 SensorDataService.exe 4864 ssh-agent.exe 6036 AgentService.exe 3384 SearchIndexer.exe 3448 Synaptics.exe 2888 ._cache_Synaptics.exe 4912 ._cache_Synaptics.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe - Drops file in System32 directory 47 IoCs
description ioc Process File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9ad453de3ebf6fe8.bin elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File created C:\Windows\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Synaptics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Synaptics.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000dde261d2f073dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f00418d3f073dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e0c2dd2f073dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2b25ed2f073dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd214d13f173dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c2a34d3f073dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfc2b8d1f073dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4ff9612f173dd01 SearchProtocolHost.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ Synaptics.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5508 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4544 elevation_service.exe 4544 elevation_service.exe 4544 elevation_service.exe 4544 elevation_service.exe 4544 elevation_service.exe 4544 elevation_service.exe 4544 elevation_service.exe 1944 elevation_service.exe 1944 elevation_service.exe 1944 elevation_service.exe 1944 elevation_service.exe 1944 elevation_service.exe 1944 elevation_service.exe 1944 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5796 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe Token: SeTakeOwnershipPrivilege 4544 elevation_service.exe Token: SeAssignPrimaryTokenPrivilege 6036 AgentService.exe Token: SeBackupPrivilege 4032 ReFsDedupSvc.exe Token: SeRestorePrivilege 4032 ReFsDedupSvc.exe Token: SeBackupPrivilege 4032 ReFsDedupSvc.exe Token: SeRestorePrivilege 4032 ReFsDedupSvc.exe Token: SeBackupPrivilege 4032 ReFsDedupSvc.exe Token: SeRestorePrivilege 4032 ReFsDedupSvc.exe Token: SeBackupPrivilege 4032 ReFsDedupSvc.exe Token: SeRestorePrivilege 4032 ReFsDedupSvc.exe Token: SeBackupPrivilege 4032 ReFsDedupSvc.exe Token: SeRestorePrivilege 4032 ReFsDedupSvc.exe Token: 33 3384 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3384 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3384 SearchIndexer.exe Token: SeDebugPrivilege 4544 elevation_service.exe Token: SeDebugPrivilege 1944 elevation_service.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4556 ._cache_2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe 2888 ._cache_Synaptics.exe 4912 ._cache_Synaptics.exe 5508 EXCEL.EXE 5508 EXCEL.EXE 5508 EXCEL.EXE 5508 EXCEL.EXE 5508 EXCEL.EXE 5508 EXCEL.EXE 5508 EXCEL.EXE 5508 EXCEL.EXE 5508 EXCEL.EXE 5508 EXCEL.EXE 5508 EXCEL.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5796 wrote to memory of 4556 5796 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe 94 PID 5796 wrote to memory of 3140 5796 2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe 96 PID 3140 wrote to memory of 2888 3140 Synaptics.exe 104 PID 3448 wrote to memory of 4912 3448 Synaptics.exe 106 PID 3384 wrote to memory of 2292 3384 SearchIndexer.exe 107 PID 3384 wrote to memory of 1592 3384 SearchIndexer.exe 109 PID 3384 wrote to memory of 2748 3384 SearchIndexer.exe 110 PID 3384 wrote to memory of 3208 3384 SearchIndexer.exe 111 PID 3384 wrote to memory of 1756 3384 SearchIndexer.exe 115 PID 3384 wrote to memory of 456 3384 SearchIndexer.exe 116 PID 3384 wrote to memory of 3388 3384 SearchIndexer.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\._cache_2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4556
