b0363e19adac2867f897b3cff915cd4252faca9fa2a788a89bd34755d3ecede6

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
Size 2.3MB
Sample260528-ch9ffsdv2k
SHA256 b0363e19adac2867f897b3cff915cd4252faca9fa2a788a89bd34755d3ecede6
MD5 6abd338d55ef465cd4b85ec8b84231fa
SHA1 09ebeb8c449e96bf1adaaab147a4cbb8c82aefa8
SHA512 4f84976371101bd29149b02012ac740def561b4562ffeafd96eda20991214e22c4c67db90cda052dcb0cf9e73355fe01d3ac28ee994cda65210c3cb67717a00c
SSDEEP 49152:gf3ZoG3UCj5qzWt2skmzb2R3NBHCYcMKCqy+XyTmp6ICDmg27RnWGj:IZP3UCj50WtQwb2R3N9cMKCqy+XSD52j
TLSH
T1F0B5BF32F590807BC67317718F9CB36866ADBB710B75424733951E6D3E70883AA39A63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4788	alg.exe
5048	DiagnosticsHub.StandardCollector.Service.exe
2256	fxssvc.exe
2600	elevation_service.exe
2444	elevation_service.exe
5368	maintenanceservice.exe
5404	msdtc.exe
2212	OSE.EXE
3576	PerceptionSimulationService.exe
6024	perfhost.exe
4624	locator.exe
5892	SensorDataService.exe
996	snmptrap.exe
932	spectrum.exe
5912	ssh-agent.exe
2528	TieringEngineService.exe
4804	AgentService.exe
3636	vds.exe
5900	vssvc.exe
1316	wbengine.exe
5728	WmiApSrv.exe
5788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2a3a6f6cccebd5c8.bin	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ae3a48946eedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aed4348946eedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000adcfb08946eedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026a5e78946eedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f96968946eedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
Token: SeAuditPrivilege	2256	fxssvc.exe
Token: SeRestorePrivilege	2528	TieringEngineService.exe
Token: SeManageVolumePrivilege	2528	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4804	AgentService.exe
Token: SeBackupPrivilege	5900	vssvc.exe
Token: SeRestorePrivilege	5900	vssvc.exe
Token: SeAuditPrivilege	5900	vssvc.exe
Token: SeBackupPrivilege	1316	wbengine.exe
Token: SeRestorePrivilege	1316	wbengine.exe
Token: SeSecurityPrivilege	1316	wbengine.exe
Token: 33	5788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeDebugPrivilege	4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	4788	alg.exe
Token: SeDebugPrivilege	4788	alg.exe
Token: SeDebugPrivilege	4788	alg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
4912	2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 3308	5788	SearchIndexer.exe	105
PID 5788 wrote to memory of 2168	5788	SearchIndexer.exe	106
PID 5788 wrote to memory of 4692	5788	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_6abd338d55ef465cd4b85ec8b84231fa_bkransomware_darkgate_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4912

