floxif | 2d633e88f8770f69eef59acfb6800914a01fd4d36729e5c6a5ce1d2ad36c124d

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
Size 1.8MB
Sample260602-nwezjsb161
SHA256 2d633e88f8770f69eef59acfb6800914a01fd4d36729e5c6a5ce1d2ad36c124d
MD5 2947218eafe149c78cd1237f8fbb9214
SHA1 ef9c5f17cbbf2f010cc87931707939ff069929cf
SHA512 ba6f05380a3bb0f0519a99c70ad0b7008c3db336c963e3c163aa47044f834efdb54d7d79e061cba0e932f168b8f553a0197fc655b7056274a2bb31190081f993
SSDEEP 24576:jlf15h9eAkGI6EB0T5QBbe2up0WEMsVQEnolA0+6vuisqjnhMgeiCl7G0nehbGZW:jHZlo/8sVLnolAvMZDmg27RnWGjc
TLSH
T14895D010E783C275F9AB14F956BE972E99387A31031690C7F3C01D9A5EB21E27B39247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery floxif ransomware spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x001d00000002b214-2.dat	floxif

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002b214-2.dat	UPX
behavioral2/memory/3136-5-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3136-94-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3136-475-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x001d00000002b214-2.dat	acprotect

Executes dropped EXE 22 IoCs

pid	Process
2420	alg.exe
1048	DiagnosticsHub.StandardCollector.Service.exe
1288	fxssvc.exe
3696	elevation_service.exe
4520	elevation_service.exe
1036	maintenanceservice.exe
2440	msdtc.exe
3608	OSE.EXE
2620	PerceptionSimulationService.exe
3316	perfhost.exe
3556	locator.exe
3588	SensorDataService.exe
2040	snmptrap.exe
2052	spectrum.exe
2496	ssh-agent.exe
4000	TieringEngineService.exe
752	AgentService.exe
3772	vds.exe
4608	vssvc.exe
1540	wbengine.exe
2368	WmiApSrv.exe
1280	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\e:	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a4c79da0e7fc2e30.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001d00000002b214-2.dat	upx
behavioral2/memory/3136-5-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3136-94-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3136-475-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_161703\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002221a83e85f2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3054f3f85f2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d9b603e85f2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb561f3f85f2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb13de3f85f2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
Token: SeAuditPrivilege	1288	fxssvc.exe
Token: SeRestorePrivilege	4000	TieringEngineService.exe
Token: SeManageVolumePrivilege	4000	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	752	AgentService.exe
Token: SeBackupPrivilege	4608	vssvc.exe
Token: SeRestorePrivilege	4608	vssvc.exe
Token: SeAuditPrivilege	4608	vssvc.exe
Token: SeBackupPrivilege	1540	wbengine.exe
Token: SeRestorePrivilege	1540	wbengine.exe
Token: SeSecurityPrivilege	1540	wbengine.exe
Token: 33	1280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1280	SearchIndexer.exe
Token: SeDebugPrivilege	3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
Token: SeDebugPrivilege	3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
Token: SeDebugPrivilege	3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
Token: SeDebugPrivilege	3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
Token: SeDebugPrivilege	3136	2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
Token: SeDebugPrivilege	2420	alg.exe
Token: SeDebugPrivilege	2420	alg.exe
Token: SeDebugPrivilege	2420	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3808	1280	SearchIndexer.exe	105
PID 1280 wrote to memory of 3012	1280	SearchIndexer.exe	106
PID 1280 wrote to memory of 4612	1280	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_2947218eafe149c78cd1237f8fbb9214_darkgate_elex_floxif_rhadamanthys_stop.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4188