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2888
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2656
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4648
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1336
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:4200
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4032
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4548
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4864
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6036
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2292
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1592
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2748
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3040 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3208
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1756
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3040 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:456
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:3388
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\._cache_Synaptics.exe"C:\Windows\._cache_Synaptics.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4912
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5508
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 22256f7c1d1038c220dbd8334e87aaa1ebc06d274ecc15b178f0a8eb623f8bbd
- MD5 9f644fae3d123700948184185284996e
- SHA1 97588fa0f7b43c1012075757e7bf4f1812816ac8
- SHA512 2cd5d2a53196499acacd0145e6bbbc55d4e25882357c3b455d7901e79ed76d87b9ed0295ba53e53a1967bab75a95a7b88cc1a1f8b5c5c1751d22723d7b7ec470
- SSDEEP 49152:Wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnSGrt85svhqt3k:I3q6HjBtGQsvhi
- TLSH T192D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 b7bcb0475f3ca9d602d512c0c81c9b9c098089884c2cdf185a0c2b435275d435
- MD5 b3c3d4fed4db825eb8065d36ef514228
- SHA1 0c6ff16efa5cb6e23ec2c1363f7402fa5e173ce7
- SHA512 a9355398f583062a8230c9deaaeb22800cad4896e17571ceff331d8cd694f1bc6a50081f221e9076d0d609778cdc7ef9b749441a82594b25ed910f3c07325d52
- SSDEEP 12288:D1XLsswWkxy2lRq2czAx2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1c:ZXYfDtczAx2DOYt858PvhGrt3/4Nk
- TLSH T1F165F12977D408F9ED67813CC9A2C115EA72BC9547A0EACB03E499290F337D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 228ed680c09f990d8d6669285d8e5dd80c299ae14a3f841604eed35b8a35193d
- MD5 94b959c0e04adf1d3c9d606f516fa0c8
- SHA1 d7eeae9d45d9edb2d65879f119f0390860f8ed49
- SHA512 e086846c028751331ec2a7ddafaef5c8801b04bb05003bd33c288b158bb550f487e57c6dcff2c827a9f205ec17a5ce87bae704f307bc318a9c14a90347501b88
- SSDEEP 24576:50Le5ji0hmx8rMZP2DOYt858PvhGrt3/4Nk:5Pji0ACAPGrt85svhqt3k
- TLSH T1F9859E16F6748771D073C0B9C5D2A68EED7130865B308ACB4286D77C2E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 5c7e9549e80cdcf097f05a156a51baa762a49c833c84ef51fa3c1b52935ddef8
- MD5 666778be2e68fd81d9f5d0f8708e2c41
- SHA1 1a032a7602cb240154f9c33d8d28dbf353423e43
- SHA512 e0ea807c3a75c2be0b4a1a0621ce1edbd0c581baee07a79a2d169d79608adea7432affe69a056485d8fb39638b34dd25039f82ddd3eb98d3f2516b1e02791575
- SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWE6q8wyu7P2DOYt858PvhGrt3/4Nk:h/ezSC6vUzPvxHjyMPGrt85svhqt3k
- TLSH T184755D15F5788323D0B2D0BAC5D6BA99FE7230865B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 d674236e4e26f74167421d663f38904683692b0763c2168098b795be8a748f74
- MD5 4e2f9da4d759459cb485347b84f0e06d
- SHA1 b7417a5f420f2320497c7d846b2256e12bb71698
- SHA512 60d0ae4186f10bbb3a0d642f6dd84b7a84d5bc43d46ddfd0512bc5545667c85c70956807c72fd6120589c30b8587e57c84d0c3cda3b74bffecbead57bf90e358
- SSDEEP 24576:6VbqPb88hv/l+6OP2DOYt858PvhGrt3/4Nk:6VO88hXl+lPGrt85svhqt3k