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2228

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5368

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5404

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2212

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3576

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6024

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4624

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5892

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:996

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:932

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2912

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5900

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1316

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3308
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2820 2836 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2168
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2872 2868 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3a052bc9d3872fbd0e8cc934e9013fe7b7ad5322395fbfcb57f2434473c33349
MD5 1deb17ee461d0be69c527257e2c6d968
SHA1 fe826cb6591a4c226fe434a48c2b90d9f39929cb
SHA512 de80ed83f13381adf12c468da25348c69522a5af600ef2652824ae9163d6b6a0d3cee1ba31d5fd81d82d578da244e8385d1885229186dd268f2e414cc2d17369
SSDEEP 49152:Ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxntDmg27RnWGj:q3q6sjBmD527BWG
TLSH
T196D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d70481d2499ae828a46afc4d948d4bd27da1f8cfbb5b6834184a49b937228e15
MD5 788169ad29ebb7f998ce2d10083b8b09
SHA1 ff6c0cad9b317f33f170b71789aa35a2cdbd73ee
SHA512 ce40c8f625cf53236c43caef3975c92c61b80b0318a5a699d3c4ef0971bbcde075a5bc103c9c3b0c736d8715d41c4b62d497f33264df67f6b2d62a9ccfd15419
SSDEEP 24576:6XYfDtczA+sqjnhMgeiCl7G0nehbGZpbD:htcHDmg27RnWGj
TLSH
T1EF65F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5857f69c1c27052a6f04a00aca9e00ca85deea50381cb9a9beb3b6e799990430
MD5 07c33a396bf779e4bad659bd90be995e
SHA1 f6d172f090c82441050bbb77740388252635e729
SHA512 67ddbfebca11f409199054034e5ad5a1c78f9271bab2ce50b7939b69c0408ce077221adad02a7d70357c6b35e9a0e1c9d62900794c0db14a4ee3f3a3afecf367
SSDEEP 24576:i0Le5ji0hmxxrMRsqjnhMgeiCl7G0nehbGZpbD:iPji0AjwDmg27RnWGj
TLSH
T1DB859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f76d1344e32fe9cec23d187e344730af7b5083e7a0620a28c23d6d031e8cc08f
MD5 e0040c788382c5becc5815c677872c1d
SHA1 0748e2f03d5ce6c96d6a7fad08bbeb9577b29e1c
SHA512 45adb6a291fee1c62aaa8572ebacae87966cdf61d2426da0187caa5f9a5e84cc66c2a25d2f535f66f1e0ee63a3fa4068af574a680ac2f31bc5e6f78f020eba49
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWn6q8wyuzsqjnhMgeiCl7G0nehbGZpbD:N/ezSC6vUzPveHjysDmg27RnWGj
TLSH
T104755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 28d7efa4d8765a65ffc9d2d20c18772019814340591a986c5f2c8778c595c8e3
MD5 fbb0a57f6568c122e80a78e8569ebbfd
SHA1 cda0be9e911efa26ef65a963ca8d61e164e861cc
SHA512 b45388aa58ef9c128c145c2d6010af7c89f574e486489871ce8fe3b124e8d419d1660a22d71289a4dba5f57c5d54f4c21590492e61a206a95ea1ee0ccd56d402
SSDEEP 24576:3VbqPb88hv/l+YSsqjnhMgeiCl7G0nehbGZpbD:3VO88hXl+/Dmg27RnWGj
TLSH
T120559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0c1ba4d359aadf398c1f3c62531aa8b6ac8a3d5acf2b4ac805527049d4ea9118
MD5 a864764774e8ceba0b22b0374f6ee881
SHA1 d15fadd5061f649530b209799202655eb6779d6e
SHA512 50af77aaec5fde2715b33e66877554186de1c2519da30bf34d3d360b596f2ff30f6c0c75d7c5b74c303f61f009ffb0c47b7720064539ad5f17ea2b76f4dfd4ae
SSDEEP 12288:cLlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cLlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C4523BF865C50DAEB7608B5C3E9F11EAC137E56981008536A637CFEE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c48b3c26701aabdf8cc98a0db8b939e116a836aa6036472e57275877df6dc9df
MD5 773d8a95bc479dc1dcad0c88c0f62118
SHA1 d0d4cf87c6bba7d19905022bce7975ab5bd79c8c
SHA512 be54200c5dbabd3e3c1058c35d7484010cb7d936e2712f310f023bc942e02292fb2391589ae13127e0127341d37fedee8855ce4d1cb6ef885ddded20276bab26
SSDEEP 12288:WeBNUbTVO86UaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:WJIUasqjnhMgeiCl7G0nehbGZpbD
TLSH
T13765CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8d62d8f4618b81da3a7e2dae05d07c83b02e7410547740403df3ccf6633ad128
MD5 cc56f80fe6cc9d7062177a3633415628
SHA1 3459cbb8b8ce00402b8a1fc9cf04dc610eb9ccf9
SHA512 4d693f24667a08b0540e808c3432a475151d1725f5632906c796d1eec4fd560e7700d1385edc233ab3cbf0e4fd479953fe2d56a557167cb14d88a67fcc3c9e11
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THd:MQvGAdlCEL8c/DRNw5CnD527BWG
TLSH
T107266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f039e4c12deadbbdf04ada5baf2f2457fbe6f91cb8f37d72595cbc124155e280
MD5 93e6bcd78c71f1020eca66694bab0e89
SHA1 0d8dcfeac5634885ecb6164362f4c90fad8801cb