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4520

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1036

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2440

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3608

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2620

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3316

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3556

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3588

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2040

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2052

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2508

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3772

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2368

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3808
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2956 2908 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3012
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2928 2940 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9d381381122dc9f4cae44263b04c9f21998fdcc325c0cbadde13a462d2e9be2e
MD5 f078ac679a2b5c105a83dfa799f91bfd
SHA1 3793b672592ace704ef23de34a81d2b8f865655a
SHA512 7c43f1f5e12b217abf17eb34397203c965c2e35fc8c18a36e429fa60c7dbb9d7afb1dc5f3181b3c065c8f81ec7b2d026b085698356cf514f71c0c0cc7d34c7f5
SSDEEP 49152:Ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxn0Dmg27RnWGj:O3q6sjBzD527BWG
TLSH
T191D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5e07e368f34af2b505e42c14e9846a6d7d71f290bb289aa5ce45f14900fcb057
MD5 daafc3e9a75f002e89e6db7083717fc6
SHA1 87469167ab086c1ebb3a6c981f20a17add9b3764
SHA512 432f2546d1ee568356d0ad79598e95d016b7f8db12cb34f1605cfdb24081760ea341e9610a6ece4aaf4aaa234f1af66f8b364684048a2cd3a7822e2b60418edb
SSDEEP 24576:1XYfDtczAbsqjnhMgeiCl7G0nehbGZpbD:gtcODmg27RnWGj
TLSH
T1DA65F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 29f977b4afc085c87597e525b2c725dc26182ab37ecd75bf99faae935156a596
MD5 40ebe7539f9c15da7954a6cfce26d9a5
SHA1 33ac6fd3c75aa0bd8fe93c67c1a686597044ce34
SHA512 77ecfbc6d69e09042da96ac4d361f403c581c90edb3f8e1941ee23d93f637dc19b923fa96925b1561f759223923a2226e00747c38a65593f73d1b9dfc3eed160
SSDEEP 24576:T0Le5ji0hmxxrMgsqjnhMgeiCl7G0nehbGZpbD:TPji0Aj9Dmg27RnWGj
TLSH
T162859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4989075d9c69fae3d92f57e0b638e93e1e31445a7713a26669ba5f0d085a1a9d
MD5 d08b556d8e859cf2cde888df284dee90
SHA1 b1100471c78aadda3e0b4e4e375450edc374c96b
SHA512 191a849038150a6198e2b6208ce184aff459d965b1ab4f13124099a8494e5d548fc4f8d27fe2c40b897b13b2df0ad21c671fde56f45c8a5cf74a9bf7665b06b3
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWn6q8wyuqsqjnhMgeiCl7G0nehbGZpbD:h/ezSC6vUzPveHjyJDmg27RnWGj
TLSH
T11E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c7321b098d2d228bf05d055140d18c5fc90ec0d02728420fc1467646ce1fc75e
MD5 e4f93758a8b9801a805ada9363dbe23d
SHA1 c9598c7b83d5ae67cc5c03b6c089368322cde57f
SHA512 e0af99ae9277444a2c46d87081585180b28165d929023706fb59ee24e743844187591e175bc52ce40b7cd8385caf585447f90f75c1528838324468027218f65e
SSDEEP 24576:4VbqPb88hv/l+Y/sqjnhMgeiCl7G0nehbGZpbD:4VO88hXl+WDmg27RnWGj
TLSH
T196559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 16d5095dd3bc69a85b0e9fdc9e93c1d61fb9ff09babcd2113e0c605ac4a8a8b6
MD5 3af0c22b67c7cc470a42006befa32d39
SHA1 a0b8c62f51071e296b4e4626ecbe26786eb840d3
SHA512 84f7cc2d284e4f538e5f79b323a0ffd5276de0d4d3871a119ef185615dc82e36827302cdb1a6ddeaa4944f0c3f6576a9ee96633bc2f58f26c73011f9e7b6850f
SSDEEP 12288:dLEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dLEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BF864C51DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ab3c951d7abac4297ff7679dbe20c4f5d48280bfc13c04cd9fb09dd4a128d445
MD5 a432f7cbdf6b59759a531c6660ebf18c
SHA1 1ef4b21b14ad2a5a53674840cb93847df1ed6eb1
SHA512 f5631eeb1318a196dbb36f6607a63725b357281b86d51d2f542eea907f952ce2b24efaffa0e1bc6f9b7a0b926ddf93107c0b85968d23b85e546aa773504b1e4e
SSDEEP 12288:6eBNUbTVO86U3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:6JIU3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA65CF7BEE28FCD2C27A8DB85791C600E76278314F2193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1ef697042d8de6f737ddd000c5477b8a6087e7c738e6ca84093cf2d84d9c8234
MD5 e2790854875e8dafc2b2ebf60d41cf2f
SHA1 3411958b692a65ba3f14bbba4141546e60bfe134
SHA512 fa75fa7f0e9e1cfdfeb76db28a53d72d88fa7398fa65037cc096976e0a5c53845ddac4aeb0eb7d7ef179b94069948fc160ead88a6b04c2f5d6540d8b1cc68e6d
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THK:7QvGAdlCEL8c/DRNw5CuD527BWG
TLSH
T1A4266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 74df0c67c879a20815578ec8617168e5826f1da41bc2fd2c02ed7994487a91f1
MD5 02cce3bcc6b5ac3e72bb8869d0d7d8f6
SHA1 eec62bbe695ace99f4397fec1e8f71381c7517c0
SHA512 0b005fc3261bfa92202e0f13f697ac6107c67a321db752d4521daf07d9e26637096de13cf1e9a46b90d6f8dccbcc3a7dc20a54c8c96526e0ec3e90ff500d7f33
SSDEEP 12288:iAwSfxL/2Dc3RDLLmt0LDQewsAjpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:n0ewsAjpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b6b7606ab47441d038b90de7538263b3a2e985796e7c4c1ebd0324e41731309d
MD5 5efc06ec3a58260d769dadc2b3b158ad
SHA1 f2d68a8db51e5ffb7ab19a44dc270b74f3807c45
SHA512 c424e18a8579d2da7bb7630c5b259c7b23f2da1875c7c0cab357966d78482630373c39567e83424619e17d16acdfa4fb2167e43b43e606b3fd2536ae3bef475f
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHlVQBWG:OUEtQevvqc2W1cpV2tI32wB
TLSH
T147474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 926cdd3fa991cf800fa342db63630527863382210781548ba32951c4abda8f28
MD5 b128a3afe3decc3f7d67a637e0c6a452
SHA1 6cf788582d723afa8640aa256891ab14ce4198f5
SHA512 0062edee16fe1a4777e943d5c0200523a982c592606de5f153288e6f9cd8ca0133a374fe2afd60521e331521b81ebe78f829bfb1291cdab82a6362e4a42743da
SSDEEP 49152:JCbRquA/m2yL5zTfFiV+XenmE3/zNDmg27RnWGj:GoquVjnmqD527BWG
TLSH
T1B7D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4048d31f84cc3974974c77f1abdf4624a059a369d178807bd224546fac7e890b
MD5 21ed5032aecc4cd817b1978e0032dc8e
SHA1 cec01b1207693abd30bb78fe6e31fb38eabb0fc2
SHA512 66e1051a9f90b7c13f4673da370897723956f803b523f8a92f2f671344272f160739bd575c163ec8baf0876293f384f1696162937456444c80d7e219d6fc12ba
SSDEEP 24576:JAhGL3IFoiwtA5l7S53GsqjnhMgeiCl7G0nehbGZpbD:JAMUFoiq5aDmg27RnWGj
TLSH
T18D359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b6d58c8d5be50675b3f0fcadeaf66c3051fa013a19a65c4a0b46c56261a4b61d
MD5 f6f44cdbd3d77e54863bc8e75ff322b6
SHA1 cbfcbdb848a03650f3bbf5aa6b1dc8acd398d0da
SHA512 d2466074d46ac144530e477a2c9543e5b525c321226344f756bc246b234c42da11d48d62199324aeb339916d380f02a7e6bba8f613e1d6c0c2ae89207981a496
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+CKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:twu4OW1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11365F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cb23d2e71e05124bf09ef826018a5aedc61b7b5d362ffe2344571e5aee0cdedb
MD5 205315ca017776a3834af05599881ba8
SHA1 b65a158a4bfb1e76cdbdc71b9bb15fbd8f3e0ea6
SHA512 b1809dd7a5bc0c76d51cde3ffea9124a41972aad1ad7195eaaee647f65bc9db95195833c6b7301afc213f1ed7f55bc604d7026f8e828b277fd60748217e9096a
SSDEEP 12288:HeZ1IyZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+Zu4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C65512AE239820FAE163417CC5E5D609E7333C52673043CF16665AAA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 66e81bd5e1633450a0fd79fcf0248224e7d4cc29d223e562636f3c8ca64c9130
MD5 44b1269643b5db3b936e4a1edf7cd39d
SHA1 d21f77222054235567d721456994cc96c9ada01b
SHA512 5bfb9cc1e7ba07274f3012c3476e2014959114505af382be22170cfa5b07cee9a765cf90a5b2deca24b8aa170059de97bcaa736b1e5494d244ec07e4ecc9e684
SSDEEP 98304:jQRQyi36YOcPbLvw2gAf+PN33D527BWG:yQyiKa/X+PNHVQBWG
TLSH
T193667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3bfbf0e0952349b56a954d5422d2d372f972c98f11f6708f952e1723a9436ef4
MD5 88e91a9079e0268e2eb69e3fd39cdaf0
SHA1 4b8f8bd568b4427a789ff6dfefb63822cebe031e
SHA512 e7647325dede073e880092d41863c767ca7493705f7cf26fab8f91bda3d217b0e7d68b39234437f2e7d0e18c7e05e6af847a8b81003279d5c6f8393c23913c72
SSDEEP 98304:rQRQyi36YOcPbLvw2gAf+PN33D527BWG:aQyiKa/X+PNHVQBWG
TLSH
T1A3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4d3500828e71b85b8bed6835d52eda9134da6e80413bf9b02d1811c796fa5f2e
MD5 36a0f14e363d0ef1cf4f220507456ea8
SHA1 9d4365a7a8e9221e4f87851d64417d3336784a42
SHA512 f785ea67edcdff1121cb8c717b50c3bb0fa7518c649daa410b24c0bad964e6343f97e05b83c025a523be48cd54cf3c95e891dd179fa82166f331b011e0ea525b
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0IsqjnhMgeiCl7Ge:q68Qg55nhceWu7PNU3/9Dmg27RnWGj
TLSH
T108B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 30cc3496ea3bfddfc6a67a3e6f8682c80dc915d797c7bd31e597723b5f1b8641
MD5 73733e52045719e40d6077e519283b0a
SHA1 f1f42bb9308c9ef5ca2b1b9a6f5f279ef951ad19
SHA512 8971e4d0323ae22701ae42da54ad0bf9a934186a812be92b75daf2a0d87be01f1c18ee54a0f276bef356d44f9c06839f91a34bc3d81625415e4b1360daf1ef67
SSDEEP 98304:iy5112gYy5azzVvt69nLKnhZgD527BWG:rLIHEWhCVQBWG
TLSH
T155167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 af2dfec12106ff4fec8cd772db15ed19949cac5e752baeab695f6b8e0f6353cf
MD5 81c2179522b285fea475d561c903c525
SHA1 5455057f7e5f42fcd68956398ea699c66a12612f
SHA512 a66494cc441afb5f614c92e3d6c7a2529770d59c488d08e13fa3c964e6e50404213c44f1e0beb4a05c2b121d0db4f69f92a2d42299f8d57ba91f4a41e7ba4a58
SSDEEP 49152:LB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glfDmg27RnWGj:du6Jmdxd2dfD527BWG
TLSH
T111D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 aea347e86ca55e9fb142d060c4db39aa640585220cf68875616aa2c65b8add9f
MD5 dda59ca117209165171fe92804c0e526
SHA1 87c7a338b537d95ef2736e7963a987f2ba7747bc
SHA512 a4c66cdd380132b176fcfb649dcace04abdd35a248fd8de8a9002c2aab0b59127b6abb0465023d03bccfa338aea2041dab0ed8ea32ff65e07f86d1f1d17c0ddd
SSDEEP 49152:I1hpsNoJpF1A63U44CwH7R4xrDmg27RnWGj:ImifPWRqD527BWG
TLSH
T15BB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d10a7d3b2de4638f0df9e12c3a2bb6435e7bb7652d9ee84972209190b85b6636
MD5 fccaff723a1af7e818e4735bd7cf9df5
SHA1 bad5eef1026d0447c46822e658e51a6193bee035
SHA512 871f4267451dc1cb0c244a9638b47f1da0a8048e690af68cd2fe36a57521ee3c327ba00fa40ea4d042e745718666c51778ce1699828b49c0db8dd71e30306ad9
SSDEEP 49152:0SuZQIY0Be2KcRVtOnks6NMHqkDmg27RnWGj:m5dKii61kD527BWG
TLSH
T17BC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 24d2526b47ece4bb5db3d43bf243003a51254dcd2d52ae7e6410f5401e189939
MD5 e2c3104a77c2bb9ad3242e96db9889cb
SHA1 c389bb1493617f49f93708ea72f8bf0a991856ca
SHA512 7afa7ec6ee5e39aaa3d0c9628537c0bf1b5022fa0e71df6df640248f20766f36a0aee09ac66735bd93cdb1ee2ecf84a6bdfafbe5e7cc85c15c13fc06ebb18114
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wPDmg27RnWGj:TX2imphGD527BWG
TLSH
T12295BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 80ac872ce62118a81261551abb836c2a89799f0eb0d9364549160692b3459fba
MD5 adcfb3a2773481974dd5577b500fb5e0
SHA1 1dda4b0998d59a4c6f830352b8e031714bda7d03
SHA512 4a53b039ac0aecd4097f3078ac25f4da0fec52a675d60ba5ba450226d0f132a1673282cf4e1e7ca014ad698f96d6163d2814e6404a5abcd2d9e68d8886750f18
SSDEEP 12288:l8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:l8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C14523BF965C41CBE52648B5C3E5F10EAC073E5BE92004937A977CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 aa7d0e01a30649434398706c88f9e7561e343be972c3ca0405f207f4b22e934f
MD5 35e5382a39f0f8f0d089fb1749343f32
SHA1 dc4bfc46a17fc287ca40baf692e93c54fec63096
SHA512 3d0ce9054190ea7fe7b8d00ceaede4311fb0b39c5dfa1f203e684fb6c7bdc98c4e8eee5eebe1d71d73c28cc3e38a33cabaf1e76176eacd240d9e205e3f75957a
SSDEEP 12288:l9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:l9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1644523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8f2c06f57d446bc48dd55bdd39720923c1317889e397f066aec959a26fe812f7
MD5 70a5a06f2f7775a1d1d3e62ea3e2203b
SHA1 9d83e594fb50044676123318e71384eb6c1da3dd
SHA512 c1e13120162729894f26eb7e218f8b2adaff3f673d18cf43e33860f2632a5d897a0d85d8f7a8a8840f7bcfd82feea90ea44526f33c24717b7c788db1f4b20776
SSDEEP 12288:4PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A64523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CB9FAB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 125ab751b515687a99b0fa7a519a65ded8c3c44346961d70452f72261bab41a7
MD5 9c1506d0b68bc0a0f446224890ca64f7
SHA1 95b9df9027b49287bc9a680acb1ef997dd7b60f7
SHA512 3324a151b1e9755fb8a7f672c9dd8fdb686f5720914849ccc4fb5a1a58d99e2eef9d6368ef96733a7e126b4b2a124e6b993b349dd79bf1d09eb728bbe1262996
SSDEEP 12288:7VmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17345236F675C01CAD83285B4C2F5E11DE8237D96EB3005DB6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bb1356f4adcd9bceef91685df24a95ee462ee3840d9b77d7042834b5959fab56
MD5 3a0b197b3418854288ac7c6b4ffae33d
SHA1 6dbcd5b42e7117d078ace45b0dcb21ef953f5eee
SHA512 871320ed11ab81b7ba655a1a92564c31dfcc56bb67f1a50ae23a86e78378b0dfbeda85cd74781b1889369f4d76832da02db6192e03f4005f227bd2f3a5704413
SSDEEP 12288:cOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1784523BF965C41CBE52608B5C3E5F14EAC073E5BE92004837A9B7CB9FBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2f0036a390fb263c75eef64586283828f05c294f7b465c2c2ef90a68c53bf12f
MD5 103cbf56ca3816cdf75e2619d4984d46
SHA1 3cc929ceb24b532b121b3a8ab163ad55ff4dfa57
SHA512 9cbc12e9ec42bdab00a01abed3f2e3456e7d4ac6fbec767a2c58e6483e4baa2e98492437185be667b9d565d0831469c9e6e45364d47130d5da245929dba626f4
SSDEEP 12288:+BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 20181a9bedaf9e3ec1fdf1addd6bc2e69ad6265ab20f7184cdede7a57f71f22e
MD5 89785d26ca77dc8b38399138de626ae2
SHA1 0d17be7a75603aeb3b9fd5c504be0a11d2002e7c
SHA512 272327157349aaf0f2197f50c1d5311c0afa6d57dd8e72cca23a36dc302ac6f0ef4aa4e35a01c0e4543d7da2715981b267a714bf3fa140633baddcec005c94f0
SSDEEP 12288:+FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1214523BE965C41CBE52644B5C3E5F11DAC073E5BE92004837AA7BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e50d701fce35364461ff2b5eb5fbeeb07b64d29615f4283a0b36e7123abdc57d
MD5 ea38e4fbca6970f8f00e560ec54c6a5d
SHA1 49d2445776b565c9341b1d5989bbcc852c20ac6e
SHA512 e60c278f9ec3c27c544e1bb051c56ef178884ae03f2681094e5b0d5c0d134f695dcd7e496f30bb55031924b5e3b04a2910a04f4ca9738a3e483a404edbe58c4b
SSDEEP 24576:rZMRzFVSOdsqjnhMgeiCl7G0nehbGZpbD:rZMRzfFDmg27RnWGj
TLSH
T1DE6501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5cdf7c9719fa68cf3c86668590d989e36ca6da5c58c1f0c8a96ac8079c10dd7a
MD5 90af725fdb75f6f754360904a29b1c23
SHA1 8b65cf8da758c8da5d2c134142545c77de0538d6