- TLSH T17555AE66F5748331D073C0BAC5D2AA9AEE3234425B31CACB1246D72C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 d18e97385ecc9bf7b0b929c3f90118245dbb4a80956e3cf4c10da223b23e1721
- MD5 12eb22ad2ed806f97e4d236f6f5f4a9c
- SHA1 b7dc4f4c7e82f18ddc02035408bb6f78baa1be5f
- SHA512 f8589c0085807f6f9eac29a67052c9cfa946305d53f6b0c7646bab8ba144bd88169167e780d5e4597d3936a438ee94121b0e8017ef5650aa5835ce8ad8d7133a
- SSDEEP 12288:zjdP2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:zjdP2DOYt858PvhGrt3/4Nk
- TLSH T11B452307B68C18F3EEE785344AD5F11AFE909CE5A8C46C8B5550BA2D0434726DDEA33E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 93b5eb0ad29938c1e79e818469134623a9bd32342771a5e88bc39b09d288e1c2
- MD5 ab22a97bcf0f6a3a1f74430894d70a9b
- SHA1 db4cfba78b8536a3cfb483f17b48d1733b88abb2
- SHA512 e8d706de6fab4b31b93869617b10aae6f2a894b68e3bb3dcfbf6dbb207a7870d7d37da5c09ba21a8794f6140c4ade8c39bfb94595457870bfaefe356af740545
- SSDEEP 12288:ieBNUbTVO86UWP2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:iJIUWP2DOYt858PvhGrt3/4Nk
- TLSH T13365CF3BEE28FCE2C67A8D785B91C200E77278704F51A3CBD165830E9E235E15E79925
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 5a9753d2655251225f548ebeb7f1850a4f9af8211cd71e88d5be47925dfb114f
- MD5 c04db5fce72dce459509920526aab203
- SHA1 1656aa12e5721965bd2e49c331d2e6854307e351
- SHA512 fe70a4e593c302d1d70dce31c11de35658cd8cd45b742fa5f2d909f205216cec78326b9273c3b7dbf66988c09c2be4fa33bd9433766ae34993a89f051b53ca2b
- SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:3QvGAdlCEL8c/yRNw5CrPGQsvhi
- TLSH T144267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 a90d4529dafc5bfec2ac6af693384ac9a3868ae45b88b7b2014a1ed9508a3d78
- MD5 0cd9e54b78b80969a8cb81c76a72d82b
- SHA1 db5e7442afe0dbe16a942c95c24b50eb9e476236
- SHA512 323da14898e8bf4c8267aaa5c9c8d2ac3cf6c73808277d47ff610bc011dafd4ff4c731d5d07a953e2ce12255b46dddedd316682d71a0bdbac86e39ae0d7dedcd
- SSDEEP 12288:FAwSfxL/2Dc3ODLLmt0LDQewsAjwP2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV5:mHewsAjwP2DOYt858PvhGrt3/4Nk
- TLSH T18575E031FE74E432C7BB0DB11B26D316586CB9604F9119C3E3E89E9D59302D22776A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 90da61a31ab5761ffff36bea8ba8fc9ccf3c967baf0fe878d03e0b14a5a20c28
- MD5 219f9da5b8746abbe69e25d4597d6349
- SHA1 ef50596e23e06243bc6a8277932431417f1096a0
- SHA512 06801d9519abc92c0f09d456fe3298db8ec2521d578a9fc61d6f5e3bb4aadcc60f1873ac03383058e1989eb6d40021c528ac0295ca79fc1436796b1f0abf5d69
- SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHoPGQsvh:2UEtQevvqc2W1cpV2EI320GQ
- TLSH T1DB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 186ec076290f9a929575cbd5a4edecfa0fa8338f6d23f24c17e34a67bceb59f9
- MD5 bbec53190136a5228bf6e1d01556a161
- SHA1 64443230fc212d1ddf592cdc15f9a414fe0893c7
- SHA512 f8df53429d192b5e0bce672785aef1212dc4d0d869914ce6c7c24a5d8b384703bd05c3c1a9662cf376ba452142830956ff8b5dd81039490ae7a4bbe903135507
- SSDEEP 49152:FCbRquA/m2yL5zTfFiV+XenmE3/zQPGrt85svhqt3k:SoquVjnmXPGQsvhi
- TLSH T11FD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 78b2cce37c8547ab3040560f9604ea5c14a7a2981e706915b08a28c9ebf804e1
- MD5 0c8ad4b49404a5b7efc932828696501a
- SHA1 a64800d75ffe505dadd1f2279bdee9d7c968ee99
- SHA512 905796e6e2f5624bf40ca29a0b7cf64413b911c151b0300934265c8c9ed3db627ea103038b22b5175887b0f339d06685f230d001fc1d852d1285f089a7ae00fb
- SSDEEP 24576:4AhGLJIFoiwtA5l7S533P2DOYt858PvhGrt3/4Nk:4AMyFoiq5HPGrt85svhqt3k
- TLSH T18C359D81E7F955D4F5B3AA7899B69171EA76BCAA5E30C20F2150D21F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 01260f8de0a9c371f7b86089f7a60b82a24c6f0681094b1a88e57bd0b8b78e29
- MD5 01d2e9444bebc0a9eedd14aafe92b646
- SHA1 8baa7a7fdd403b3f4c4847c8ff285f33e377d901
- SHA512 b840b012f527f92bffebda7e00f078591b902d81a95fe7e1abfa1d1806bbf0a57f6fc206514d9b30d482ba7caca56e41ac8c96698eca77b0837ae7a78ddbec54