SHA512 d196c6f787ca940b1c8b30f1380be7a53e9282e846132043a56b8a433ade0e0f2891c0b3cc53b1da7554a1788921a4ed4eba52612923ee9dd407e715b81f71c6
SSDEEP 12288:/AwSfxL/2Dc3RDLLmt0LDQewsAjEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:I0ewsAjEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F75E031FA74E036C77B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 57da93cc166d4409cc91e4b328b8d2b735cefe59eaeb6b96f10e857bd022727f
MD5 0e60c7b3f2e2e023a4a6cd440c4d183b
SHA1 8a5152c8da44da1b6e975898c0ca21d353e482ba
SHA512 e675f4bb75f983a0f6be75a15511eca4677d3ecb643b0e5d3fe4309b26ce0633ad3455548b83c1c458b062543d1fd38e85bcc0a91350e9167acaccd946bbd7e5
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHIVQBWG:GUEtQevvqc2W1cpV2tI32PB
TLSH
T118474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6195477a7cf9779fcd1118157e7ce6cbdc07db06f481de9f2214cd97440f1d76
MD5 2acb9a2453ce2bb0a8b91096c1055764
SHA1 34435d24659c81f8e468d3453f559ef0fc31970f
SHA512 8c729f9766ede7356fcf40325f07c83f17ec144a041fcff90e6243cea788542dac106a4e66c5a8367dd5d38cfd24855ae5ac822cacde0adebab4af6a0371e33e
SSDEEP 49152:xCbRquA/m2yL5zTfFiV+XenmE3/zADmg27RnWGj:+oquVjnmjD527BWG
TLSH
T1A6D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ed578d9588267b0a229012ceebf545a856b6fdf3d1fe89c9cd76a325d762dbf6
MD5 852040491f72c40934f4c388cf53d56d
SHA1 7df5aa342d4e8eea391a1ef6fae4a5f33dc07186
SHA512 b256a52e948a768f5f056b538ee118b0e4eca33ae1384ba5058c79aa26753ed6b02b895912e9a9986a27dfaacf82c98b0049604e30c6e14e444dce439e416c6e
SSDEEP 24576:5AhGL3IFoiwtA5l7S53fsqjnhMgeiCl7G0nehbGZpbD:5AMUFoiq5TDmg27RnWGj
TLSH
T19F359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5aa7ae8309ccacd4364e71e082bae897cdc8fa32e738fadd5a30167c0952cd09
MD5 095fbe1ae230e38283c3eefa6d2e17c6
SHA1 4f9cc371c39c8aecbc1a51eccf352ce880d57835
SHA512 4e01e006ec238e6c9178bf1d3d7f1c40708b8f07d5be4ecb44b8de669251d757fd2acf1399d112b737ac4fbc52fdd52b7f12490be25dfc3cd2cf82a3419ea3b2
SSDEEP 12288:1mw5HEjsChNVBFgl0WDm+CTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:wwu4OWQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 35c0c3eb2cfc20233d3c0e57c5b4050a15fa19c31345cf234040e48396485460
MD5 693c0e8ae18b1dcd0405bf421250651b
SHA1 868b1ad8fafe5cf6448bfc65adf23f1c154afb59
SHA512 6536064a6abb08becf923bf8cb05801077589cea353bd5b9936eed82022b6a1d672c99ef4f68a454d34191bc3f687ad33b375b57bd52d9e3ab28886b3807b9b4
SSDEEP 12288:LeZ1Iy0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qZuZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D75512AA239820FAE163417CC5E5D609E7337C62673003CF166659AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f34fd673925549216a441ba2e46e95104c4ee4de326df4855ccda332e093ce66
MD5 724f300e19803abaafb2fe28195e2751
SHA1 a66b80ce159ea40beeb4a8a4f901b09d9f562577
SHA512 59fd476bad7d35be63ba06ee9847615db7cb8b0fa8800f791e416cb291540b87128d11771473ec74be552833ee3ea7539a7dbd090c88d4463ff0abb674d80c8f
SSDEEP 98304:uQRQyi36YOcPbLvw2gAf+PN3KD527BWG:1QyiKa/X+PNaVQBWG
TLSH
T10D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ce1bb77427ee22f518797b4b281c674534f92b8f07cd5bd2300ca23087f297d4
MD5 20dfaa6b47150e1b2d348c59b7f4f76c
SHA1 be266f9f3f6085650fc3d72e33a7d7b8b8c351fe
SHA512 58f9aae2428eaefad688435fd84ac28856bfac650b576c9b0a374d0efd05a1aa4467834a2537e482759436b4f1bed194156ba738ce9fdf19a291abf138d12ab2
SSDEEP 98304:YQRQyi36YOcPbLvw2gAf+PN3KD527BWG:PQyiKa/X+PNaVQBWG
TLSH
T1E8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ae60d129eeeeb01bfc51a942f315ab96ce38f30dcc4ca75b3a6926e3e388c585
MD5 cfb732f9e43cca9419a3528369dcd800
SHA1 c6b0ccd92c5cedc8b9f73117d11c688d6a30a1f8
SHA512 c27d883226e7b06b008c28c940d9e7b0a97d87c0232ef35dd29e1632edfdf17f72ac8d8f4e8e76aaffa44b5e0b94df809b34946d1c2df0556513e7d99ee5bc38
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0psqjnhMgeiCl7Ge:F68Qg55nhceWu7PNU3/wDmg27RnWGj
TLSH
T1DBB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e09d836b6bb7dde540924e4a1755279270ddf86698ba1712484bf6e7a666649b
MD5 a566661f82f452befca5f4e871df635e
SHA1 d0d6281b619724bb64ff5fd2c0e72810edd57c77
SHA512 5318d854a293d5d1b01aa79498031d070c7888d079e5f8210954b0dd236018d78912b20c87e3d0a4f064f5959dba544ce5969f2ad149bc236402de2d99af21a6
SSDEEP 98304:1y5112gYy5azzVvt69nLKnhZZD527BWG:YLIHEWhrVQBWG
TLSH
T176167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 81dbcbda2bdf58600bc9e98551b0f8eb5c035720c3af8979ee9b03f861c84ef6
MD5 8d5a9fded0012e55ef8170137e332df3
SHA1 cb908d348020c5038c7b6b1c0b181d13b97f3552
SHA512 4bfe0d81af35777999d17ef2c82df2cee840d60e41e75f972780070071116b2b6f9f08f3b6db16dc41b4d999683545b5946f7726b75c9ece49f9e0b44834773e
SSDEEP 49152:ZB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliDmg27RnWGj:Pu6Jmdxd2diD527BWG
TLSH
T183D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8e08b7c1906eb4d8662879df8e2bbba9b6748e1c36af95c6d1be036daec3b232
MD5 597b983b963a809bd6454842a8a028c6
SHA1 6ef64d9b0b3007466681aa5cef02899dc0bc80ad