SHA512 4c3e3bb4fc79f4a2f9b6d598e7c07ad831ef86e53eac6df0e42389ade7991096ed04993387b5c8909fef20d35407493d56e45edbfbe3e42fb18f8c75fb2ca342
SSDEEP 12288:KoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KosqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e449840243ed311d575d2a6bd79651e9193495441a3da5a9642a11a9755ba576
MD5 84fc134e82eff6600706025261a64710
SHA1 8d2e3c39952648a7b8f8899eba95c268fff72eb7
SHA512 c1bfa4ec2937bf4b7eedbaf1cbd6b1a1330103ac64feb9a8fb66cb86729d957a22cfb57996807ef0e4ddf477f67fd54d71bac6b1af1da1c92281cfc69bcba1a2
SSDEEP 12288:h0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F4523BF965C41CAE52608B5C3E5F14DAC173E5BE92004837A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 da50667acb89dc11bb36eb990ead5d1d9d820d1d2e906516a83c38e410e77ab3
MD5 fc0fb72aee248e2c674e957ab9fdc843
SHA1 13b2aec166df0ebe2506b346e232a721a782b2b0
SHA512 393135df1ac43340c104e341792d5ab1ba09fd25271f150265bf571c347f8f99a83908bf3da1f1550be0901750a850ec05b3195685c4e3f26a237a56d41a1631
SSDEEP 12288:+yPz5L8ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jzyZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ad48728c28015c8fb76524e63d0ea691d75a66e635387693afcfb2356d105478
MD5 a468939a75013540107723779904d4c4
SHA1 f86b11b2b074cff9e164a73710e2c2955e60b233
SHA512 7eab69c7f0be1a3ba5d790b5f14fb12203bfee5b0f78779b708fc60cd643778178d97e9540395ad83ff508764c893625ac7547b698b02ea2fc1f6da6afc4abcc
SSDEEP 12288:RoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RosqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f61fe4f70f5af9180b513d136d99f146e0922618bbf8db7c19dfe4ac8dca04dc
MD5 a79c6f5a3baa176e236ef2454735a95f
SHA1 d88e2896e4b85b5eb95ea63ec2fd4013e09957ca
SHA512 4bee3ea7b1d94db7df8f28fca859b2dc7a5b0a0b17a17436fef43f9639970c9c52b0548939c534ac88ff37dcd0b023dc9c757bb5be5da7c8660f1a1d71fa4eba
SSDEEP 24576:kCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvADsqjnhMgeiCl7G0nehbGZpbD:kCUZPTY+8Wg2lIL8lrIUJLWwiDmg27RN
TLSH
T19865AE1EA3DC0896D4BB81358A51CA06EB327C2E1B2196CF2160C77D6F67ED54E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 083b5fa8f714fe753ab59da35c825f04368d389c94402d9bc865ad8e6ba207f9
MD5 5d269e6acc0c87726603bbfea2d93459
SHA1 bc16bbf9eedd42f07b6102e950f43dd9d9fe0a00
SHA512 e58817192a1841cb7a2e6ae1d7201e8db6cde5bf2a5c09cb1d9ff7f87891f5a0aee232f55f8a66c4276d1e214df661210547d51ad42d08df1940d04228dfd9fa
SSDEEP 12288:Rbsf4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:s4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F955015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 240f81932589385729f65a477b4d92dceffa9cd1ee708247774799d3cb6b179b
MD5 a1632e5c9fba0c0f9e86d6e87d538ec4
SHA1 78d39211e3aa50f1a1c3e46c30d21616f098b093
SHA512 a824130bff1159649f84bdfd70a11ab5459ec9fa55c26f19db39eb537b1e953a3ec94f9c55f29532a9f561abb909631803373c4e43f339da958e10ef023c625f
SSDEEP 12288:MvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D345237AD34C518AE57649B482EAF12D681B3E669F2004C3BA4378FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 2a7cef36c330eedc30bf6de8eea3967d4e60f5a73354bd42d67d78b4596ddf4e
MD5 b54c5029619a1dd1315a3d6ce69eb816
SHA1 bc2ed1a03a4ed78bb97053baef0be9ae7ba0bcb9
SHA512 e069857b54953228fd7ae41d648c3bc00d7dc3081185b63712318129c8e2d569f777c9615b1131c32d414a6d6ee121f584a8398402a74c85cf6fe44f47ef7279
SSDEEP 24576:e8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCJsqjnhMgeiCl7G0nehbGZpbD:HRZwQCyiHiQEaiPnM8Dmg27RnWGj
TLSH
T15785B01E62DC42A5E0BAD2B8CDA74407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 f90df92a959d7f483682d964fc647e0a3342f93cd89da9217deb5767ea71698a
MD5 8d27f11920d5e607bdf5a49873156b70
SHA1 7d9b412f85a04f298d5e21ff7d15a4340bb8c6ed
SHA512 7147c449f01a6a389bcf1f388f68b0bc7422de636ae0cbb7716f89b8bedf82fc89837f1d7bc5b8c6385b2c1c53fff3f2c6bae1fff484ebcd9f33734e84a3cc23
SSDEEP 12288:RbxA1U7KfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RbxA1UGfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14455123E62AC20E5E176957D86D2C10AD7327C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d8d01d45733cee6f579cd69a9e2856d91232633843b08491d30f399ecad94688
MD5 a64a3d94cc0ba27ca385e044cacf2004
SHA1 15f7ac94ca7be84256dc8394ab8c2fecc3c8b86c
SHA512 c194918bd7f2d771c9eef77ac649110f96e2115c9d8321f2de52dc6c1e57bac37ad5ee4ee98b641341e815d75e25d1c89c2e00ef0e9a5a2251069f4a4637118a
SSDEEP 24576:rjsmP0yHaqrVqHra44KDzMsrnWsqjnhMgeiCl7G0nehbGZpbD:rjRP0yHfVqzlAsrnaDmg27RnWGj
TLSH
T1C345AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 9ecc941c974fedf75b868295d54ff228273056afa9597df9ae6cce8d6ca99898
MD5 466b7acc2910755fe3816d0fc5004eee
SHA1 239050aa3fc38def871fbaacfdfc11f3d448890e
SHA512 01810722cbe139bed04e4c079e92a9a06458dc09d767c98c77ef34c8db206061cdbba795c934782c5842f97cf41a4cdfa95edb21a044d6c8e9542f6ab831b2df
SSDEEP 12288:RhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1764523BE924C51CAE93649B5C3E9E11DA8073E569B2004C379A77CFEEBB54D84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 e8edf7cf2b6d14ecd0a3b1665f4e521bc5c0b7c88c87f5ec4542bbf4dc4559c4
MD5 98b1d736cdd43842b208d6740c174926
SHA1 e45c4a1f22a3764ffe4c56be5e4a7346bccce913
SHA512 2d0ab312a613725f154a52f3046dcd39e046d477f88f59d8f67b2bfd1bf4c47e085e76dedede5a5328c47547d9724ea421772a0764b049fb2b4e2af5359bdf35
SSDEEP 12288:2ObfA4LWO+vAYFTbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:fbLBUTbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F6750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5e2bca9718461bcc9ced7ecba2bb64efbc2307fe3dc40ff4b0db62e29b0602f7
MD5 e630c1e0861ce22ab9f82b6a09c293c0
SHA1 ad8d7dc80bbcb4f34c1a5921291c640802040bc0
SHA512 9421fd557cedcac5a7c4e02eac6a64a285196252cc2af1b4e6292672a12739d70ebc9e290f07970d6a42a70c8954477d715105c580ddafc114f16be02f6ba804
SSDEEP 12288:Z70Vm9IYNvUyBpMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:WpYNHysqjnhMgeiCl7G0nehbGZpbD
TLSH
T17665E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 77d3dea01678bb800aa659a04eec8f795b7a6b3f4a85e4de6757abbd6f2adb07
MD5 5299c72f694d46147d3f6b5b511a74a5
SHA1 db4b740e2b6be4c6f38205b3add828132a48d765
SHA512 ac2da24b86ff838598450af48e5d52e2e1b4c67602c0b484ffd5c96fa1d92160a2ba83dc782a3351e0ad994bd54427bbe9286353f439cca7e55d4fd4aa011885
SSDEEP 24576:hnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKy:hnXoJJYH84VVS6AmEOJas+cHBjSSKHPs
TLSH
T19765BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 611147179f1f75852628fe9fe95dd2900f1e203e8cd254fc3a4805d45324f198
MD5 25a406071a1a42a177f00f3b442f91f7
SHA1 815f4b79484d5de1f47c08a2cd2a010dfbd62bcb
SHA512 03a876d8921c33abc0c7e7cd2fe8da8e38c14f1bc7e7e50a0d9a595da579d84f24cbe740cc9051ebf82227fde8e7ac272bedfa25029e3414de0293137256e832
SSDEEP 24576:tv7Xbxd9Tuycf8M/TYlSuxrr2PCksqjnhMgeiCl7G0nehbGZpbD:tDLL9TuJ0M/TYj2PVDmg27RnWGj
TLSH
T1B4858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 86d8e9722e5da40b2f980b78d15497b4d40e0efe58dd721a175a104d62950141
MD5 03716acf60ccbabe69b26a052babcbda
SHA1 981ae64257e2427c9639cac8892b1fa2f959ebcf
SHA512 08c6ce48ec3959d1df20ff624014c3e6cb415ccbe3a36f7d7c20806612ffb113e3470e07d5a13a693e3156f98df6261eb9efbcd56edd8d9327a7e7d20f501dcc
SSDEEP 24576:zegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wbsqjnhMgeiCl7G0nehbGZpbD:zngOJOmPOHzPDmg27RnWGj
TLSH
T13455CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 5c04f4655fd2a92ff058c1f9ce047bdc40072f927df5c182336510710c8b13ff
MD5 8311e0d6d1c581537559029ad3ea413f
SHA1 9dd5712aa9dcb9f85473a31c38157d4153344f7c
SHA512 5e133ec98e9a68dff1ab8e367f0a749b8e40569c096e91fa2ae09fe17ae426fa7064b415ce7b92fd7ff8d90ab55b3e8db303be051c326ef417ac9f84ca721ca2
SSDEEP 24576:FLJnJiTk3R3waE4JrOBsqjnhMgeiCl7G0nehbGZpbD:FLJnJK8R304lqDmg27RnWGj
TLSH
T11475E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 40b332de01d44c49321c7a317238e8d07520576322804e898dbd8c7598d541e3
MD5 36df81ac3969808d6bc76d13cb72d9bc
SHA1 9dc8c53fc4868540bd321f8782b9356fe4db63a0
SHA512 ffd0118493aa42a766cceda1b369214596c1dec095cca36b03dc28651262b0c6a9efd134a8e05860ce5e68c1908daa65e781eaaa0c9d89822df0a46787a38af2
SSDEEP 49152:79mqCzDScAZmlvTcFg8Ph65Dmg27RnWGj:fWD527BWG
TLSH
T106955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 878324e77af5177aa4b420abe91b59730295898e5e2c29c472818a96134b4a99
MD5 5baab4cf635e7ce1d1a671431d1407d2
SHA1 5bb2fdecace69a26587d7d8e41e1853cd8182d4e
SHA512 c1689abe79894abe7004563273e589229c804e4f2df0fe69f9733835cdc22ac429aed025dcb239b35ef2d20a7b9b4bbfaa3942545b361c405868ea15ab8e9067
SSDEEP 24576:rlYJeXm5jUuELsqjnhMgeiCl7G0nehbGZpbD:rlYJeXmRUuE/Dmg27RnWGj
TLSH
T15755126E669C30E5E12A8079C2E2C508E633B872671017EF65E1D5BE9F679E40F3CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 11bbe8f8fb988be38f8b19eb8f5bcd4fba4dd1cd6930fd6d320bb05ef05d1a3f
MD5 7bb59fbd0c6ab67afa19fc2a2990f84b
SHA1 2b97c15f0c4c911289216d9a5d9b3e6c427fec38
SHA512 3c20834f031d914b80574ca8fda47d7e634d92f1375743da5bf5e6f764aabf0596a3fa3ed2018e8bfbc3071c4cf0ec42b4c6f37ffefb299ee4e6065e20a7780a
SSDEEP 12288:tmu6ky2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:t7ty2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB552219639860D9EA760978C6B3C158DD367C219F2002DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 2277e80c3965a464e8372e343a1ad73d95ee19f73cbdfb11dc1bef0f566b0f2a
MD5 0c0145739b1c40bee8fe59e6bfebf3f2
SHA1 9254f8ab2ed6bce0c67457749f66cf793b06d8a3
SHA512 5333894d6e58719194dbf2d7ab89f9b7a3a3caee4a11937269ea1b33a5868d807e55c7781c1df85883267cfff1e99c7c3381de95ea60009ac4201214c61cfffd
SSDEEP 12288:QPbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC4523BE525C61CAD93644B4C2A5E10DA8173E36AB2014E779E3FCF9EBB54D44B38C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 94139ef505d9c6f6764755a89d418cd6810e6ca89fc883157b2ea579d74a1bad
MD5 0882a06623347119fa754f23d8e6085d
SHA1 e4d5db63857fd48b5543569405031c659091a259
SHA512 c404562f3af0fcbe30179ecc8e9a4b4017819e15df793a3a04d76b2df5d6c5f4dd990dc0652673f807c22f12ca35c186ab627e31e1919c950835711c84a64cca
SSDEEP 24576:CC+TyQIu93VAumZr7jmYsqjnhMgeiCl7G0nehbGZpbD:C/TfIq+YEDmg27RnWGj
TLSH
T14F558D2DA7E91DCAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 da95c7afc806e1439ed3b91fa1bcfbdeaf15b0075b637b03699981ea2687f52f
MD5 7e6efd86bff70e967a8f57a0d88f58b6
SHA1 5de4d067b7f8f53a28f1bcd7ba535e7eb0dff2fd
SHA512 ed189ea5d3cc06958c2ff11512033e52e8db302532f6bef3812494105524136bcad74810cb34a4c4d139044546164c73496e3baba3a1fb54b6372e5ffba83a72
SSDEEP 12288:kcyrWOstaa3kcsHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:xLQikZHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14165F11FB3AE00A5E067817CC8858116FA737835571163DF02A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bb254c6cf17ff00f0181bb4cd8e29619c9d25aa9fdde1661de739813398b61ef
MD5 dd6ff2495c5868bd15f28608bb662ee5
SHA1 20e09885d8a4f4811dedceaa952adcf243625ee0
SHA512 ebacdf71b6c7bb777411b885ee7ea3c39c06ad26ed73c4074ef75cfe85599377737498c42028fbe758ba94af030b5a6e7cced3269a776ddb96571cb99b9961bf
SSDEEP 49152:hpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP6Dmg27RnWm:ypC7b4+80GTkRD527BWG
TLSH
T13EA57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9cf6dd13b235fa97c407ddb5d57144da3d906f55daab961da8e29e7a59cfb842
MD5 5c251294deaeafc9b9f6d501631d89ff
SHA1 39a48ca678d55e3aefda2b748348c8676d40f12a
SHA512 07c2edf87976f1cf23975fb2ba6054ffe48d67dca15ccc1ce61f9eda341b293ac47ca22a86639173779eb9ac46ca83bbf618cb374860f9a69ff26a716746fac7
SSDEEP 24576:ZSAwJPE1IDAo+4Kt+l4413JUQusqjnhMgeiCl7G0nehbGZpbD:ZqPCIo4Kol4vQCDmg27RnWGj
TLSH
T11955BF2AA7F956E5E17ACBB4C663C601FB733822133163CF5290857E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 ceb655673fc98fa38775643978530c1ced24e1765278e8ddf4d14b3bbd693ee6
MD5 941a76c2ff07a65fe39a007ce67aefb1
SHA1 ba9f7c101b8ee6a57f2e7aecdd24fd1c6b25e779
SHA512 c7a929d691d17e5f7a1f7444b93313e9b60a66868347963382c881710d69953cf4a2193008c73f28bbe96d09b15ef1401187118b53548e7dde096f85eddfdb8e
SSDEEP 24576:2yLXPLcw94tesqjnhMgeiCl7G0nehbGZpbD:2y7PoXtyDmg27RnWGj
TLSH
T1CA75D03ED76C04E5E47AC27CC6A3C506F6723CAD033166CB19A095792F6BEE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 05bc91a8afa8b340f451e547a3812b8f573ec27ad6d7a3e93271d3ee54f9ec08
MD5 964a6f6c75eefa48f7c5f7a2f6615daa
SHA1 897971edac10bece4ebc51a4c7c68e9c743f3a8b
SHA512 73565171ffc6cd5fd8cf22bd1188d4ffa6e56efad83ec7d31e8ebaecb985fcd0f5d7eaac107005e3b278677d4b57f188e7de502d1e2ea6c428e6aeb2be9cd5df
SSDEEP 12288:29lyvj3IkxjbBzXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:2Wv8qjpXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C365126E529820D9E43A4674C2A6D12994337C77173459EF35D5E8BF8B31AC0CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-221-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/752-224-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/752-215-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/752-228-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/752-446-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1036-100-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1036-98-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/1036-96-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1036-92-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/1036-86-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/1048-32-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1048-40-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1048-41-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1048-172-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1280-283-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1280-324-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1280-285-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1280-483-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1280-277-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1280-290-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1280-306-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1288-50-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1288-112-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1288-53-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1288-44-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1288-83-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1540-478-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1540-252-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1540-272-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1540-258-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2040-177-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2040-169-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2052-180-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2052-369-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2052-187-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2052-182-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2368-269-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2368-274-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2368-482-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2368-263-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2420-26-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2420-18-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2420-27-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2420-102-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2440-260-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2440-103-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2440-110-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2440-104-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2496-200-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2496-413-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2496-198-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2496-192-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2620-173-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/2620-130-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2620-136-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3012-502-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-503-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-488-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-489-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-490-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-491-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-492-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-493-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-494-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-495-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-498-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-499-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-500-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-507-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-506-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-501-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-497-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-496-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-504-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3012-505-0x00000246B2730000-0x00000246B2740000-memory.dmp

Download

memory/3136-0-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/3136-5-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3136-7-0x0000000002760000-0x00000000027C7000-memory.dmp

Download

memory/3136-14-0x0000000002760000-0x00000000027C7000-memory.dmp

Download

memory/3136-475-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3136-77-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/3136-94-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3316-178-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3556-148-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3556-142-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3556-174-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3588-479-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3588-481-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3588-158-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3588-175-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3608-122-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3608-124-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3608-273-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3608-116-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3696-63-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3696-66-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3696-57-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3696-223-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3772-476-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3772-230-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3772-238-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3772-236-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4000-210-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4000-204-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4000-445-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4000-212-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4520-69-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4520-75-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4520-78-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4520-229-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4608-247-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4608-249-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4608-477-0x0000000140000000-0x00000001401F6000-memory.dmp

Download