- SSDEEP 12288:Rmw5HEjsChNXBFgl0WDm+Co2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO2j:MwuuOWf2DOYt858PvhGrt3/4Nk
- TLSH T14965F14676A80CF9E9A781388697D136F7F2BC522A61DB1F0760C61B5F37321AD2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 758de9bcaa9fdc61a1479bac0b5348db361ff44c417657b57b88c748dd549af5
- MD5 3713e0a59ff741713fd77676b32e53c5
- SHA1 226aac3a2a4fa5591a0f93623583119004dfa1ae
- SHA512 f37f616711e90ab9bfff9e1e1fcfd091c539db9501863ce5ddd4f192f6d5daa80ed74c3ba55bd070be853561a084a6280e4c352796e3efaabc3d42d363aa5086
- SSDEEP 12288:AHZ1IygP2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:4ZuhP2DOYt858PvhGrt3/4Nk
- TLSH T17C55124A33D824F6E5A38238C9E19205EBB17CE6677547CF1660562A1F33BD25E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 31182028af522a9b1abd6f0cbfbd15063e0e40873c70486a34bbda052ce93d74
- MD5 6e0f24edccaee4c75d5640e2cdb0776a
- SHA1 b78dd72d7c6e3a6a8812a33e4e6cbd7ffe2c69a8
- SHA512 bd5ecc205c4c1633d055754baf7c5d85249358edf8e789605ea5b019408bb7d0ce3a9286b0f1b4597c5ea60a051dc3fc715b7038e21915fa36430b2bf96067a4
- SSDEEP 98304:IQRQyi36YOcPQLvw2gAf+PN3yPGQsvhi:fQyiKayX+PNCPGQsvh
- TLSH T1E2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 f8886fefc4d152b32933671408009ecc8c106d93ac544edfa1550cc147e20963
- MD5 12a32af9447485bb4d151df45b772834
- SHA1 9edf688171839a672c9e27e82ec510317d7e9198
- SHA512 3b2400b4ae12fc82a75aad24f62f3fb9ec67d1fb2719ce1a1b2c2b21fa756c38fd3f52a4f2697f12e93537e94fd0191dd2e8ef2fab058b0d968adfe6e8a4c18f
- SSDEEP 98304:0QRQyi36YOcPQLvw2gAf+PN3yPGQsvhi:bQyiKayX+PNCPGQsvh
- TLSH T15F667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 6b16ee4a60894ea6c379395131b1fb8dc85b8c17f4b4d0a32c3d53e1217a7d3d
- MD5 f6aaa96f31a4a68eb04c11bb4b40ab9c
- SHA1 c8c8854c4e5452c81005a8885eeb131b460cd9ac
- SHA512 072ab39135101188d69fd281ccb68560591c3411f3a4184ad5f996ca423a67d6879a3b415ab1241f343a58a8152ba6ca53bf2be1116e74b493bc600f96a41f76
- SSDEEP 49152:n68Qg55nhheWu7PNU3/APGrt85svhqt3k:RthWRc/APGQsvhi
- TLSH T15CB55933B2F600A9C44DE1769F4A973196D17C758FE0E3DB8511720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 983ae1a55dd3258f52ecef0711be98ac1a2f0343fdc404b0f1f04d52e48fdf38
- MD5 567b0d582ebd21621d67d0910c6b0f0b
- SHA1 f18e353dd861051cea8278621a987531b94bcf55
- SHA512 89a4f523196e911513eeae7f92885d4f81acff8b25f1bcd8e313fe255813874cd16172df45f701e9d9db44744f8942dea281bffbcfeae13d813217a8ff73d480
- SSDEEP 98304:My5112gYy5azzVvL69nLKnhZdPGQsvhi:NLIHmWhPPGQsvh
- TLSH T1A2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 5174b5094ab6ba68c4db2d89fff79dbaecfb1a5826ad16ae82a17c2b4d12c43a
- MD5 6c171399ae322c37cff334dbb7a2abfd
- SHA1 276533a40fa6e3c642162f2ab5206561f8528ff8
- SHA512 99d08778c0b698f60358277b2064729b4f6cb630401f149bca77b2da3ecea3c42d03768ff2ad6e72616b33784b2fa7cb8a3e9b8aee5eeefab792d86503fb9c7b
- SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glBGrt85svhqt3k:pu6JmVxd2dBGQsvhi
- TLSH T1D1D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 e7bdc72fafad5df2850e0612a3469f392bcb906daf991bd3761bf049a4ac2685
- MD5 c5ee33cde83168e15a9c108a46043198
- SHA1 efd90936814af0708f931507a7fe59f8721cfb50
- SHA512 e4c959fe00819f717a9bb200eb41328d6c0ebb8cf8e4834bed330ffeed71ab1f82de2978ec7f4aef325944d81b9a6a0c6db475a368760d89b6d0d183b847e70c
- SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4x2PGrt85svhqt3k:DmifPbRXPGQsvhi
- TLSH T1D3B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 f837f2b2feaadc43415914104e7a26e11f4a07647d67645adb51b7d5f323aba9
- MD5 16b28339bf9847a9f1bf67c01799f096
- SHA1 fd995127c99f68d1be287a0f84c6de7aa54f3139
- SHA512 8a9dce5ac75f9e95e65b0842e26f8584ff15a8e6a1568fac3960a3fddbc96d446b2c360ae6a163bed1705bb9d72ad4fa9c44dd804cfde6a57ee483c42946cef0
- SSDEEP 49152:0SuZQIY0Be2KRRVtOnks6NMHqhPGrt85svhqt3k:m5dKTi61hPGQsvhi