SHA512 8f1a9093f7cbd4d2cf1147c97c77d3b5e4346592883ff29377998d2e605cc3889b0976e59d4bc19dbd10867e71f7dd8eb96f16df7fe690b7c88707459369ec6b
SSDEEP 49152:k1hpsNoJpF1A63U44CwH7R4xODmg27RnWGj:kmifPWRjD527BWG
TLSH
T103B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5e4e767950c1de7e39f310888ccadfa66d5760a03dd82a8ec93a695216cf3728
MD5 98cb1ed7f9c7757b75974c2db3d45a40
SHA1 d309538f4a35ff9f4bdc49bbf06bda5ca984c08c
SHA512 8240a25421e86f08325aa01f1c3300de44e29007f49fa306bee94a7a2380e09e2793db155f5bbcacdba395f6def0843ee12cf305de542c198ecca919f9f104c4
SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqdDmg27RnWGj:H5dKii61dD527BWG
TLSH
T1D5C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 91c5fb7bab4b124971ae9b3b54b679fa571ff9f6be5128cd1fa0e3e854bf66fb
MD5 0e99a6c03efa870adfa6c909619071bb
SHA1 5fd11605831b3386236b063a9fbfd07cc7680ff2
SHA512 2a6ba7fce22f5958932fbcbc8812b195cbdf8d60e10a12a1e2de7ea27d44f517db4d6c9c35d45a2baf7927e46958687f8b769b825ef9ad4a53377bf0f09b9dde
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5wSDmg27RnWGj:aX2imphvD527BWG
TLSH
T19695BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d688e577d3783942559d8a2c26b2ef97beef10e674ce87dd633cac7d48632201
MD5 78dd218bc23314c95a45e757ff812504
SHA1 3bcce6dcc79bba1fc8f388e5322a085408848f2d
SHA512 4ab69a853d5f44c6a219e08b5ad623b14b8ab1c17b3ca07ae4fb26dbe182617c5c6a16e42da08a0c089ad722e6faa5614706a2b18fded3c58eb0b47f4a0f3b1e
SSDEEP 12288:NtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1424523BE965C41CAE52649B5C3E5F10EAC073E5BE92004837A577CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 59b2ff146ce11c7e765ac04e48d7c736a7c78a091b62cf1b119036c7559a29ea
MD5 09587aa23634f2670bcdbcf104cc1440
SHA1 73b45a56f415441dc1f1d4db5fa4230e42590969
SHA512 737176f94e19efd896bb621df91d42629e774295bcd784f222416db7b9c975137da75080a1aa54f297fbf13d557ce2c65497b09fa7106b1511e3d29d38ddcfcf
SSDEEP 12288:AIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 05e3b12eb27bfe328f2013912eccaf03652765c84fe29c6c7fbc17178d37429b
MD5 644ee37da11f3a97731f9939bcc3636b
SHA1 a36e908946316fab5be84913dbe02b3310db5fa8
SHA512 39ed0461a581ef2e92b1044ab3a7b991cef9ee21d1ba341f0c59d6b0896dd22755c13b72d566a8473345eabb8a94541b10dcd0ee2662f24b7ded49238c8346f3
SSDEEP 12288:EiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA977CBEFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 571086eab548fa3b4914016608adecf2b0255865197b9fed59b7d65bc4531dea
MD5 2e69d105e5dd1e3a82388c6c3224acb6
SHA1 b8f7041a716f4f3d07f8414d10472d33039686a8
SHA512 d547dce13839a816db20d81c16449bb46a4cddad1d454f30ee20cff466e6f05ebd17edf016b83ee53cd528e98dafd085e98120e949ea0d0f76f69aa114963cbb
SSDEEP 12288:3V/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13945237B675C00C6D83285B5C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 423a57dcdbed8e826c0a51e5b62e0068ca491813dab7f9dd7e31b10fd568681b
MD5 ca37c1b0997d9c5c55b0ec8c6c6fd795
SHA1 981484c77813658f2cf36734f98bf955eedbf409
SHA512 5e4f5f4d3e97bfaca09b00bd41fe086cd605f4cd5912c24a8160b770bb3dd185a629599c2269016bae7500ba91edd90181c47d54b56c6f94a897b9271db0e4e2
SSDEEP 12288:H3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:H3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD4523BE965C41CBE52648B5C3E5F14EAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 11445bdd38a9fd7002e0fe67d99464fa15cf627ced4a252120fc2793f6975770
MD5 5b63801e4aec7fedf8c92d1e8be63c6f
SHA1 45064b0e7d31c600cc890489bd764811fdad3a41
SHA512 3c8cf10f9c4f7d8eb25053ff3a50a240330afe0ee001b0f7e09ab90ed9d77287ac939cbc1d09142406afce24317197b508278c32cd5e75a5151ce5072ef86b50
SSDEEP 12288:kMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1234523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ada16f841fa59ff7cc0c50079a56e3cb1e7ac3c4277911e14cb822b223311064
MD5 5423e2a79c355dae710b968b56f57992
SHA1 5f6b3da93ed3880c0fba6f448ddafa35c2a5061e
SHA512 7137419cb0d90d2ba4b26fb4df926b8486acd46de05e6e8b279cbe92a6cdd989d8ec5e7eb58333ab797ef97f0a40e4c62665cdf7f50f832ee9f5ba9855cfd9d8
SSDEEP 12288:UgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1174523BE965C41CBE52644B5C3E5F11DAC073E5BE92004837A6BBCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 47671b9ab013e843610f6c65f12346996c2cc23ebf006b504d75607d75ecd2b8
MD5 bd89a04a01f4c83785520f0b91048239
SHA1 1c968aa89394337b53a66fa2f608e0c3a7f18d1c
SHA512 fcf076c5313612a41a281748e0c3e924dff038b40dd21165e24fe33b484aeea47dc6aff9c9c44b27a5099182cf0a2ba6a1ff17b97507c3b55f426d3fe7c0e8c0
SSDEEP 24576:eZMRzFVSOosqjnhMgeiCl7G0nehbGZpbD:eZMRzfoDmg27RnWGj
TLSH
T1D26501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c7abef5caaf8875a04ef4de46f68077257c9ab8f0f342565c35793e4d01f0360
MD5 627be96f61c882640a6e3ca8c25b7be9
SHA1 932f3283530c9fa408b1e6378d6f9830bf7ead76
SHA512 ce0080753fbd75e8cea82b8c8acccbe71d75b0d340ac4b23af05e0bb115cf3ce1a05ee57705a8eabd9af96f6e5b322aeaac4f053b5c09547d1b4d7409f994f0f
SSDEEP 12288:9JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1854523BF965C51CAE52608B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4ab73a0d74c10cd09bdca4bbd0d622c127fe26b0030024b45002a5f0bad2f6f2
MD5 150a4668456412171536c947998dde71
SHA1 ccfb426cb1044621bf394191382683f47ef8b07b
SHA512 b2a2a8eddb21319f9eaab5fef714948c755bb69f6bc0923c253eba6e949829c5bd7bbfd48604214ee5b9019081f9c5a0feff5c71e8def473e652c83aa71cf169
SSDEEP 12288:RVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BF965C41CAE52644B5C3E5F10DAC173E5BE92004837A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 1a009b05c43ef5e3bc0ad029821f29f1b5f909708261df6ea3d7cd0f90ac16f8
MD5 6bb88f2f83e769cc40918dd38a34f15c
SHA1 393e4d897e1d728f721b8cc7179a3e740e0e12a8
SHA512 9f02935f4d3855b534dbda8f8fc7f29aea6f4974be4158b875b7f8d71402667d3e11bd7f12b51e7135332dd8baf6e698d1b576fd14487515479a9cd10e36864c
SSDEEP 12288:YyPz5L80Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5zy0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A506BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6d31379f5d278259be4f13ce1c5d6b5bd8a51a7cde980a5403bb66654a9687cc
MD5 0877cf9de4ec29e0120fe6a32209b0e2
SHA1 cf2254d63a9b9dd4a7df3ffbd384bde41e83953c
SHA512 1e5403f79cb51c48c0759d98599d7eb4e91f9689750f9af5abaf042dcef7340097158ff4ab971b66d83d5840d7270021d6ffd3c5f0c112f2678348c2c4be199d
SSDEEP 12288:LJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 37e3d764e0cdb1db9535a8cda89d37cb396b86784e1073d7d7f0949e26ede5f8
MD5 571dccbb991e402d186470b58f0edd0c
SHA1 b8392c4916da398c930683f45fb344f5abb7d6f0
SHA512 1fb589473ea43a2600575dee03271f57c805422900f3271294282995d460e031dd5f89e995a404e21a794edc8f9a6ee1f95ed8441b9097f4d1799e206b4608e8
SSDEEP 12288:8JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BE965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 3f8f2221dcae84784fa9d0fa2965bc821724681a738ace2fea785d05e99a3273
MD5 6ef85b0f459bb3cc72d8bfdc703ae212
SHA1 34ea69803b01a24612623e2f47544151cb944b7d
SHA512 81c7860591259cd88d639e1eb3262e6eeaae9f5b03ad7e479282b49382658f0652eba3f2fdc52447bb4160cdf58e803c1d16c8b5d86b62bbf904593f366b85d5
SSDEEP 24576:xCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAWsqjnhMgeiCl7G0nehbGZpbD:xCUZPTY+8Wg2lIL8lrIUJLWwLDmg27RN
TLSH
T11D65AE1EA3DC0896D4BB81358A51CA06EB32782E1B3196CF2160C77D6F67ED54E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c1b265c754a9847b0fbfb5fbf158b828517f42806a6538b905bdb550d3f449dc
MD5 a88231c4fad663f6d64ff775b48b2d2d
SHA1 c221dc65932ba88166a71f5bb23964a0b683f075
SHA512 fa5fe56139d4a3c7b7de8cb188fed2ef676ce14bbdd7d2c4c3661b528e747130801fd308cd73620df85df7e89832c1fe02700624b75ce55331a37b5e6617ab41
SSDEEP 12288:7bsfZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19255015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 312a214444edbb103ddfec803ca5355403131f0cd3eb5bfe1eefda58ffeb2394
MD5 fe3ba8744d71b3ced3ddc0cff326d673
SHA1 a24750ad1c66895245f05b934bf268409357c071
SHA512 f078f578540cf152b2484e62f70d6b25ead91fbf4adc35259324a018f83de8ec61076ef80c4328e2590ccf6bd2af674062863ae9625b17a557468b82e0bd872e
SSDEEP 12288:JCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A45237AD34C518AE57A49B482EAF12D681B7E669F2004C3B94338FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d87d631e90570f17d2183ae8ec56b8ddf383fb1a1a0a3a16a1bcd205905a94a0
MD5 8b74e4e1397d57a65632eca17a301b05
SHA1 c9f466f9d648cbd245d137430dca244f85d6bfe2
SHA512 f583f11921dd1f317b0fc51e0dc7b3429a36c3cf31d703b0a75103e63ef9daa1816abee251b5f842b0cf506a5bcf01fad5703e5bf4ad160d26a2b81e9d3b3596
SSDEEP 24576:B8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCksqjnhMgeiCl7G0nehbGZpbD:eRZwQCyiHiQEaiPnMFDmg27RnWGj
TLSH
T1EA85B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 25929349c0a5a2c0ca0492ce6484e0017b8da2b633caf5b7190a1a81cc92310b
MD5 68d75f05b11cd3f283aa4682e015b37f
SHA1 968392b35cb3dd441f8cfa015e95fd4e9c744021
SHA512 6e2acf7581f95a168ff0afb800206bc8c4f23c3b74782d8283481285f2fefca2716aaf956fd8810b64e40815df3f6cf6106511f53219b7c2199b469751ec1232
SSDEEP 12288:cbxA1U7KyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cbxA1UGysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C655123E62AC20E5E176957D86D2C10AD7327C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7e3d5090013bae6386e0cf429e5d16a5a7a06884ca3413e5b58bd8cc28cbfabb
MD5 aaa93bbbba2303e7f180faf89d992203
SHA1 80ac3d1c70db4cd8e44d9d320382ef7b26fcd94c
SHA512 7e65fda8c5a103c35fd24a76e1c0aae8e9e81cfe00a4138e03c10f5f4fd596da860758d750395946ebb01d8b9392029167b4be1a212abe1d474cef28a29f3167
SSDEEP 24576:yjsmP0yHaqrVqHra44KDzMsrnvsqjnhMgeiCl7G0nehbGZpbD:yjRP0yHfVqzlAsrnTDmg27RnWGj
TLSH
T1EE45AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 859514befcf902d00af912cabee4a02470b9f73dbaed970b344e3113df1bb339
MD5 a5384ceac15aed9285c07842743eebf5
SHA1 16e8c2bf152eea7fa5b6f49bde868730c80daf16
SHA512 eae54c0b4abb8387c342b93d10f14c1f02c13481443a86c9054cd6d1211916f97386dbb351abcd92ea414bb2678eb31302253c8f5b6854b1785070d1cea7bc22
SSDEEP 12288:fsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A34523BE924C51CAE93649B5C3E5E11DA8073E669B2004C379677CFEEBB54D84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 6f36a66296dda0ed320b9c8ad4606beaec519a9158a9d38812fc615fe278ef33
MD5 2cc8afe411dee4abd2176e5fa7cac470
SHA1 aba0f2f48f7fac4fdeeb33e865b22e71b4bfb87d
SHA512 e3e3f8657916d695ce2c6018d58bb9c20059349c3aadc75783cbc2a09934f84807a5e8dc0d62840f4ac640f1accf5e8d9b11dd955a52f0211ac3030b3e0080be
SSDEEP 12288:4ObfA4LWO+vAYFT+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:VbLBUT+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T165750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 efe13b91ff1327a907cc35ccbd1d6c8d2668f3635d922772006deab3c1321ba0
MD5 bdd1693bfe2f8390481cc235ebaf5c9c
SHA1 4c7da072e074e8b1d736537fb7eb4a9cdc7b9359
SHA512 be9f5dbc9b7ea8cfa9af8fe9fd57e3c2c72bfed2e3d8b89e67336e984a4322564e1f3af864bfd781d14f623ee625508e047519c9591e0fa40038487a0b646262
SSDEEP 12288:n70Vm9IYNvUyBp9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:QpYNHrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14265E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b1777635214ac1805188b55fe709336b4190e60319782b2bac39b3af8286ee07
MD5 54c157725d0b55a7c94faa765daa5b75
SHA1 599e19845c207b1622b2d8b824eff4a05564f9d7
SHA512 3172fabda96162ce54fa4e3ba7b1ab36e958caef5f1c83d956e848ee421254260cd92bec9b9fea1701ace9bc802caa9ec2c9d3e1fc6f3d671f3f93365e1b58a7
SSDEEP 24576:xnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKH:xnXoJJYH84VVS6AmEOJas+cHBjSSKHP/
TLSH
T11D65BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 42d680d50516b8aaa850a2c3f4ef75a09d49084c029b493e12f67458c7b9d873
MD5 9f3e5100416ae57160ef128b18974650
SHA1 58936781bb9466e49d9223267ce28cd0c1caf206
SHA512 2e91a309f6caf9cc1bef00c8eb38e6eb46de07c53bd82001b605bb27a72a1814eafdc5534c1db273bcc7349711e4e2b7a4cc1d4c41339925029294e017bda610
SSDEEP 24576:nv7Xbxd9Tuycf8M/TYlSuxrr2PCFsqjnhMgeiCl7G0nehbGZpbD:nDLL9TuJ0M/TYj2P4Dmg27RnWGj
TLSH
T167858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 96a5896ef54424459dd42036d046fd50e546b8ac22100b37f870e58b54755813
MD5 c39af3885ac2ef9d1c1340415da2bd5d
SHA1 9648915dbb3b2cbefe993b39609f1c706f8da73f
SHA512 1ff63bf7e45c0cd4f7ba99193d74000fb68ce8f9c56849a2453dcc8c7ca8ef123e46f0ff5d10adeb9e06f54dce28812659fcfd6a8c23eca7e66301e3a1a4db14
SSDEEP 24576:IegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10w+sqjnhMgeiCl7G0nehbGZpbD:IngOJOmPOHzSDmg27RnWGj
TLSH
T18F55CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 42e3ea7646139b018d7d595f34c1885d3fdd44f19a308ca7166bb304dd387bc5
MD5 e0287ffd7c33bb750c663394ce94b38c
SHA1 1cb58bc7c275bb9bd5a4f1d3a56a93855460e5c6
SHA512 cba541145664f75a2d456bdaf554170bb18d00ce769590d2c759303a701f622d13da6f2e32e1adbf14ee20b83b1b9df44317ea52560f8b29bb9e933604c3f9d8
SSDEEP 24576:BLJnJiTk3R3waE4JrOMsqjnhMgeiCl7G0nehbGZpbD:BLJnJK8R304ljDmg27RnWGj
TLSH
T12F75E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 15e85e7f28d8ff661cde2be927c353292c304848686dffef9c8abc9f459da3fd
MD5 764b224d5e354444d8bdd08404e8016d
SHA1 e1d5b438622bf602a7c3cfe6a572a1c0502a6af8
SHA512 1d8ef2aad06bd0ec76c1ced3788f7d11f643cf9c5113760df98f46d26bcd8b91cf96a6f77c7ad55c106b4bec5b017dda17be587ce3601cc3cb0a21db8a4482ef
SSDEEP 49152:59mqCzDScAZmlvTcFg8Ph6cDmg27RnWGj:t/D527BWG
TLSH
T173955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 b8eb028cb30d36f4b21987dc69e8242f6299642aa031c82121b2ecebef96cfcc
MD5 3990e3d9b8494a7b49e4608ad9a05f92
SHA1 ca0a4d7331719f2393a30db49afdaa7a207d20fc
SHA512 7f76f5d68e9b3d654808f11d4bacf0fcff8deec2bf3a4b66d9cab135a0cb1f7eccd5263486434a1d383956baa357df5c1486647d87b7e4864a49facf62fcc5b6
SSDEEP 24576:ulYJeXm5jUuEusqjnhMgeiCl7G0nehbGZpbD:ulYJeXmRUuECDmg27RnWGj
TLSH
T14155126E669C30E5E12A8079C2E2C508E633B876671017EF56E0D5BE9F679E40F3CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 8dc8c1c705e83d1beb51411645f578cddfdfef903d177f08a1dedb02ba521675
MD5 7724c9d4aab2c8d80036e822a6d33b69
SHA1 f460e60d001870a70a3917c69724b4a2c5700d43
SHA512 00da84889253901776127ce426a3a67a629841c6897ec846e1d5124522761b5005df5eb8efe2a4932cfafd0f0eeb5d93fd29f3cb7677f2714699e7f99d97026c
SSDEEP 12288:amu6kyPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a7tyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F6552219639860D9EA7A0578C6B3C158DD367C219F2002DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 0b21a29f1faa91f758e70d87438ffb78beff899c38d33a3ffc68c6e8d6b0ba03
MD5 ad74505411c57b36e7e1f5e927b76a3b
SHA1 a24a8badd893aec173316c78342ae94abf53788f
SHA512 6e4426f258f071fe5a10807814792bddc8562467a745709ff9fbfee932d3f8fa88fe8e7023af28686040dcf836298009e174dc57449faf8106e822d322ff4269
