79713e52f5ee772d67e9f4b8ec2c7f3330a85da3de08ff10e1443ae0b4a5b94e

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
Size 3.2MB
Sample260527-twftqset6y
SHA256 79713e52f5ee772d67e9f4b8ec2c7f3330a85da3de08ff10e1443ae0b4a5b94e
MD5 aa548a58a16dff9181158e9fb8b8c251
SHA1 8d64de72eb08b2b555afd23c4af9a16a7d218cf4
SHA512 250639f0ccb1b24c83fd94babd6cb5b3f2830c0eb5fa88ce709ad99517d47bc1cdc25671cf3629b5b8fb55b2fe4231dc93129eb87bcde3dc3c650291fd5799a5
SSDEEP 98304:DD/JbJO8uWm6BU2aJK06nDrEVDYcHKuPVUwq8ejtTT:aiRaI2YcHKuPTy
TLSH
T1E5F5C07D7AA19076D67236308A4EE3BDF2FAE6704D79060726D10E3D6E34482592C36F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2376	alg.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
3132	fxssvc.exe
3760	elevation_service.exe
1468	elevation_service.exe
2688	maintenanceservice.exe
492	msdtc.exe
3068	OSE.EXE
1308	PerceptionSimulationService.exe
924	perfhost.exe
776	locator.exe
1604	SensorDataService.exe
3800	snmptrap.exe
996	spectrum.exe
1624	ssh-agent.exe
5000	TieringEngineService.exe
468	AgentService.exe
4540	vds.exe
4944	vssvc.exe
3676	wbengine.exe
4904	WmiApSrv.exe
1280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\485bd521e7fc2e30.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_161703\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_161703\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008975ce9cf5eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b34ce69cf5eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed5ef99cf5eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009bc2dc9cf5eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e63bb9cf5eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
Token: SeAuditPrivilege	3132	fxssvc.exe
Token: SeRestorePrivilege	5000	TieringEngineService.exe
Token: SeManageVolumePrivilege	5000	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	468	AgentService.exe
Token: SeBackupPrivilege	4944	vssvc.exe
Token: SeRestorePrivilege	4944	vssvc.exe
Token: SeAuditPrivilege	4944	vssvc.exe
Token: SeBackupPrivilege	3676	wbengine.exe
Token: SeRestorePrivilege	3676	wbengine.exe
Token: SeSecurityPrivilege	3676	wbengine.exe
Token: 33	1280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1280	SearchIndexer.exe
Token: SeDebugPrivilege	808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
Token: SeDebugPrivilege	808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
Token: SeDebugPrivilege	808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
Token: SeDebugPrivilege	808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
Token: SeDebugPrivilege	808	2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
Token: SeDebugPrivilege	2376	alg.exe
Token: SeDebugPrivilege	2376	alg.exe
Token: SeDebugPrivilege	2376	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 4496	1280	SearchIndexer.exe	105
PID 1280 wrote to memory of 5060	1280	SearchIndexer.exe	106
PID 1280 wrote to memory of 1812	1280	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_aa548a58a16dff9181158e9fb8b8c251_darkgate_elex_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3376

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1468

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:492

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3068

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1308

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:924

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:776

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1604

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3800

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:996

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3460

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4496
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2860 2836 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5060
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2736 2784 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3a78659bf49b3f55a867bb6471cf23ac44b5ee0934a33d52f2d6ca759203b8c1
MD5 03920fb975eef926cf1bbcaa9b7cc126
SHA1 3feedb967cea926505bd805c0fa2566d4f46d132
SHA512 51849c26f68462091561acd78eedf5dadb6b713282188d8a4168bab52670bb4c4a68d9d39474247bcc90602e3c3bf68711b8588dcf1a8b29e5435465e2741a7d
SSDEEP 49152:Ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxnMPVUwFM8O125itTT:Q3q6HjBpPVUwq8ejtTT
TLSH
T14AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 536b44069b86260ad27b3c1e5d1a6dc7be73bd54881be10712d600169e671357
MD5 948f445dd3cd86004d216122a575b954
SHA1 b0560301138677832556ebe1a98dc31e709b4b7b
SHA512 960344219015c8d3c37abea6f967ba805a91437703b8b5a82c02c4dc209bb5a6a4e4869a904351e4c92e8fd303e3abeb91f323766b1024320db70d4f1a40ae43
SSDEEP 24576:YXYfDtczARPP24PsyR/tM8O12qWe+TJgq8rTT:Ptc+PVUwFM8O125itTT
TLSH
T11F75F12867D508F9EC67827CC8628512EA737C514760E7DB03E0EA6A1F332D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 44ed8439c8df1eb5596a4da6001253ab63a39cdc9a0d13b3443cc646d9eceb62
MD5 7a4b362684103b0592a93999ae10c53d
SHA1 953ad9dc75106e1a9b6b47b65262826cd209ce4c
SHA512 1f5cf303802530e0e9afb19e5573369dd428d7c98b3fdc733c1db3dc3c3f9edccd6f91535077962fdf97824413f29550f31da614d0f61f5ed34a710249c2d700
SSDEEP 24576:s0Le5ji0hmxrrMsPP24PsyR/tM8O12qWe+TJgq8rTT:sPji0AFzPVUwFM8O125itTT
TLSH
T181859E15F6748335D073C0B9C5D2A69AED7234825B308ACB0286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 36c972acf8102d0646ee687b8afc9a0ecabf72356ccb175008d05b832f069072
MD5 1ccfd29d4e85f3eeeddf40e3c394add6
SHA1 4ead9ef86eb30d22553dc3fd3ec0d4346ee2baa8
SHA512 f77550453e1e3080b241e7d2871e3bda759bb6ed89ad928c52688026cdb4a438dc50da72793c10cf5b1b39a808b1f69c3743b9254528cfd5ac801b44639ccc59
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWE6q8wyuCPP24PsyR/tM8O12qWe+TJgq8rTT:w/ezSC6vUzPvxHjyfPVUwFM8O125itTT
TLSH
T1ED755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d2324cd6449de35cc283a5d2091801328e0d960f4d320e99cf7ba475600eea63
MD5 4eb23c046722f173099fb8796c85c245
SHA1 643e7fdc2bb3c0bdf1dfc7055fb684af3fd60018
SHA512 1dbf6bdc08015f98c8cc6388cf80b7039165e8abb45a511a33d74106dc783a2c5b89deea579450891f492fea87bccc04e00e7f8a4ba4fe23085f029fa112885c
SSDEEP 24576:7VbqPb88hv/l+69PP24PsyR/tM8O12qWe+TJgq8rTT:7VO88hXl+APVUwFM8O125itTT
TLSH
T18E559E65F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2ee9cc4dfbb85a24d6715599951bf659b157aa02c396768a5448d861b0e79677
MD5 e8571f09f908f551804b01942ffedff8
SHA1 55f820f248ddcf44671721ee7163fbbf061088e0
SHA512 58bfd4b82f5bcb3105fb90c2ed1b9ca4b0786ff1adaa3f47cc96c8e05f919d28f45de4fceedb4347269505de4aa426c331c54eeb1b8003190accc42ed68286e2
SSDEEP 12288:UjLpHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:UjIPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1625523444B8604CBE9770EB8A91A5093F97E3D209DB776EB1082FE6F0E781C0D51EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 45c03967828a6298ba427dd7611832aba62617fbdf73dbee60f1cb0615e23524
MD5 7c5905a560108b9ca34b0891d00ba795
SHA1 22ce989a1f007a7ccbad8f46951f6d80df2ac472
SHA512 7f8617d3e76fa21339fa2f4946876f98294d1bc61ce3a0044ae94275f65e9a580cb0d09621ec3d70c88128505554a5d51863cd6b1110ec614e1d6ee00248f7b5
SSDEEP 24576:tJIUlPP24PsyR/tM8O12qWe+TJgq8rTT:tJIURPVUwFM8O125itTT
TLSH
T17775CF3BEE28FCD2C67A4DB85A518240E77278304F62A3CBD165C30E9E235D15E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7e06500091f037d0e0c63e6814123b3a933ffbccb0d8c73985e50b8607a77adf
MD5 348c52b87c8b167c154ec9f44efc328e
SHA1 bbaa3820f38277ea1c2f8ea37c95cf90520f5b47
SHA512 20fb6f9a10017cca6eb24865532e92060969acfa553e1c815e2ea9e746a1ab7a5e5628c828dd3a9fa549fa47d2b0550b607a99adb7bfd149616cdc9ed56e1d3f
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:zQvGAdlCEL8c/yRNw5CePVUwq8ejtTT
TLSH
T108266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 47f4beda06b8b29c5617d667389822b96a282ed1ba525a0e0c65ed53dab53271
MD5 9429cf3c4972ab07794a9f334d01af58
SHA1 3bd599c72d36311867a0acdf6f7b518d6a86a8bc
SHA512 c43d069324aaaa9795e4466cf206cb90918d80060d2ed9e2bdfde2b4317e2858881b4b77909000fd00c730d7a89b05d07121991217ea777fd61112fc5297f7c6
SSDEEP 24576:vgewsAjTPP24PsyR/tM8O12qWe+TJgq8rTT:oljDPVUwFM8O125itTT
TLSH
T16075E030FE75D036C67B0DB51B26C316683D79204F622AC3E3E89E9E59341D2277AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 74713d29659be702e3db26a3819fa290c39067ab3cea5589cd65f6957d114761
MD5 00f828a9792d77d3bda69d1f6ed0ee1f
SHA1 9159f6e3aa0e758e8fbcc5c072c2d2237ee114c8
SHA512 da200ce0f8aa2e47b183f588a58184a32e32d6a28d690c8102565b269ad05f5386319f980cb3a03a3e24c435f786dcfb7004923f6a22d7118840d2a395c894f4
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHLPTy:FUEtQevvqc2W1cpV2EI323y
TLSH
T1BB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6eb06a808f797bba4b90f2b4f3f660e6ae5045288fbeff2f4cb3f7fa4bee7359
MD5 4c412b8c91a208f5f4178f7743edf738
SHA1 b08a83b73ad9cac783cf771e1fdb76a4db77b0b0
SHA512 fa634758f9f4a49f2e107ee9f7e8506abe1499642cdcffaf5947cdad7b7dce6fad9a5796bdf8071fc034b356b88ef57deb800c25be780893072ce3c4eb97d235
SSDEEP 49152:FCbRquA/m2yL5zifFiV+XenmE3/zjPVUwFM8O125itTT:SoqHVjnmaPVUwq8ejtTT
TLSH
T1C4D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1ea5ec06558fc1e53e3405e4b44909a189fb46c6cbecc3640d17d79dd3618056
MD5 4014046da0bb0c6f40a8137593d5965d
SHA1 730a3997bc721f26a3c90d7cdc43aabd727dfefa
SHA512 07717e919d09b080fe4c51e00517c18de952707af2f749e75031f1e5bc8db469e08b55c76c87371e0d4d8fb3bc2e4f66c919f98d3e92777945fe11d48b601f49
SSDEEP 24576:kAhGLJIFoiwtA5l7S532PP24PsyR/tM8O12qWe+TJgq8rTT:kAMyFoiq5qPVUwFM8O125itTT
TLSH
T13735AD80EBF955D4F5B3AAB899B68171EA76BCA55E31D20F2150D11F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 947846962f3d6cf42ae0921c8515a2e714e6661fa7017b38e90a910e9caa30e7
MD5 dc63cc319fc3c16e7083286d346a5b86
SHA1 feeef191c836ac78eaefc89cc0a5b869ea1b9320
SHA512 de8f525f5ee70e64fe17134a26a8b3bed8642a823a7152dd63d15e654226bcc581873571831e3b69ed582f6383b4b58c5f4e827467e69d3516d28438f6ae9ce0
SSDEEP 24576:XwunOW3PP24PsyR/tM8O12qWe+TJgq8rTT:XwMOmPVUwFM8O125itTT
TLSH
T1BD65F14967950CFAE9B74638C5578132F7F2BC112A21D71F13A0CA5B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2a4d33dd83f530b607519e1db2ee77baf93001e184a048601def8c87fee3dd84
MD5 62f541110b66e1e2a21d33b0638c182c
SHA1 a3a34c41f99acf13a8415d7a9894e45608689d15
SHA512 54cd9887c66f7452f4f3bcb9675e6a150d78cf49e5b6347948f83eaa8da73bc2462f3b9c2a08b11889d60c60e7753ffce92e2a579082707d71abe34c88c34735
SSDEEP 12288:4HZ1Iy4pHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:wZu0PP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T18955124927C520FAE5B34A7CD8A64142F7763C22677263CF1191EA6B1F32AC15E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3ffb096ee47b91ec4f1b27ef6e83d03591eba37671e03f393c32e8a6e99fadfe
MD5 60430064694fccd0c93c76df31b31740
SHA1 1b6e9e5d8fc6de3225bcca692e9d03b4ba2fa341
SHA512 49b1e414b6170b8725c16e7f1be97c452ac921fe45bced6a3a9e2e5ef16187d6ad28b41ea9ae45a2f3cae905d117bd626c959aef33eb2a85fc814cd5dd936166
SSDEEP 98304:EQRQyi36YOcPQLvw2gAf+PN39PVUwq8ejtTT:LQyiKayX+PNtPTy
TLSH
T1A7667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8552280dfce5d0b45ea7beb1a944194bcff8fc5e4f858ead4966c94120edddac
MD5 7aadfa1b29f2ed53d40df9b9fb85356b
SHA1 06480333a8d639749cd69574df145f4af2b84a9c
SHA512 188bbed12fc5409334e7f96122068afbf06d048b4f340c1f151b7f11d94cc62a1cb6add51d75609ff444b06cf71180bc5d13cfdf341dbe421efee00bfe1b05cf
SSDEEP 98304:GQRQyi36YOcPQLvw2gAf+PN39PVUwq8ejtTT:tQyiKayX+PNtPTy
TLSH
T13E667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 96b012a4fea11b8ec67afd158adac35f7fa4c6fb4f7c4b3b8ad17bacf87df262
MD5 4f87a85ff7146d499020254e33782f34
SHA1 6a28c216cf59bf01ec57447d5f150f64eaef727c
SHA512 0cd368c2dde523fecddcdf46a171af0262ccba8804e5cfe372e4391b462c9876a5bc4c56418725baf33d23f4aba7aa4b8f1a2fc75c4e5bbf26d48f6e70932853
SSDEEP 49152:o68Qg55nhheWu7PNU3/zPVUwFM8O125itTT:ythWRc/zPVUwq8ejtTT
TLSH
T1EEB55A33B2F60099C45DE1769F4A872196D27C718FE1E3DB8141721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3d13eed53f24c2c0f7594a0015c6dced5480a1d115c4a4cffc1ec0d3b8dec7ca
MD5 ca5604be5af43894fd47caa60fc446e8
SHA1 17bb43e761ff0abf2ee0beade2092f1849f59c58
SHA512 ecf38efe756a8aff89270d67ea1297a99ea0c8179fef28a3ba4ceabfcd7d0640370ca4723e97cc722da91424e61ba82e9fad34965effecbfa989763ddaecf6d8
SSDEEP 98304:dy5112gYy5azzVvL69nLKnhZIPVUwq8ejtTT:ALIHmWhiPTy
TLSH
T1F5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 44a22d4c0e4c9d553413bcc7d51837faa659788964121ec793cb9e23bb93895b
MD5 40886a20409d1ce4071e861bf0a924af
SHA1 4bb3d3768deb31aea0dd98a227887205d1f10f49
SHA512 8c3eb421c9bff74b22b8227c93115809cf52d6031d8882fba7c99de856fe929cd45481a93b7bac8e926c718a52556ff028337a07436415a3c8f99d01b83281c9
SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl1PVUwFM8O125itTT:nu6JmVxd2d1PVUwq8ejtTT
TLSH
T16AD59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 89ca02abaf56ab481862c487f9769d035583e2a73670d62d31fba2bdb180a34a
MD5 fb7fa44f022369621c79316cd3a1d6f0
SHA1 8a122e592e8a8e62df5e35368a9cbf00070cb7bf
SHA512 326dbdaa892fde0b8ebc9df953bd88dc8e923068fbbfbd77796361cb99e571d881dad2defc2e9e2c052d458336039912d07c4a797d153b170ef390830802b61e
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4xxPVUwFM8O125itTT:pmifPbRaPVUwq8ejtTT
TLSH
T186B5BE13F2D900E8D06ED17887569232EA72BC460B35B6DF0A90B7961F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 34eaf7819223c951381c07ced361cfbb79b4e34e64e6ec3599f39d56bdb531ad
MD5 78de25614f94372dac8f061fb27c41a1
SHA1 3f58fd7aab264ca42fd397e11b17761b175f9274
SHA512 4db5fa3af0857c7a7ae10141ad9be7e5d5962cf38e77828340584efb59237f0388c9ec126174df9f148eb271154d354cc5c56485dab5c10bb863dd93f8fe65f5
SSDEEP 49152:TSuZQIY0Be2KRRVtOnks6NMHqcPVUwFM8O125itTT:R5dKTi61cPVUwq8ejtTT
TLSH
T1DBC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 30f6b9b378d72739c75ed4d134238b6deb531647e2d31510bb27f9dfb293d7f8
MD5 51839f7c393ac95477787a43b758f779
SHA1 8b3d9bb76d02a30ee197b83bd332c51421980a59
SHA512 ce776fa089543cf5e3c9546e92192030dfc759391a7fb2e1ff92c6dbb87ab26d3d70fc9fb79a0caf4f308c9a0fe565e7228285403914e1974430f7e796f4445f
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5wFPVUwFM8O125itTT:ZX2iyphGPVUwq8ejtTT
TLSH
T16895BE13F2D900E8D06ED178C7468632E962BC150B35BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 64612a5fdbe4393318d4450917b80f95afcffbab5942b57087b9cc24e748d6c4
MD5 cde9074f4cd0517f43009ea846df8916
SHA1 dd335104285ec9c11fb8f061b59b78da84fed405
SHA512 12ffed5ae2fee2993a8d1cfd6c77c32b6e71ed561bb3d18087b3e8f69558e8de9faddf0b904dcfe0f2b4ee8a16d57903e7741c9449202474591fd7fa20fc69d0
SSDEEP 12288:rzpHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:rwPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1425523484A8704CBE8770EF4E9161092F97E3D65EAB772EB2083F92B1F791C0551EA5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3f53059c5cb4b2c2d3f9b74238b6262f9dd9027a43558925f01319d9cc52bc4b
MD5 477d52befaabdc6d2e43167c7fa8862b
SHA1 e40b144b33694417b647cb02c38c907fd5e4be5f
SHA512 10c9b5a71992ac09728e223253d5cafc31076c9907b39c54ba8ef8b7d8e2378a742599f582bf31da94a3a147754752175edd582903bb91e51347dc057ad24324
SSDEEP 12288:pspHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:pvPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1F95523484A8704CBE4760EF4E91A1092F97E3D25EE7772EB2083F92B1F795C0551EA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5e1b8ef6dc2e1e17f0c148574714f2ed50a2c7794d0bec7f15c3001d5786839f
MD5 ff8a79a1a24bd63a44e2ccbe454a75fd
SHA1 1644bca7d2c97d52dbb8290c160a38ca93489ac2
SHA512 0f23f55b17e7915565a744e0a024f4ae4ea7992e91c4879f57650c67cc36f74601a6e49c41c8d00083e981da7922bb5128b5416277aae3d0f3a4116f86c6cf1f
SSDEEP 12288:T6pHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:TNPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1CE5523484A8704CBE4760EF8E9161092F97D3D65EEB772EB2083F92B1F791C0551EA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 dd65c3586c8a16cb1063353e5233a16c647bbffe596f5d969e9947b2c1bad50a
MD5 9af10b61ba83ca5e515c50e4b3b0a2a7
SHA1 344b8df5914429c681dc94149440858cd953ae88
SHA512 639a8c83f9b21a8199a4d0b798e127322f2729a76f8981baffdb2967ddcfb85951ca5199275a6ec7d6f6c7d5e25fd42bdfbb6b542fcc4cb3926f023926b3069d
SSDEEP 12288:LVBpHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:EPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1F05522445B8600C7E8779EB8D9265052F6BA3C60AB7373EF1182FD6B0F752C0992DB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 de84e7501a3bfb4061d858e6d80e003f21b548d043313a137211d08f0a6bd061
MD5 899cdad6470a4c557e78ecc054bdb8b6
SHA1 6cc5be5b5cc91a976bd7f9cab635b082f3bc1626
SHA512 7fc1e0dc89f3c1b7051c07d792ada27a3b9b7bdbc159306dfc91f2479598febd2c325c7adcd223916de12008fc852ffe9d8e6e8c079195cb355dbaeccfd4547f
SSDEEP 12288:BZpHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:BuPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T13E5523484A8704CBE4760EF4E9161092F97D3D65EEB772EB2083F92B1F791C0561EA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 91645677e9b03c154186f9f480f98d6fd4f6ce54e4ea2cfe5ab7c91ea500d531
MD5 0d5e2b6b77e5ebafe4e106a3d98670d9
SHA1 88d155361018b5aebd15b8aa9eaae22026a9e1f1
SHA512 eb1d76d18a964216e6c6d9aa554e855081971dfba35802df1ead82c56eaa4a1e725c1e2282f8bff4b16805f4d17c0cb7798f5956b3c81127d41e91fad68e7543
SSDEEP 12288:IwpHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:I7PP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1AB5523484A8704CBE4760EF4E9161092F97E3D25EE7772EB2083F92B1F781C0561EA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e423c8f834b372dee9a8a984652e4e56556941889194476e0525eb42f541067d
MD5 c345d1b374cc0439e53ba9ec77299d21
SHA1 d8d5809bb848a7fa66404570a42cd944d7b70adc
SHA512 444b6154f2bed8efbf4afa59dd22df320fc6bb1d5bae174f10e071d260bf3fc1bcbf10f973055d02e10bed83e484c59edfcbfb69930ebf6453645090bd2114c6
SSDEEP 12288:AEpHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:AHPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1FA5523484A87048BE4770EF4E9161092F97E3D65EEB772EB2083F92B1F781D0551EA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b5baae45dd865d8529c8549c5b8d1e8aea0e1e3de79f46197fd0acaae57e7a43
MD5 4c4fe4282f837a1999f09ee48ab43c1d
SHA1 b0f49688d62cb71215994af3f304fef3da0a4c35
SHA512 54b89e9cc3037a6d7f250271ec6d40cf65a466362d4dbde98bf59a051650b8cc37b6b50478d3b197cfeba04089b7b5b40afb730b38c5a43fd8f6306e94093843
SSDEEP 24576:LZMnzFVSOPPP24PsyR/tM8O12qWe+TJgq8rTT:LZMnzfrPVUwFM8O125itTT
TLSH
T19275F194B39008F9EC77867DC9158906E6B27C294B70C65F13E4762B1F333A11D2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7b2a38a1c73ff666b250f5b31d5fa7daf9e27070d10e188e3e208b91252b4c0d
MD5 8ec186e77a05d2fd2f161334432e50b1
SHA1 6e02d134a373c2a9aca58d09eb2a28c25e24d13e
SHA512 3d8b2b53fafb798bbfd313473f16ba6432c25c9029c0c738ed6d5838a611b01bc25ef50f805caca447dff53e6db1e6bb92227f81b468431d1df5d6852591e587
SSDEEP 12288:iPpHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:ikPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1335523484A8704CBE8760EF8E9161092F97D3D65EAB772EB1083FD2B1F781C0551EA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 29510585f1705376a6e8a8e9bf47012596d5240a65806889dc035c2be01eb683
MD5 d1dd442d2c5cfbafc7231cecafb5b90b
SHA1 3e3217880d5674f78bb29aeed3adf0036e2fa82f
SHA512 81b487e92910261eac68b225e367e5c59c0d39f8a8f7fbb3ace173e54af0de149b07d2f5e2d6314efde6a93675405e8b5a45c064af0eb234ad6bdf59dae0ee57
SSDEEP 12288:17pHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:14PP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1C35523484A8704CBE8760EF8A9161092F97D3D65EAB772EB2083FD2B1F781D0551EA5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9fd4cc95cea328a0287a53c75a270fea1c7aadb7f8fec0e9022f79b7d4ff9c39
MD5 19055d8f537627820a9f2a92af8e1146
SHA1 858facea715f45814cd22b6635044e9fceb9d953
SHA512 c5b8f361a3b82520bd21adc1a71227f1c01243897ca4cdce1de184dfaebb53628164b57c23f33271b1cb3ff57934497ab00e0ee3d39f7c56bd43908a059e15db
SSDEEP 12288:iyPz5L84pHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:/zyDPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T196650107679220FAD4778678C8621542F7767C314B619AEF12A09A7B1F372D09E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 827241c4351f6d35eed840b62aaa80bc577b8bf3ab2781be374311ede5c11b73
MD5 9ded37bb4e88178fc0fde077aefe90a6
SHA1 6f0ff9c2942db3700462e052d1884d9d41c776cd
SHA512 fc46b3b0160506388bbdb9f0170bff647723efe5d498816de3f7c53ce4119cee83ef3fa72e8557032890ff01d5d4d84f079316e41b15f62bc441055b5fb0c367
SSDEEP 12288:dPpHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:dkPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1E75523484A8704CBE8760EF8E9161092F97D3D65EAB772EB1083FD2B1F781C0551EA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 902156b119619c127dc8546ba4777e25d8570bd8e976880d7f98be81c8e8f87d
MD5 5b03fa581f6838b60f65fba7706c9c71
SHA1 86fe5f1377b12ce1fa84d63364f2636e6c126360
SHA512 98ae076a5e9731f11ea47dd6c6aaaa5f4f79ed3412cf69956716fe975f44a2398797dca0dd18d6d984df5113768803bc940ebde899d61682e618de917f72c063
SSDEEP 12288:VPpHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:VkPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1BC5523484A8704CBE8760EF8E9161092F97D3D65EAB772EB1083FD2B1F791C0551EA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 af71c7e3f37727c31637b1b95fd19d25f1f3d945b51e95198c3479eb65a29673
MD5 e8b852b71263717162de2f5af3a5f89c
SHA1 a724c71f081cb6083b60cfb2126d176402f1ade6
SHA512 767faab06322bd93e497f9646c77fd922510bbf1be62016c550888a37e203e8d17f370782a5e4b6d1aca79276ac81e5abbc7418c562ce228a9d2b9089f6d7fd5
SSDEEP 24576:tCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvApPP24PsyR/tM8O12qWe+TJgt:tCUxPTY+8Wg2lIL8lrIUJLWwCPVUwFMP
TLSH
T15965AE1DA3DC089AD4BB81748A518A06FB723C2A1B32D6CF2160C73D6F67AD55E39F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d322cfaf1a18624f2a6789451f4264e84a654ed2dd61a28afa5047a97a4d31df
MD5 e4b5a1885a2953726e959014d3576ac5
SHA1 f90f69d72aadbfbe0833d9ba882047848789067e
SHA512 4d4d773d4f280e4cee613977bcf73f1e8e6835fd6ea65eccb69911ae4637bd99f6623875c4a39a1d488549c0c3786efd24760316f793ad5622c31e5b7f288640
SSDEEP 12288:W8sffpHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:g0PP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1F165F009C28801D9D06E6678CB164641F7373C2597E2A3CB12C1F93E1F7A6909EEEB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c9a118edfb03cbc1f57476dfd2f587ed4b0cc547d101bce50b96df243c0f0f15
MD5 c837a210b7e66038f6f4fc682e33a1c9
SHA1 127d7c4b5f46f88a99fd4e6043b713699453d52e
SHA512 605795eb055d4e3c04927ba51221e45a060677768a03fa91c8fa3e19826af6a99ed1c7ba2268c6c95691c6d097c4572de56d8a9e5fc50b384a6f8b2a54b8ebe4
SSDEEP 12288:yapHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:ytPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1145523148B8A048BF8771FB4941A5062B57E3D349F7272DB2082FA6B1E785C09D3EB5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ebe30ad51920986caa9e6bf3b79b39827c4aa4321d7dc2d1e82a319970d72428
MD5 cf5c0470df17f7865ae0d6cf2fab96e4
SHA1 0f9b0d452ada982b8f98b75ff5b69de792a9ef0f
SHA512 62b044d1f39a4fcc72a1ec76c9261417f8f38cc0096f590514885c5ab6853eda55a4622a8d13267c15db01d96e24ef1b6ea6567e6f34a8eee778a4a219cc9d78
SSDEEP 49152:dRZwQCyiHiQEaiPnMEPVUwFM8O125itTT:v9xPP3PVUwq8ejtTT
TLSH
T10285AF1E62DC46A5E0BAD2B8CD674407E6B238165731A7CF0191C27D1F27EE49E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 14d3e5d69f56729f8c212cb9248fd3b6751b0daeaa08f825707591bdd956a96a
MD5 86f25b6ebc4fba3a519a990022c1333f
SHA1 908766d39af20243db6a1772cee7c964392cb086
SHA512 18af4b77d6f07f3e378830ffdae6606b95f423e6f8d5aaea1a56549895c1bbf41547bcfacf9957294eefd411c7fa155c6b24d2eb7598415ff997ea6677215981
SSDEEP 24576:5bxA1UGdPP24PsyR/tM8O12qWe+TJgq8rTT:5bxA1UAPVUwFM8O125itTT
TLSH
T16455122D569D14E6F4769A7C89968102E7323C255732A3EF20C1D27E0F3AAE49D3EF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e145cef403a0dbc7fa4a901f7eb5ccbad8d6bca20aa90513128f3c329778174e
MD5 0000637d4da1d39e6bff628feb44a35d
SHA1 b7fcd81ff55d43c7893aa9c96a92875fc8fc0e8c
SHA512 4d0fb652f757b028e706d61197d8fdf11f92a245281af03d95f7383d38b0b153bcd75dc8696f778ec4bda5978112d65b80fcc6d41cabdd91b7a781024a4c229f
SSDEEP 24576:FjsmP0yHaqrVqHra44KDzMsrnGPP24PsyR/tM8O12qWe+TJgq8rTT:FjRP0yHfVqzlAsrnqPVUwFM8O125itTT
TLSH
T15A45AF2EF2B910E9D4AAC136450107B5FB71782D1F219ACB0170C635AF1AEE89E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 3944a7c13ac2186ed550202397aae8e818ba7e9b0a889ae4d89412ad280ca601
MD5 3e6651f263cd58c93ac5a03e177c9bf9
SHA1 d7f59c6ec319fd8a0eb8971786c9bc347877e87e
SHA512 10b32b0db36bdd152b86aa003d431d349747bd8717c6d13b07554d6b1a5ddf7b04b96f52b181e860779ea531b7256d16ba9fca150b638bc32bd057ff6ec06d98
SSDEEP 12288:qQpHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:qbPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T1D45523484A8604CBE8770FF8951A5052B97D3D209F7773EB2082FA6B0F785D1993EA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 b6eb98ff7ec82fb074d2c7e143dde28e6aee46ec72346eadefdd8a314c0418cc
MD5 f8d2c93abbd1869c76724ff1eb21ff0f
SHA1 2e6fa63878cb614d774dc5ca90b38d05a28fe58d
SHA512 28a88af5006d577dfdf0e953d09782815c451640e1660ed4ad5265f752983af9862bce2552f6fb46f5b90f3e342735e7635d7c59991350a076c2f82e08a411a9
SSDEEP 24576:5gLBUTRPP24PsyR/tM8O12qWe+TJgq8rTT:5gLBURPVUwFM8O125itTT
TLSH
T16B75F154E79500F9E87B823CC9668512E672786D0764E7DF03A98B6A1F337E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1b4d3adb9780cbf06fa981b65ef24333614b39c267b341614fd27885154478bc
MD5 adbba5fbc75b0825fe76cffd41259cbd
SHA1 d470b6f63924c056e27741bb57e75b9be55191c1
SHA512 bd11fcab867f05c6b23854c81a291335819cda4ec53c5ce0db3ba12bb0e7f3b4b545c50295a241213b9662e4d3919c3ca94824d3da03daf83315490cb156c2bc
SSDEEP 24576:m6YNHaPP24PsyR/tM8O12qWe+TJgq8rTT:m6YtWPVUwFM8O125itTT
TLSH
T1B065E11E569D08E5E57B957DCA838109F27278661721A3DF00E0C27A1F27EE8BD3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 21c7bb4ce2165a5c571e5752c137ea1c404df7c1b66d51fcbe6509a5b69ace23
MD5 2ce7abc5d6e61ebaad0d07ad2220fa4a
SHA1 3def4cef1bba245d034539fb9802cc30fd6fdd53
SHA512 9b659a24640b87f20229e1c99a6aff1aa9fd608b5ecfe6a281f15044a57b8176964392ce43fda832dda173c1702f109c476284a779bd1f166a8ef578b05af167
SSDEEP 24576:JnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKy:JnXoJJYH84VVS6AmEcJas+cHBjSSKHPi
TLSH
T15A65BF6DA2BC04E9D5BBD17CC5824506F5B278621331C6CF0261C2BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 845a3e38f3bf50d34452501fe597c38548afe8e3344e00869b3172510a79eaa4
MD5 b1ed6b8fe9462376e64315c4bf1aaa1d
SHA1 61f9b6850cdaaa67967dcd9490473b9126611a79
SHA512 70fa4265e08afba70ccebb600896de61ad4d1d87db71ee2970014cfa446806407715e7eda7e9e00b52450a14477cc8afba402a5326766a8c62721679f075b60b
SSDEEP 49152:WDLL9TuJ0M/TYj2PbPVUwFM8O125itTT:13PVUwq8ejtTT
TLSH
T16D858D5EA2EC42D8E07BDABD85B79046FAB2B855173091CF0291856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 0d6623bb4d80fcb4477060ea166aca450047669a4d4be61d6ee0b3a8201e77bf
MD5 3994e4457bdcad29e19fa34072b71215
SHA1 aae715b85b3d9efc498022cfbe48bd801febb118
SHA512 45e982ed1f4c31d741701f4bc54943e44fe5c044d666a5826f5439828de714ac7d2add0acc0b002b748c6d81de87b39dfea4affc807ac9537d0ac34b5aa09d02
SSDEEP 24576:oegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wRPP24PsyR/tM8O12qWe+TJgq8rTT:ongOJOmPOHhFPVUwFM8O125itTT
TLSH
T16055BF3FA7BC15D5E03EC17D8A968816F6B1782613255ACF0190827E5F2BEE46E3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 0de2f3d3bce3542430ac0b452267b63b2e7acb33b7fd3bf6281ee8587116620e
MD5 67da40efe815fba37466153ad1e50e30
SHA1 03c1cc2b5dd04d0a6a6f9d0768d8cd5abc770de8
SHA512 84e256e8cac0d5080e6d8487f22ebae5246bfa2bc9a7255d51b7c1c882b9dfe0c203a90f7da1a7f3f1cd84ed542acc6ec4ca794cfcbaa87b3ecee144d1145dae
SSDEEP 24576:9LJnJiTk3R3waE4JrO7PP24PsyR/tM8O12qWe+TJgq8rTT:9LJnJK8R304laPVUwFM8O125itTT
TLSH
T1DA75D02CD2A910E9E4B7C2B4815A1656FF31387C2B2269CB15B4D5353F22FD0AA7DF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 22500ac0113cb3fa29af43b2489de3c40dbbf40539dff46189e8046254c72ccb
MD5 341aa1daa9f4620a029300d94020cd89
SHA1 31b9c68b057fde4901e7bd724d3834db58af42ce
SHA512 7a0bd43e42f1ffdc0dc5066236b94bddcd2c5a8798d761a643d204d7a483cdeccb29cf22c6f1d5c86af0b1fdf58ad63b120f0d58382c72419b6d69de9a0e7623
SSDEEP 49152:Z9mqCzDScAZmlvTcFg8Ph6vPVUwFM8O125itTT:N2PVUwq8ejtTT
TLSH
T1F1955D05F7EB5298E8B3CAF1C96294159B327C509B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 180cbc672e6ad7f10395687413bb056f3fbe13e17c9c8f1dd5c2d877fa39b4d4
MD5 e84c23398751f1c6d674aacb00745616
SHA1 8e8bb2df68e3f88b66a598f79d20ab7d8445f2c4
SHA512 4f10c77725ed0efe0334e9beffc1a51df2c3a2495a6de6d8cb6cae460a47333a92e8d1670293615adec84756202b25d1be516f8276eaae251282c87a807b7ed2
SSDEEP 24576:1lYJeXm5jUuEBPP24PsyR/tM8O12qWe+TJgq8rTT:1lYJeXmRUuEVPVUwFM8O125itTT
TLSH
T13255125C2A8D20E6E03B89B899524141E376B871676273FF10E0D67E4F76AD16E3DF80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 cd47af12051516c9e865c62684969340503b85b606cede7ac3d97408e67b6422
MD5 5829e2d9d6c9287fd57d93e143b6253a
SHA1 d5a081bec50ad39059371494c02daef307e5d0df
SHA512 7e4905ea40f474729adb852d755fc0ba62f921fbc96399d722aade6264825524114b2456f190f5036d2f2b81b63df2497acf8278d1060aef1d23e663d2c28330
SSDEEP 24576:Z8tymPP24PsyR/tM8O12qWe+TJgq8rTT:Z8t3PVUwFM8O125itTT
TLSH
T1D5651208578510DAE9BA0A78DA234191EE797C309F2263EF10D1FA3F1F766D0A939F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 d4d4561385f21fc271e0aee60262bd3b72bf712c241ee7e374a51741087a92a7
MD5 0da5c34ab2b9f132f1c71f064c1e7692
SHA1 50681bcca64216d5d9a7fae31e13d2a89e26cea3
SHA512 49395a182d4370ec0858239de341aa06d4862ac1e6db289bfeb5fc0960c7363d2acac1c6ddefcdec6006e5354de18be5d055d9d8b5395f9d29bfadf5231ad722
SSDEEP 12288:APGpHudAXQ3f26D7Hvsw5F4S/t4g68O1xA8tWZY+IYJffQqAPrTT:ARPP24PsyR/tM8O12qWe+TJgq8rTT
TLSH
T14E55235C4A8614CBE8760EB8952A1092B57E3D309B7272FF10D2F97B4F791C1993EE48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 babd54b512a0bfb1bac5cf1835e3b4a18ba991958fc38ebc3e1da5cc4408e788
MD5 8e75daec51da6155c6cec8540bcad310
SHA1 c28058bd6e8cd1722cd5b71be3b9e8c313bbc90d
SHA512 a40a9f5c3c021a89d1b832c5653cfb8f6f2984d8ddbe996647169afad23e3de00fa6c662f28f370c58834aa6cdd9c624b2280651cf9085f619d32e72dfe298b9
SSDEEP 24576:+C+TyQIu93VAumZr7jmUPP24PsyR/tM8O12qWe+TJgq8rTT:+/TfIq+Y8PVUwFM8O125itTT
TLSH
T185558D1DA7E91DCAE176C675C8A34493EA337872137196CF2044C07D4A9EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 29cb78ffd38a61862cb74392f9276cfcaeaa438f9d603806d713d367937055b7
MD5 3e82eb2e94f55a4df12df9e1f231c149
SHA1 f7d90e3ede1174183cf6f1d466ae0662d692700c
SHA512 d443965fe94a8ae9577203a0ed9160da9ee4226dadca9550bd3e081f8c807640b99af28ce6f3c13108df36469446169dce6c72a721ac902e56cd511a296a3f31
SSDEEP 24576:qLQikZ1PP24PsyR/tM8O12qWe+TJgq8rTT:AQikDPVUwFM8O125itTT
TLSH
T14665E00EB7AA0096E4B7827C88464152FAB37874572263DF0191CB7A0FB75E9BD3CB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6170c0bd8e0bb85508fa8aee73293c4f2892866c04ee5484c6ecdcac78b5215f
MD5 55265ee4ac37a2dd527bdb9f0bebb08b
SHA1 499d827cc7503ee797b9d0f867fb9e15d33f2322
SHA512 3438ddfcf5dde3c89dc8182b9bb82a714626ae4b40def6c68fd777125a1eda2947c9cae801df8d1480d4b95c3375d689e2731f7385444b30538f484066e97dd4
SSDEEP 49152:SpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPKPVUwFM8OT:PpC7b4+80GTkXPVUwq8ejtTT
TLSH
T1C5A57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB00B0C578BF1AEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cd65e274197e281e56bec2cb70216ea7d8b5d5eae5cf4ec851e9ebfe74af439f
MD5 370b82eb85f86d5005fac7ac056dc7c4
SHA1 51b20d28f562d0123258199dd2a0b34d89d6f63a
SHA512 165942b24e6fbb2789e8e7afed8583c41bee79b33ae475293f067d9a47c7ef6511ad4420218d9fa19336509e34ff6212d54596b849ccb94a395f22b428a346cd
SSDEEP 24576:jSAwJPE1IDAo+4Kt+l44135UQOPP24PsyR/tM8O12qWe+TJgq8rTT:jqPCIo4Kol4/QiPVUwFM8O125itTT
TLSH
T10355AF29A7F946E5E17ACBB4D663C511FB723822133163CF5290953E0F269E89E39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 51da08fab1a264171f7c82277402dca8fac736dcdd1b6d2f3477dc2f965aec0f
MD5 a4d18919fabb9e7e130630e606acb168
SHA1 6978b7d4bb485d21d637829ab56dc316e08980db
SHA512 732399e34b02fecf9cdd8577b943cbb110bec8c788ca93c0b0d94e9af1cfe2eb814ace6c489e39e9490bef8521dfb6cb5fcd5cc5a04bbcd8d9dcc85c7cdac37d
SSDEEP 24576:ByLXPLcP94t+PP24PsyR/tM8O12qWe+TJgq8rTT:By7PoOtyPVUwFM8O125itTT
TLSH
T17575E03DD66D04E5E47AC27CD6638506F6723CAD033266CB05A0D57A1F6BEE4A93EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 001308a6fbb9fb648b61406eebbddafc81a0ffe0a2a1d183f8e5560e45bceee1
MD5 bbe89ad797c90f3fe4f0e913c60864bf
SHA1 837e93fbfa8ff39cbbee778bb16f4f882cdd4275
SHA512 5d56f227eb3890376b1c055536a945aeedfd771df5330f3cafe7a4ebacdbdc101992edb25e8e727de7109f08fd944151b20877b579110c002fc46f71a32917a9
SSDEEP 24576:BWv8qjpFPP24PsyR/tM8O12qWe+TJgq8rTT:BWv86PVUwFM8O125itTT
TLSH
T10D65124D46C424D9F47A4AB4E9268162A0B67C721776AAFF30C1EA7B0F356C0993FF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-212-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/468-217-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/468-314-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/492-89-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/492-95-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/492-371-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/492-88-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/776-464-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/776-144-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/776-142-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/776-136-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/808-8-0x00000000027A0000-0x0000000002806000-memory.dmp

Download

memory/808-6-0x00000000027A0000-0x0000000002806000-memory.dmp

Download

memory/808-87-0x0000000000400000-0x000000000073B000-memory.dmp

Download

memory/808-0-0x00000000027A0000-0x0000000002806000-memory.dmp

Download

memory/808-3-0x0000000000400000-0x000000000073B000-memory.dmp

Download

memory/924-131-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/924-126-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/924-134-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/924-463-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/996-203-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/996-467-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/996-170-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/996-177-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1280-261-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1280-323-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1280-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1280-504-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1280-267-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1280-277-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1280-293-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1308-112-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1308-121-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1308-462-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1308-113-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1468-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1468-61-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1468-214-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1468-67-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1604-470-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1604-468-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1604-465-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1604-147-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1604-155-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1604-153-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1624-183-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/1624-215-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/1624-189-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/2376-12-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2376-20-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2376-111-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2376-18-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2688-78-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2688-83-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2688-85-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/2688-72-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2688-80-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/3068-106-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3068-108-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/3068-433-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/3068-100-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3132-46-0x0000000000F00000-0x0000000000F60000-memory.dmp

Download

memory/3132-44-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3132-35-0x0000000000F00000-0x0000000000F60000-memory.dmp

Download

memory/3132-41-0x0000000000F00000-0x0000000000F60000-memory.dmp

Download

memory/3132-48-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3676-316-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3676-246-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3676-240-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3760-51-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3760-57-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3760-179-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3760-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3800-466-0x0000000140000000-0x0000000140144000-memory.dmp

Download

memory/3800-165-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3800-167-0x0000000140000000-0x0000000140144000-memory.dmp

Download

memory/3800-159-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4540-226-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4540-321-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4540-220-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4904-503-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4904-256-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4904-317-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4944-230-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4944-315-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4944-236-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4996-43-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4996-32-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4996-25-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5000-199-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5000-205-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/5060-480-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-474-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-482-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-483-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-481-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-471-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-476-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-484-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-473-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-479-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-478-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-472-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-477-0x00000238581F0000-0x0000023858200000-memory.dmp

Download

memory/5060-475-0x00000238581F0000-0x0000023858200000-memory.dmp

Download