- TLSH T10DC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 c4daec69497bcc829c7c21d32fdc0a39f8a5e1fee96d1d561d2b649223338302
- MD5 134e42c27284fbafa426fdcd5e7f7837
- SHA1 51e633bd8536492078d363558cf3bb7a2cb58ff1
- SHA512 78b0300cbaaa8abc4d32df4b7cd0f5159a08fef1a1adaab2dfdc07e0f08b00f921f54b28bb0b4a77c27b1e30e3f64258c9d951b61bfd8cc1473af82d39f3e03b
- SSDEEP 49152:whtSn8EApI0figngiDn0AP5wKPGrt85svhqt3k:hX2iyphDPGQsvhi
- TLSH T1F895BE13F2D900E8D05ED178C7468632EA62BC560B35BADF0A90B7561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 cbf7b902514fcd59b2753429242462d6d19411ed9041b73eec246df882072734
- MD5 14b33cd83d2424ed33519c1026afc780
- SHA1 7e864a89446db3db3d27d040e14c766cbd8046ec
- SHA512 1bf72a731ea356d374195fd6839aae82e304b19d7ef7faa31668a481400c0dfc0d85af6dc04370a9a043405c1c3dcbbf7157822ae4a3da8db0b629aabdaf72d8
- SSDEEP 12288:ZlP2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:ZlP2DOYt858PvhGrt3/4Nk
- TLSH T1C0452306B58E0CF3EDD2C5748AC5B109FE905CEBF9C5688B6640762D0435B261EAE37C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 1eaf646145e16303c251b2d2a809078d6cd5c3879401fd7dd71bfb74830b6523
- MD5 0e80b60373be83da98ad75c2f3752096
- SHA1 cb1e6d0595d9a8ec82f9c84ebf73a02d1607d49e
- SHA512 c7c6d0610d0de9b18cfa06d95db3cd8ae6320b094e16614ea97fdc30230737c99f279d14927e5fc74ef88c9cee1673fb4e7cacf3263db374da48f433e1f4144f
- SSDEEP 12288:3EP2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:3EP2DOYt858PvhGrt3/4Nk
- TLSH T1EB452306B58E0CF3ED92C5748AC1F109FE909CEBF9C5688B6640B91D0435B265EAE37D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 7e388150e87f9008fa3f4a30bdff2307b50eab499f25054fd8f00773b4148e2c
- MD5 a00a6b2bbb294b94129b81abc62e8635
- SHA1 52ecfb9dfa3f2c27e581b109016cdb25b1354645
- SHA512 19f31f3d8225a1038ed50f9ea0cae8c92d406ffc6bbfda0fed7ab3d4471667c93aa53886fd0cd2cf96783e37e2b6734b7e461d189eb85a12fce6e92cc15cab52
- SSDEEP 12288:meP2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:meP2DOYt858PvhGrt3/4Nk
- TLSH T194452306B58E0CE3EDD2C5748AC1B109FE909CEBF9C56C8B6641792D0435B265EAE37C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 f50844ec5d6b48aa36e9cbf33d03143f89a04aa856962d9aec05a9b5c2ad97e5
- MD5 64a3c05ee1a9465a75763ee571dd78ab
- SHA1 de0901bf2a1ad4d0d066cb1aae43247fb8e177e4
- SHA512 9fe7d0a33fea981b65432b889149302edf64f1d19a2a5707379d3261f35d3becfcf173f2ca9ec00fa96006080c19ff53d89df088f7b35b452f7bd62d27153e51
- SSDEEP 12288:5VXP2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:zP2DOYt858PvhGrt3/4Nk
- TLSH T17A452306768D08E3ECE3C234CA91A119FBF0BCE6EA9169CF56007A1D0D317656DB9378
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 88e6c526927579e946db73a151d86f69c11acaeaef65f6fc834f20e9b2b58651
- MD5 df289b2b174a3fc9c78ceecf757c3a2b
- SHA1 3e72beeb7fbaf1e7f769a98eff8dbc2cae4e6f1a
- SHA512 422964dfdcae326dc94dfe519f5c67ce899abdde2fcba79c77dd5d1adeae9e1c25e5989ce42f793459f49e052ac165827a2caaba0c1b68cf2fb9740ffd6d6d1f
- SSDEEP 12288:BvP2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:BvP2DOYt858PvhGrt3/4Nk
- TLSH T140452306B58E0CF3EDD2C5748AC1B149FE909CEBF9C5688B6641792D0435B261EAE37C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 a4b304ce04dcc662232eb2dbcb07e2ab66aea8abe503413c884b776365b3af54
- MD5 48086c334456ada6b50e31e94f3c8fdf
- SHA1 d995029917accd84e3303e3241d8b3c3585b6285
- SHA512 776111596dbf25bac7fbe6a54c1a5da36b91de419d03119795c12ef2f7026ef71ecbf171fad012fef04c8f6d23826d13ef2524ff6cec4a741acf8827de8c52ad
- SSDEEP 12288:FYP2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:FYP2DOYt858PvhGrt3/4Nk
- TLSH T1C1452306B58E0CF3ED92C5748AC1F109FE909CEBF9C5688B6640B92D0435B265EAD37C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 b501d4b2fe9e7d91097491f36c429a3ca2ceb363071dbd7e19241e2d425360b1
- MD5 0cf46e2a62253b0084a25ba2784b1cb6