SSDEEP 12288:xP+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:l+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1404523BE525C60CAD92644B4C2A5E10DA8173E76AB2014E779E3FCBDEBB54D44B38813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 bbdf02ccdc52b49df7cd344f49a67d0807ef85d4be8d70238becbaa1bbe1eb93
MD5 1d9d2ccfb85a524f8063df5f6ab36dc9
SHA1 3add303af103ba847d14048e27b9eebd33716c42
SHA512 cfe4aca39ef06fd6a953ebc9bf74cbe158e6cb4cd4e40b23fc9830b0ac4188d3a6f3d344606f6fa497639296f6a035c8b84c7b2516acd48824e6c36b7c2a099e
SSDEEP 24576:yC+TyQIu93VAumZr7jm5sqjnhMgeiCl7G0nehbGZpbD:y/TfIq+Y9Dmg27RnWGj
TLSH
T199558D2DA7F919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 ce898533d1794c8940722feff93e6ff326f44395255924ca063bd15c211a1cb1
MD5 d1a279e3bec425e6badefa7a182c3873
SHA1 1442c23618f515ab978d06c72ed223c608a3e6a9
SHA512 af71dd6e12a0a8d714eb25c8d599b0131b2c18ba762cc0c82bd3b38fa3548fd6142dbc3fde7ae78de0dea1dc824a6a2d55b0036c5cd5770e19e1726d61d32d33
SSDEEP 12288:acyrWOstaa3kcsqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:7LQikZqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13065F11FB3AE0096E067817CC8858116FA737835571167DF02A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 55f287688a48a4cc6790476222609a53ec9a927236a6a4b7f80c8bb5dfca9a4c
MD5 56d06bdfc03b95ae03d63b1b87212532
SHA1 6eb8bc123253d87968abeffbaa3f1effac82e4a3
SHA512 cbb7d6c18a89aa8e8259b797ab835e6f398ab8c382bd499449b3612ff83bc573f63c64648b9150a85db16d917685cbe7dcf935558465861cac48335c36476545
SSDEEP 49152:ZpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPzDmg27RnWm:qpC7b4+80GTkkD527BWG
TLSH
T17EA57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 93530d5b6fa455cd039993ff0024515f0459bf50c85153d277be9ba0c2afdf46
MD5 2ebb0305d04ca4acc4b2a40bc11b1a7a
SHA1 6639c8a589da4bda3d96b6529670c4bf63dfe93c
SHA512 a41263fc301c8b1365783a42b23576467ce476a4999bce546cb5d667794cd150003832886b693c2be91f9fbdd00ac9049d130cab24ef1439e38b50cfd004a78f
SSDEEP 24576:kSAwJPE1IDAo+4Kt+l4413JUQXsqjnhMgeiCl7G0nehbGZpbD:kqPCIo4Kol4vQrDmg27RnWGj
TLSH
T15A55BF2AA7F956E5E17ACBB4C663C601FB733822133163CF5290857E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 447c8ff7e3e79c56c38b693c31c6ada75ad79c686ef37783a30a614c418690f0
MD5 e0ca8df680e46cf6761df0034fb4378c
SHA1 f2f8d3a38fa20d1f047318eb8aff20238c9d0c78
SHA512 e6c3e427185fdeedff495edfeca5274f17e2b1f8c87abd7c668d8dde7dbd0017bb64d85c0c90c324632c5de26011e5245e9be8329a19c32863b7fc59cfd7ef58
SSDEEP 24576:SyLXPLcw94tHsqjnhMgeiCl7G0nehbGZpbD:Sy7PoXtbDmg27RnWGj
TLSH
T15975D03ED76C04E5E47AC27CC6A3C506F6723CAD033166CB19A095792F6BEE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 1fee7b63365939fb118c72ca375cca385ff66c623ec70fa059a8e09d8ac0659b
MD5 f512ae5a53e988413f489086d5ff75e1
SHA1 6a53eafc162a9f3169e52f92d8c3232f4a101618
SHA512 1aec7f8345b31df5978ae99b0a175de57b1abe2de2f72357dcdac81333a7360c3d9a4de06e3a685ff4f26f941b52f93d89a13fc04cdf4792e6b87ea49818364f
SSDEEP 12288:G9lyvj3IkxjbBz6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:GWv8qjp6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16365126E529820D9E43A4674C2A6D12994337C77173459EF75C5E8BF8B31AC0CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-166-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/932-172-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/932-379-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/932-165-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/996-159-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/996-320-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/996-162-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1316-240-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1316-250-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1316-463-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1316-246-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2168-482-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-474-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-472-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-473-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-476-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-475-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-471-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-477-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-479-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-481-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-484-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-486-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-485-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-483-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-480-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2168-478-0x000002EAE9A90000-0x000002EAE9AA0000-memory.dmp

Download

memory/2212-237-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2212-109-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2212-100-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2212-106-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2256-46-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/2256-37-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2256-48-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2256-38-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/2256-44-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/2444-62-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2444-71-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2444-68-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2444-187-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2528-212-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2528-189-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2528-195-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2600-52-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2600-58-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2600-164-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2600-51-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3576-113-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3576-123-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3576-119-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3576-249-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3636-217-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3636-226-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3636-223-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3636-461-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4624-128-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4624-139-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4624-134-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4788-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4788-21-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4788-11-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4788-122-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4804-215-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4804-205-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4804-199-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4804-211-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4804-213-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4912-0-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/4912-1-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/4912-98-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/4912-6-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/5048-137-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5048-25-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5048-33-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5048-31-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5048-32-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5368-95-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5368-83-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5368-79-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5368-209-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5368-73-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5404-99-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5404-86-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5404-92-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5728-258-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5728-262-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5728-467-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5788-270-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5788-264-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5788-272-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5788-293-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5788-310-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5788-277-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5788-469-0x000000000B9F0000-0x000000000B9F8000-memory.dmp

Download

memory/5788-468-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5892-150-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5892-313-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5892-464-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5892-147-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5892-141-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5892-466-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5900-234-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5900-462-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5900-238-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5912-210-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5912-184-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5912-178-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6024-138-0x0000000000400000-0x00000000005D6000-memory.dmp

Download