- SHA1 f0a561798967c307beeb89409e1f7034ce947b8f
- SHA512 baa7898161f6e0f5806b532cedc366b62e24cf384f216ff631dc56cc3c010381ed2b6711876d2e6b2f15067052a5f794e3c1db4acc3af9c73f0458c940511dc0
- SSDEEP 12288:r8P2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:r8P2DOYt858PvhGrt3/4Nk
- TLSH T123452306B58E0CF3ED92C5748AC0F119EE909CEBF8C5688B6641B92D0535B262DAD37D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.6MB
- SHA256 3664e028fff7c4055743376072dbf5dcd702718683c0a6312572d5e2e9051713
- MD5 a398c41849bf49fd4c746f20c2f8a984
- SHA1 3be90b3cdb0e14b746646a18725cd8ed90aa3813
- SHA512 70d87f0a89efab9ae074e6bb20600e4d4e59eb1181d18cbba242642d3df2659773efebbb688c27bb0dd41769c543ea6a0142ecb5f339d5b2925155ba4e05b99c
- SSDEEP 24576:hfwv6k9RX6wkyAI9P2DOYt858PvhGrt3/4Nk:1MnYI9PGrt85svhqt3k
- TLSH T12085D029EBDC04E5E1B7923C89B3460AF6B178691B31C6CF129A536D0E37ED45D3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 9e6b4f3fbfa3d449b09c98e78a397b9c379a4b5d0c2b8cfdb4c865d7e5a9620c
- MD5 636dcc91c74a570eccc933cc6ffb0801
- SHA1 53eeac3f3dad37677d82c110eea53fdf7a11983e
- SHA512 0a0e1fceb1020baaa753acb8e7a368a2424f1429dbb8592180f0ab845ff28e84e15a81b6f34d622fc5cb46ee4763dec25ee07564b0049747fc06b4bd1e0f4a53
- SSDEEP 49152:LYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qPGrt85svhqtU:vySzPSPGQsvhi
- TLSH T1BA066C56A1A801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 8adc6ed9e53cbd94db4157580ac5071da6c49daf7ab22b5afb4f3bd0326fd9cb
- MD5 71a7c72c8bc19ec87f364b9970307683
- SHA1 6cd1f50019ec8279dd52653f60804de3e9e642e8
- SHA512 97f59b1e0a45b3650bbe62c1681e1c4281931c44057d1eff24637e4c6258d80fb1586c5c7133d3d0e0f855667077063c186b00df86a85aaa021267c8fbefca0a
- SSDEEP 24576:Y47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYUP2DOYt858PvhGrt3/4Nk:Y47JUQj1irIhCnDHUPfF/aPGrt85svh/
- TLSH T19565AE1EA3EC01E5E1BA92788555461AEA71782E1F31CACF1270837D6F23ED45F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 2256d5ae15706c0fb90b7d08f8021b12a0a58bee0a7cd435c635c29270771686
- MD5 d6c4e064e4874335a7752e0a4b607bec
- SHA1 e9c39da54da6ad839542331d668a92423ae38ff5
- SHA512 8f6237c09290124b4741684b7b896716f518b99ce85e0a19ee3150d798c1af2e3379af30ad520adc5219416e11a111a919f8191c00091af6bc1ed5111c2b5362
- SSDEEP 12288:gHsfhP2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:bhP2DOYt858PvhGrt3/4Nk
- TLSH T1E855F10AE29801E9C4AE9238CB859601F7737CA597E1D7CB52C0F93E0F366905DEA713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 91e9ffe5fde113b26f23733d081b1597dbf2fd83b27de6271fe428e09472b122
- MD5 63fa9746f072ef9ef2deda693ff7cc33
- SHA1 f1b5aadf314681751b36bb55ce2e0701b54bd790
- SHA512 ee7f7a371a7be64916c5c97d5c2db257d282684c3dd668a92b2c22e12cf20cf950db4ee613f75336148b79f78bab4f09f496e5b6e3eb8cb37a62d20504bb778b
- SSDEEP 12288:m6QR48cIU3fl38asJ4KiFuZwd2jfb84KqOKuhzwIPVWOiQStMLprM:m6QC8lUP0viFef4RKud7PVxiQSyLpr
- TLSH T1CB4518007226DB4BC66950321E76C6CCAB70BD42FE08AF1772C9473FD476659BAF1292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 4KB
- SHA256 9aeeb775118ba3ca2d3ed51071fe9d10a308ac548274f3d914afdc6bbfcda803
- MD5 c1f1437ef3e267e19e2e4505eca79a14
- SHA1 144dea35eef32d6f79ce4ff91ace95a55aed7784
- SHA512 9a131bdf035cac8cd13e880d52aacf8dff5bcf232355733918da1ed2b76379e2a3d47e5bd19fe887df6ab7bff233866465bd4fffd5cb87b7837bd8e760893fd2
- SSDEEP 3:OlH/l9pRy+LR/2llAjc62ll5l3y8Dl63mCllltGlslslslslslsl6sX:KnZLE/AjtuMmCtEEEEEEEB
- TLSH T18E819298272A2E20DE95A172251843A8432AC34B2186BBABD14420A7AE0A6FA0C0171A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.6MB
- SHA256 5bfb5c93246b8850b3a86b0b0d7a96dbba0eb829b0f63b10c67a0b48e6aece23
- MD5 9a18671c7279a0904792407927611deb
- SHA1 bdd60d493e62c22e80b6a35b756c3d6a300b07d6
- SHA512 cdb37e4cd4b04f5d2fbfa6932c39eb637ff57c973afb066b4923efb7e60efa02392e8cae6068a74f80b6ee4a81b45774edeb0cd9091b0d8049fb6565ac7f126a
- SSDEEP 12288:sutLlvfei+6lI0F4LOqrJWcXzeCB9NRPVU/FVkuPaYWtl4FZHHrgUlJpVtr2gJW0:swLMMIk4LzeCnNIP1S4FZrggJpV92ax
- TLSH T142752A015177DB4FC9B95037073289CCAB78AC06FB493F06B38589399867A5EB5E23D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Synaptics\Synaptics.exe
- Size 2.6MB
- SHA256 75018adc32647b537b57ed3b1df2ab52a6a15223e58feb3a1c1d27b915450f5b
- MD5 5029840dd42cbd645ff5289b5e861d9c
- SHA1 d7726cdb097300db157b65269ec48138cc435b46
- SHA512 43e580ce4f9ad91752b17b9157362e4b569eaea76a7e81121d98ee635f1ec1879c3f4bf0669b1e38ed89da327526d5695653f8f6e04412df391d1f8ba50843df
- SSDEEP 49152:2nsHyjtk2MYC5Gnu3T5xGrt85svhqt3kaGrt85svhqt3k:2nsmtk2aTGQsvhiRGQsvhi
- TLSH T1CFC5E122F2D18473D1731A3C8C9BA3A59839BE912E34794F7BE42E4D4E397812D252D7
- MD5 SHA1 SHA512 SSDEEP TLSH
._cache_2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
- Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-11-14_5029840dd42cbd645ff5289b5e861d9c_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
- Size 1.3MB
- SHA256 b6a02e485b590d69b92ceb725c7c24e4b79206855e06d315f2ee4bd3f7357b99
- MD5 224824103546a4076d95f44a5d274f45
- SHA1 7bb8ae3be5f388bbef4414866fae5b656c8af29f
- SHA512 c344b3beabbeac081a27ac32fd5874a84121f74efafbdb20962b96336ee91945d5f5a8750d57cf7f2ad06b0432c9e394f555c124209b78225fb6e4c54c18ac6f
- SSDEEP 12288:5cnHwAlvrT9rnx2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:52HVZT5x2DOYt858PvhGrt3/4Nk
- TLSH T1EE5512117280C5B3D8B7443444E5E279AE79B8B11B9578CB77983B7A0D343E16A3A3CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\6B495E00
- Size 24KB
- SHA256 06eeca4ad77183ae247cb2d4ae58e75be626987ebeacbb1c3075e8038a0b7bf6
- MD5 4a1c735f6fc0dc05b4959ec0e53d7a91
- SHA1 f97df2752bc85dadb2aefe5962be8776bb982574
- SHA512 9e05a93d17f863842039a6464b4977e8e8f1c3b4ba3c57cb5bf4bb4e48c4b11d27eedf78ba3e3b2d6bc2ebbc9d8d6ddb02bc2eec3f39557195b7e8abfdf45c40
- SSDEEP 768:M/AIFyLzS4o5blpmQSOLB8TxFZ+gkZ7ZRly1wpZ:M/ArL6IQSOBqFh+NRl+e
- TLSH T144B2D01CD81BFC1AD47ADC35821820F3398D25D9D01AEE4F8A5CB1CA62523EF236D25B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\6huAT2SF.xlsm
- Size 17KB
- SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
- MD5 e566fc53051035e1e6fd0ed1823de0f9
- SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
- SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
- SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
- TLSH T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\9ad453de3ebf6fe8.bin
- Size 12KB
- SHA256 dfdc3c980afe296b2841ba191f9a324ecc6af48721cc2f26cbeb1bb307aad29f
- MD5 cbbc02f40ddbb4354c84cb50794ad88c
- SHA1 af7c63afece28b5070d73ac7958ba9310252ecd8
- SHA512 4c99d5cc0c9d74512b1340767b955f7e98ff8745453dc0f1b85069dbceba0280e2034715dd8d50646debaa29ebbbb1a456c517a2613e5614d40d885a1e77bf8f
- SSDEEP 384:e/b7t0EBPBefPUpnh5tcoGNhGtVXi1Kf5oDO:SpsuntcxLG/XpfSO
- TLSH T1DC42C045B2BFBB521DDAB9B15642FC17DB0C7F4328F434B0A5E63888A6C018C404F28D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 8d37e3887d8405b3ba22e3e1afa779b31e73732c1dcbd20604f1b14a74975d9b
- MD5 804f4b382cdc860747901e7706b3efbd
- SHA1 77fe2e7ee57fc76c555b1aaeb87e308648df1256
- SHA512 be02c3b1d9f52e5ca4d733fc43db032a539bcbe809eec0b93dc996d9c8ef466440603c12fdbf163f263d65edc747ef1511e73123439a6d58d49efe0c98d6d228
- SSDEEP 12288:US7K2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:jK2DOYt858PvhGrt3/4Nk
- TLSH T18E452316B68D0CE3FCF6C57046C9E125FA54BCF9AF84A8CBA500761D0430B959EB932E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 3ac8983041f4f6d7703f16aaca7f359fa199b8a5dcbd36f6decb1fb1f83a9d19
- MD5 b0034a014ed46b2539cbac689820bec3
- SHA1 7de686a62d4646e0c030a4dfa98a635e5ebb4550
- SHA512 5ec12c1693d62d467acc50fd496b2840c6d1b48c098a730693250dc58f87156587e2201a5d72e2377cbe8b50e26169caa5697574bd37d408c7d836432c3856bd
- SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bY7P2DOYt858PvhGrt3/4Nk:Wgb4mBIBhGFUPGrt85svhqt3k
- TLSH T170659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D6DF1151422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 538d514f02b7988607f4259e59d0914c157a616824d83afc85b31f3a036b4ce7
- MD5 df9e6a66c7d3926bc6322d1184ea7c42
- SHA1 91271918ba8265da07e698be3afd55f792628387
- SHA512 d8dde4fcbed85de4100d954f574f9fd4e72126bb0bb7eee1f1e434ecc5713354153086ccf5901298266bbfc1b0b69b2ce944f1ed55f5ac033816ad08e64a6a81
- SSDEEP 24576:LG88u8FpJqH1dzria7/mkP2DOYt858PvhGrt3/4Nk:K7ZFPqVEa7/TPGrt85svhqt3k
- TLSH T15D85F12576E501F1D4BBD1388A824663F6B1B8250364EFDF07A88B551F23BE50B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 548d4033bf3f525d6869ba15d47311986a2b9c3716157cfade4843258ec2e672
- MD5 c2a4c7c6c7948cabed625993c447b13b
- SHA1 cbe9b220cce3cfac801327cb82134eb5ac9d89b8
- SHA512 99c9a50dc33036f3bd65a26edc6bfd499f561cee64aa62ad83f28d0cc347e052fed0954653162b390df7a25440f3900884e7783fd827416a9fa312c0d2842cd1
- SSDEEP 12288:rHvUrBFrEjwaQD2xJHuYLR8T5l6Smjjx7JhhErt/Zq6x/4HV6l2FO25e1Sb:rPUr+NQD2DOYt858PvhGrt3/4Nk
- TLSH T1BB65E11F62AD1CE5E676E17C89828219F771B8A2175196CF02D0913E0E37EE8BD3D724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 c77eb7e829b927f421591144458e59444ebe8ad315dc779563fdcc3953506001
- MD5 cfbf6a33321acd98b0395775a91e0100
- SHA1 fd516df79e4334117adac5e4a17cf5dccf52a4ff
- SHA512 28ab269e9f0ea2ec2573602d30d719ec021cb6be4aa89c8ae3c6a491aa788d6670cde232b3d271f3b16854e8f1a11389e234537c82a2f172e0de8b9366f45fc0
- SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYPGrt85svhqt3k:zG05lO43bVPGQsvhi
- TLSH T171D5CF6E62EC11F9D1BBC17CDAC6460BEBB23825032556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 d2c3db82dd8ab3ae4047b1b8aada32856aef6f7c725f98ebdacd9e6c6a8d6a80
- MD5 38550ac9a131436c1eb337a973d30991
- SHA1 a2afa1eaa9be1e2f67c3395760f441f06a0fac7c
- SHA512 28adb0ac67a90aeebd5777aec8d7b3df37e528355a47aa056d37e5a3c3d8211590dafa9f538a847d95d4876199133ea4261110fe1501a45e215f1a0ec51bc84e
- SSDEEP 24576:ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnqP2DOYt858PvhGrt3/4Nk:na5POZ3+Jt2pasx2+mAPGrt85svhqt3k
- TLSH T17765BF5EA6FC00D5D5B9D17CC583861AF5B1346653319ACF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 46a5f782d8ad73cef36f93fc06d94199842077f28b08c0777f9ac56eb41ab69d
- MD5 90b738840a176c5debd16de01ee37fd8
- SHA1 e2c5e96b4aff12d1896d3314eb22b83e74fd4a78
- SHA512 04b0661998b4247c1e97d593288e6a498cb447983791f0c19e7a0e8845781eafb4fb5671afe80b32703c607758f9fa595d15c9d50c6704bacadae580a2dd0dd9
- SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkMP2DOYt858PvhGrt3/4Nk:pNc/zEOVHFzPGrt85svhqt3k
- TLSH T1FF858B1623E901E4F5BBE1BE89679546FAB1786513308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 67a4773cd5273a20a8415d1e104c0e5ef3f4e71bb66de1d49574a96c102a3c02
- MD5 f1d3e4fadfe4d8b68830ae9764cb3994
- SHA1 8afeb3b935cc6c23b302225d829ed82281f12b6b
- SHA512 5f3c6dfb047f0fbb96ad2377ade23dcf9346fe66f47e8b4a38c02e74a4a937aab614aee1baa7a20b28f59d4015a708436ef18d31c5a8be05928d8d6cb20dcb4e
- SSDEEP 24576:/8kNvNnaFeYhJNtmZBmF2DOYt858PvhGrt3/4Nk:/8MwBtOmFGrt85svhqt3k
- TLSH T16D55AF6EB6F805E4D1FAC6B4CD238512FA727861173292CB5290C13F0E679D89D79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 fc8492db208f05d5f6d628ce4078996e8f5297a3140de77c8458b3727d1595c4
- MD5 552b5bbe34fb9fd9656e00841e923aa9
- SHA1 8b785f2128393761198400fa2a3f86fda86d145d
- SHA512 c6672397eec402fa3f84fd78238e7b1a2334b405e4af56dbec9de30618a06e5ea46b5212cefb047464452be7f17e86a45d08dee408f4762682048f0f2e1d80c5
- SSDEEP 24576:tD3FHshBIYQgAFP2DOYt858PvhGrt3/4Nk:tDVHeBIAAFPGrt85svhqt3k
- TLSH T12175E13EE69C04E5E57BC1BCCA938606E77138E9032169CB12D4917A1F6BEE46D3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH