d2d57733bef41bb9170f2134f5c396f512a5e58fef081b702a7c9b8ac497fa91

Analysis

max time kernel
82s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
Size 1.7MB
Sample260602-qsaa1afv9m
SHA256 d2d57733bef41bb9170f2134f5c396f512a5e58fef081b702a7c9b8ac497fa91
MD5 e0cf69a4beff12c098a77de27d4f67f4
SHA1 be9bd08bd9779348952c7cf003f4fe8787cb30bd
SHA512 ff816c202b1f24b213cd8606329fb9a28baa540b76cd25b693087ccb230b80e5ad6a8da0e049e6d81f93129f5bbb82c3484c2bc152f582ad7a63dd04e2df3362
SSDEEP 24576:jlf15h9eZkGI6EB0T5QBbe2up0WEWsVQEnolA0+6vuisqjnhMgeiCl7G0nehbGZd:jHQlo/msVLnolAvMZDmg27RnWGj
TLSH
T1F785DF10E783D135FDAB54F94ABE962E99387A31031690C7F3C01D9A5EB21E27B39247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2408	alg.exe
3040	DiagnosticsHub.StandardCollector.Service.exe
1704	fxssvc.exe
3760	elevation_service.exe
1628	elevation_service.exe
3172	maintenanceservice.exe
2824	msdtc.exe
5008	OSE.EXE
3284	PerceptionSimulationService.exe
1572	perfhost.exe
2000	locator.exe
4832	SensorDataService.exe
3176	snmptrap.exe
1180	spectrum.exe
5080	ssh-agent.exe
2300	TieringEngineService.exe
4920	AgentService.exe
3316	vds.exe
4416	vssvc.exe
1704	wbengine.exe
448	WmiApSrv.exe
1612	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5c2c23d8c9945a43.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180281\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180281\java.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d006d1a94f2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002b33f1a94f2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006090fa1994f2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000502c9e1b94f2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
696	Process not Found
696	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
Token: SeAuditPrivilege	1704	fxssvc.exe
Token: SeRestorePrivilege	2300	TieringEngineService.exe
Token: SeManageVolumePrivilege	2300	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4920	AgentService.exe
Token: SeBackupPrivilege	4416	vssvc.exe
Token: SeRestorePrivilege	4416	vssvc.exe
Token: SeAuditPrivilege	4416	vssvc.exe
Token: SeBackupPrivilege	1704	wbengine.exe
Token: SeRestorePrivilege	1704	wbengine.exe
Token: SeSecurityPrivilege	1704	wbengine.exe
Token: 33	1612	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1612	SearchIndexer.exe
Token: SeDebugPrivilege	796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	796	2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3884	1612	SearchIndexer.exe	107
PID 1612 wrote to memory of 4912	1612	SearchIndexer.exe	109
PID 1612 wrote to memory of 1188	1612	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_e0cf69a4beff12c098a77de27d4f67f4_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2408

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3056

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1628

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3172

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2824

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3284

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1572

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2000

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4832

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3176

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1180

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1632

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2300

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3316

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:448

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3884
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2824 2828 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4912
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2840 2836 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1731f57d10cbadc24f97f02623409e5f65aca174fd20976c26c5d5cff1076812
MD5 711c9dafb1a699355b7e6e4cebf14a0a
SHA1 cf63cef57ae666f6eccd3b660534fe96161281de
SHA512 64a30d46c644a647579d2e10f4f09988ac9af1648c4ec342ef8878bdf7ab377bedafdc0955fd58e6bd9750a5e5a6cc39bed8c68b9d015ca7edec7ec46c752880
SSDEEP 49152:2b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn0Dmg27RnWGj:o3q6sjBPD527BWG
TLSH
T157D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 44304581ec6ae9bb36ddabf6b6723e4a305af6253bb61321850fdf3505cf69cb
MD5 e37585fec82e003b335c61ba387fadcd
SHA1 8c41f5a81802073078eb00495f26e0a9e55808c3
SHA512 5dca37cfdb4ce5a693e2753d6778d83bd54fd37514295d3bbea826d948a306f30696d6541904a6a830c442016a78dcaac17637a86f5ec6390c868d403a3889c7
SSDEEP 24576:3XYfDtczAnsqjnhMgeiCl7G0nehbGZpbD:itcWDmg27RnWGj
TLSH
T1C3650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 8e6b505abd6106179d7fcb3ac7c058a7f48cf355c7a7249490a4c5791d655929
MD5 afab82db42651c03799b48fa28b9675a
SHA1 8f877eeb3879de32dc704658b0acacdb536a3bd7
SHA512 40ba258d010f2fcde403064ccca84e1661870f0a342fa11cdf07af3c2ae56dfcb9b8bb50c25e851dec65c5cb08b7b4f68c136f16ea43d52c19bed98114f73bbf
SSDEEP 24576:D0Le5ji0hmxxrMAsqjnhMgeiCl7G0nehbGZpbD:DPji0AjhDmg27RnWGj
TLSH
T174859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9533ce2e0add16dc00a3b875f61e5ed2e7b44fc7abe24033ba05902dbaf1ab0d
MD5 bb8e8cb614988c349545e9deac03ca98
SHA1 adf407edd3ec8ac73597f9d036f76c6e160abf5a
SHA512 6b0887d0be497fb77bf2e8faf4e0e0cf102d3f657e071ceb408fcebdb5831f1e3634cab8e9279cb506c53ba43ddac4633d806d79108d0815984c01559018117a
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWn6q8wyuCsqjnhMgeiCl7G0nehbGZpbD://ezSC6vUzPveHjytDmg27RnWGj
TLSH
T103755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d813001af71d5fe2da2da8f2fbac75e6b33e000f3e8435bbe1c48cc94f5555bf
MD5 9b182c4f46cbaa1ce8c0aee0eff8d1c2
SHA1 47888fd7816601e547602a495acf0d68b98fbeb2
SHA512 385d151345fedf3aef324fb9b666d0e0c48ec17a9a7cdd4708665ac7b439f5ff4c81446d2268b8643999a14625631d19451263e6dc4dee0f89a92592d006f0cd
SSDEEP 24576:gVbqPb88hv/l+YLsqjnhMgeiCl7G0nehbGZpbD:gVO88hXl+eDmg27RnWGj
TLSH
T13A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f21077787c29d0793f309cf4abf2e9ed9b3e29732d1b5720d183c24fe27a9bf6
MD5 367489910f8edb2e0f5f4c8f3ecd4155
SHA1 336a09629bc8545d2cccc00eb0074f317f17d984
SHA512 1e66f413534c04d2131f4623146acd1d0f26882bd6487603a4555a330f263a3ac1131a36bb96610eb40de0d8f98f3fdf26af74a1d34d23dc4db1e8220f1ffad2
SSDEEP 12288:JLkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JLksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BF864C50DAEB7609B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 dc50038eab81fac48837fdd92f954d612796698c65341654d64e00792b74f0fb
MD5 f14e08c038e76253a31d86ec29c0e9c6
SHA1 0cc7c007e03e233046e7f29b67a3badb676af4a1
SHA512 d0df2cdf84b8c4cf2e31a4870e076e1f002b170ba203d71b0342cecfe59cda3d0fa2df3a973a9ac4b0843639be71eceea224574d504739c5e76ead33d65c50d7
SSDEEP 12288:yeBNUbTVO86UDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:yJIUDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F65CF7BEE28FCD2C27A4DB85791C600E76278314F61A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7a0427109f2b3c4c9dd8ea9bada0717b250dce5eac9c69427c49f7e6daf8a7e3
MD5 0c7953ce345b80623c50f05f5efc642d
SHA1 8ddb34b4a8d558fc9d6e6ecd8501ac3774f45166
SHA512 d7a215a71989092661ad90af296a18b95877670090fe56c5944237b701340fedd4c4a69b461e8dcb14717908ab78ad077098c6072558cab0fb5d79a6d4c7c6ec
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH+:nQvGAdlCEL8c/DRNw5C2D527BWG
TLSH
T114266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0d5528d0b3b6744d52dd5f05d71b7cfc490fc0b975f3c1a4986fa2fb0521cca7
MD5 db7280d4f5598c31006e40a6a5d3fccc
SHA1 5eabe9d41bad22f57744604627306147ed45c091
SHA512 b859d27991aff2f80bc2fe4fe2a5678aae31d7a5cc68ed2ccbc50ac3a25bec9f0497b3ff6bfbdb9aaa114970f3bf3f215328f8161ee40eb05cff2d661d5c49af
SSDEEP 12288:vAwSfxL/2Dc3RDLLmt0LDQewsAjtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:40ewsAjtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.9MB
SHA256 85e5dc8894a51d2ad13e66f0b9ae9a11bd49500fe5efcd4451d3b3bfad6a1978
MD5 0e90745547ba5810f44b16f682f870f4
SHA1 25a500bca1a8ca4e5ec2ef7b864b81647249f821
SHA512 e5cd14b6413e7957358343a20bba6d7eb946d5b974bd4f15936b9b46afbb35938a7ba7d399239d6eff821034177b67668b99d8ff2c36882e77e4bd1c6f756c36
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHJVQBWG9:WUEtQevvqc2W1cpV2tI32UBP
TLSH
T1A1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 02a4fe778afeb2738beb6a9e92d5ac45905d077918829156794f787d85f002ff
MD5 ff5026097acec405d7ba87e1efc8a847
SHA1 add3286ce5a50cd8530cf90d409db0e19c011edb
SHA512 1aae1ef3788d59be9e215d735bda875be298c348d1bd7d5fbfdc2c70027595360c3adbe091c79c8887a3cd68606e77900516342307026c7ff5be9e03890f2885
SSDEEP 49152:hCbRquA/m2yL5zTfFiV+XenmE3/zxDmg27RnWGj:OoquVjnmyD527BWG
TLSH
T166D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bf61f2fd7e139d4ee95cb25c8e76986dc84ade197468abe8067b1d30ab1c23af
MD5 04d071634da63c638bf1afca2fc7a48b
SHA1 1751af1122ea41c0f86928ebee82713692a5fe32
SHA512 ab22449ae8e976247bae1ac2b6a280e60f0b76a7d698a08f88eaa8a40dde37928f163881aca84b02589a1eda604d0e98de7b6c14c031e9040028d890586d411e
SSDEEP 24576:SAhGL3IFoiwtA5l7S53+sqjnhMgeiCl7G0nehbGZpbD:SAMUFoiq5iDmg27RnWGj
TLSH
T1AB359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e1264980636481c466d12f796a39e4d9618252bf9ce8e8ff82b0f94726056411
MD5 05b0328f7f61e62c06dcf5ea2aba80e7
SHA1 bcbfe26728155f328b2ab13152e9de5f7c391977
SHA512 e6894aa610da10bd61d4b642e08817b67c4ae1a39190126ab048e9ea2c06662404668a9b843b6353571a4ce0378e2211dcc55f81d23475daa0e4c0e7fa4c4878
SSDEEP 12288:1mw5HEjsChNVBFgl0WDm+CiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:wwu4OWJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16065F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8a657bb41236a7630adecc99904634df96015b22a3b20a86e7ecde5c6de7ef2c
MD5 23b98cd27781e316f6254fae607c648e
SHA1 25283d57177f9fff39a5cf1bb217f4fe7558f4f3
SHA512 b36370800da62e61e442a5f8c1e08a5533b887f94a05d586b43cc25268556ee465ee26d233013a3fb322077575e777efa885aef90d073fa45c5357efa1087d5f
SSDEEP 12288:1eZ1IydXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AZu4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D35512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 972c9c7ad87c860137f517fd8f52f6f61f5201385fe908da88e3f3d64783f0ee
MD5 8c1661098c29830b147ac0b3d65224f1
SHA1 81f320821bc094e9dde3c4e3390b51e16a81c76a
SHA512 604fc562474b8550bf16e6f041111cdcd9d7429ad038d206a30e975b6b472cba1970c0b084d684f91a9706f1a9eb1160cb2c1c216f5087e3053c8b744fcf6c6a
SSDEEP 98304:aQRQyi36YOcPbLvw2gAf+PN3jD527BWG:RQyiKa/X+PNzVQBWG
TLSH
T100667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b25690cab59c2174e65fbe22e54c7619610de395d68cd5ce99fa452f08b67f94
MD5 ef2e4e89d2540b59fad0370d4341b265
SHA1 103c10d4c948b44622d2fb0d1df2b243302b046a
SHA512 ce2d4282e868241560229244dd23ea3a3b6d639c0f18d17c4ce8b12e6a4c42b62a2d261ccd85a36031b0162df86f3829dd502f2a0fdabb08fbcf2dd31af0b526
SSDEEP 98304:oQRQyi36YOcPbLvw2gAf+PN3jD527BWG:/QyiKa/X+PNzVQBWG
TLSH
T146667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9a9fd796efe330adc8b278a39cc95be67b85ba90e1fd2e12142edf964fde9206
MD5 06bfebb5e49030e8989c8f530852e0ff
SHA1 04714ec4adce4f9ba9cc766d0736926f196612a2
SHA512 7f4b3f1614f97d0bda28362ab0b749f934aad84b7edf5c3c4cb9c0057196040dab40ddf426df8b6b772ac06c9f2dd67071f7cf59cdf7483a1f435591583b1628
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0IsqjnhMgeiCl7Ge:p68Qg55nhceWu7PNU3/hDmg27RnWGj
TLSH
T13AB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e7b24ffa4f79bf7f73a880cdef88738c909e2867d8b4a2275956f7528ed74f25
MD5 a78e56aed979c1559e4a13a9681acf8a
SHA1 f17e51a026cddc021c157911149e6e91f2012670
SHA512 5ce065c4df7be8440cc489bdaa542e4186703afacd2edbd873c6ed3468a7bbf483d086929d5a88069762f83aae3db86189000a1924565b9008e69f87aafdb22c
SSDEEP 98304:oy5112gYy5azzVvt69nLKnhZAD527BWG:BLIHEWhKVQBWG
TLSH
T14C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9aded2b3d36ffd5c2f5d2f8c1417117d3977b4c66861dc6ec548140c3c22bd9b
MD5 74d3f5c0c074c0010a3c3aec5371b0a8
SHA1 79c8ab939d6b2c7b1799f3bb878326cdb5348367
SHA512 ac9584e24142a84ee40d89a9acf227b56b2329d69482026affcfa42f6d08f019df90e734a1807aa34ed4a5ced2f55a0d7cdbbf5f5c9252a6170cd57f2ca6c9bd
SSDEEP 49152:NB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glLDmg27RnWGj:Tu6Jmdxd2dLD527BWG
TLSH
T1B6D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 af020434c12dffa9a13c2d0aa252f4212a284780e615e241f981a223f65c4a17
MD5 b81aae5e08936e63f6707953c14df17d
SHA1 f06176c77216f59f2352df1f099a4b79c8e096a8
SHA512 16d55d262d3d660a9ea666c9c5a03011278ec609c7fa0a9c0ae5738cf653c5500de89223dca06e99b24b6f71bff6fd63f9538c31f8725cca48832ed55b5f4a33
SSDEEP 49152:F1hpsNoJpF1A63U44CwH7R4xnDmg27RnWGj:FmifPWRyD527BWG
TLSH
T13AB5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1b5a24242c9d77d3d9a9145d200866feec942de329a3eb733cd6a6ca4fe12a63
MD5 e842581ec87a2f408277fe9fe126ad4f
SHA1 fb243db670559669d1b024d9ab4a79f6e0c775de
SHA512 44f72d779aadc2255b2b4b782a24f1e4944be7bc6e784170f94300902562505941b4b9fefdd5a4639d75fb6bd5ac52b76f2a9522ed82d255455673d9554e68f2
SSDEEP 49152:8SuZQIY0Be2KcRVtOnks6NMHqkDmg27RnWGj:+5dKii61kD527BWG
TLSH
T142C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4c90eea4fdf1b694cfd460d29cee3e30297e0b83a45e8253d9546b92e121215e
MD5 1c30ed524f1d1e5135dfae78737a9926
SHA1 5dd8edc7e688f39f7ed6da553ce49f0b5e557abe
SHA512 2f477f408f4568b07327b2b8d64c11c5f53b4b9b7bfe105db02f4c79b9a23a21e43cb58028d4a6b22f8aef63a1cb9a35e586bc46173b039641a4f4060038364d
SSDEEP 49152:MhtSn8EApI0fig3giDn0AP5w7Dmg27RnWGj:tX2imphOD527BWG
TLSH
T16295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b351e37a13f1031d82063852b0016e244eed0a664980a56963f44be2f4efd9c0
MD5 0cb1e2f3c0badf421cd64ca38953528f
SHA1 a3e9fee2547689dab30c470e6ddaf01e3fafab80
SHA512 c067f214d87cca9437b95fc5c9c72532fe9b6a48703ca22359d9a86c5876b0885f17607ef4ae6caeedf1f9f2a8c089e7035aa6d9d1ee0e5b186535ab1514918a
SSDEEP 12288:68Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:68sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F14523BF965C41CAE52209B5C3E5F10DAC073E5BE92004937A577CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7042f08a1e7b045194703bcb1f34031ff2645972422023f7f205725395776802
MD5 421d20e85c04fdece688b25d368f033f
SHA1 7eecdf543b5c373320286d9f935fd7d63d5e628a
SHA512 b606799d55da2fb25506f66e16c2acd65132ffc08c89f3cd72b84790b32f03fb33d7dc4526cea883f955b995ad5fcb243f428a1f58425f2de33bdd7eaf0d9320
SSDEEP 12288:txXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:txsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C24523BF965C41CAE52648B5C3E5F10DAC073E6BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 754a2959940576a8b2e048563e405c9437f345163470ce5961415e9faf3b5c51
MD5 bf83934afbb1b182a69fdf62c1b19a10
SHA1 a0f8d6810841b1418e2fa1bd6f8c4dd4b513389a
SHA512 11d439fd3d94e5a92e33fae5e66f945ec8e8594834d00b2b52daf758743fb807a7ffcf940dbe8ff70131012e9f196a3553987ca087901a6ff6a7238a9ef1c207
SSDEEP 12288:+bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1414523BE965C41CBE52608B5C3E6F14DAC073E5BE9200493BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6f444850745ced3ce8c432844c588f4e87939634d3359277ce70fc4eb4cd7e35
MD5 802b01fe8c8b4676a50adc1c23eb0c0d
SHA1 143dbcdfad6ae8a0f3a5940cd8e91edd3381219c
SHA512 d4f95c1964a75e209bb7117715050edad8746cc64feaa1d95f32a102959fff7ad6b826feea63a3997f379d5cff983fafe41726d7191e4645781ded524134ac5a
SSDEEP 12288:uVeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C445236B675C00C6D83285B4C2F6E11DE8277D96EB3005DB6B532CAD9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3a17e64d74cb11e51e7363b601b6a46bdae1c7bc6b0a55383133a051ff39383f
MD5 dbd28772e26253249e0ead9b1da50a66
SHA1 c6603fe8b8018bfe29fde5a0c28b36751d5580ac
SHA512 ab551ed2ba0f2514042f9465c2fc33489bd8a1eaf186a72668fff15079c4cddcc1f5e9343e829ebc2944c5c9fe7ae1f1df562267b6b1023c8e0858ed9c9f88f5
SSDEEP 12288:1mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEJ:1msqjnhMgeiCl7G0nehbGZpbDr
TLSH
T1E04523BF965C41CAE52608B5C3E6F14DAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4c67fa0d9061ea753e2d19b1f4956ecc32b93e20cfd61c6ff212da65179ccda2
MD5 66c5c4f061945c9bd56f89ae43452634
SHA1 67f727d271b20f075b2bd2dcf347fdfd134be0bb
SHA512 f5fd59418893038f7205dbc1cdb8eae28652ef6a50e653b0c170f171f1f4b4493210557b67e481c2b6b2c05fd1ce4308356df492768b2ac84057dc766361ba22
SSDEEP 12288:1FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BE965C41CBE52648B5C3E5F10DAC073E6BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c1bce0118723ab5fb3d06f5de85e275e3505614cb0de94647995524fc329804f
MD5 823b0b5fa5bf56fca5b9e66e12c5bbdd
SHA1 b36193919be5b5d0dfc6043b8ce6c27850eb5b25
SHA512 b51d1f096287ef3a4fb5500931fbe6661642a98492bd32ed899d9d7eb6cf0db4363f463315d053f477bc278536924da50bf6bb7cd92c9eb200baf532560a399f
SSDEEP 12288:MZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1274523BF965C41CAE62608B5C3E5F11DAC073E6BE92004937A977CB9F7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ec319782565ca3746b75d4b249e126be9085c87a5a352b26d4228935b1743e29
MD5 1acf76d00fa43b556992e21fbb907043
SHA1 f0390bcaa81b283246c5b339b1efea6e6e38483b
SHA512 2f590a8e9efbf901330151a52cf0b28df5ceed0059fd88b529d5639b23db67bb39af8ce6ff5e820e89b6e4c29d0404b17a1329210c2bf76fc237bd5c4428fb5d
SSDEEP 24576:1ZMRzFVSORsqjnhMgeiCl7G0nehbGZpbD:1ZMRzfpDmg27RnWGj
TLSH
T1206501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 18a7b7d5754de9308c95935193f4cb0cbd94f75c9a998766fe3319045a8bb049
MD5 afb4927ebe1c9fe718f726c6e0c95450
SHA1 b62d52f2fab85591ff258a59f6618b01d465637f
SHA512 abba877020a8a2022677c3881ea1a53028bc0270b74ac3efe860ab36d897c7a7c7fcaaed41db70bd591535cec057e7f7871900098dd270fb773da4ee3f3231d6
SSDEEP 12288:eoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eosqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B4523BF965C51CAE62508B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 60ad67c28761f24c2367d69d9fe3f6c1c1fa99e93f7eddcf874ea3fe78415612
MD5 0a353fc73a923a209c743d8471b252bf
SHA1 aa158cd95330ada404706cb6e90a127cc4e93da4
SHA512 91e00947d18fe0f4100bd9785ec7565fec593f77baf2db895beb9479a3df57bf93099663700d031f9874de5686b1a0b035a7d5d2a953815150cb4a569428ba1e
SSDEEP 12288:NUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B4523BF965C41CAE62608B5C3E5F14DAC073E6BE92004937A5B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 175284fd210581c1e5d5d3c76d0244c6c7189852e2fe51bf2696084bdf589697
MD5 17c498c5b310ab31ce3b7f2f20b5d448
SHA1 a62a9b6a9b9497ea4fb87d59d8d1f83c5e1d332d
SHA512 2ab5b90bcc62d0e0dad25a218f0d59c6f0596aaf8379f0b004742d65169dc1ab132f31484ae2104eee3f3764facdb2fc15ba685a6f23f6e9584873723b5382a1
SSDEEP 12288:HyPz5L8dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qzydsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 169602772366061d52c4891c9fa0c59e05fa9d1a8821e1bbf4c531c52e64ee49
MD5 13dce0f8053c31e70f7cfb3ccd7aae0c
SHA1 75642a698ed06c61b2663b9b088a31b41e8edc68
SHA512 8b905cf8ff5e4f73bafbd8829057443e68b52c2721c21abb0425b2855d9e4237ee19f1d171ae5709094edf161c386afb1e2ad5f8113dc006bcb71effd7f7b8e3
SSDEEP 12288:voXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vosqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d5b6c399ac2a00a97d777ca13c877c98acce82f524ece810ac5fd0c432f87bd3
MD5 9e86474a49e8d17f8f5ff3fe6d725b4f
SHA1 14ec8d75f50ce80790b8cafc4e4def7f82b8dcef
SHA512 73f5f1766695ee68798db3b9a032187e8ceb18eb519d635cf78daf9319a46f3761e36464c9c5f9375605bd91161bd8507786b7a8e2f31e5cd14ec59c90bb26d1
SSDEEP 12288:aoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1464523BF965C51CAE52608B5C3E5F14DAC073E6BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8d677bac5ad2a6ca16840acc54625b9ce9c1508b241e0a9a3e4744cfa6aab2a2
MD5 c4d0da4da6299dae48fd129714a2be4b
SHA1 c431a2e61c6942acaf4a03196bf2cf4b0bb30441
SHA512 e0d58dc9e22eae44bcd3e46e39f2e0d3e742fdcffd085cc0a5380614ac4366455a482a0d4f25501983217e43e68c010185c3535252bd22a5e4d7672ba8b5190d
SSDEEP 24576:dCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAPsqjnhMgeiCl7G0nehbGZpbD:dCUZPTY+8Wg2lIL8lrIUJLWwqDmg27RN
TLSH
T1FB65AE1EA3DC0896D4BB81358A51CA06EB32782E1B3196CF2160C77D6F67ED54E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 077bab6f760e8e93d4c15620826aea2e098179077d012cc8c1d5da3aaecf9d03
MD5 a5f9d5f99104531e022e56875c9a39ce
SHA1 10ba673d395ce6e279bedf0250a028703b68eb4d
SHA512 6e4644e26efd6144ab0559674c3d84348befe38f153a8e9cc91fd8ae108ba6a8f084c84e1ff47e2d2cc7cd6aceeed82038c1fb702f007d2bdadab7d5bf7a03eb
SSDEEP 12288:5bsf4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:U4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D855011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e6f8f53f4dda61d4684cdb56e014d74286484688410a54636dcdf67c510492e3
MD5 8a388a1244edf57c0891a0170090d7ff
SHA1 99c36f6bf0a42da2e63da0f7f24f8eef01bd7706
SHA512 c9b6bbb7378a680ac3cdbdcb1176d9ff300a0f23dcb55e6a5bfb666dff2061ecc77d97b633e9dcfbb165fe266a7ade5c577c3749c31b0a3242f4807f287688f3
SSDEEP 12288:s7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:s7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B45237AD34C518AE97609B482EAE12D681B7E669F2004C3B9433CFDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7e95124baa0d18bcec38d4876c4fe9353791cd171194c77ace0a6e814233a337
MD5 34c752dc3abaab019e5c32b0aa24c581
SHA1 572a4cdf52d5e2eae64a7510e7d0a854cf77fd9b
SHA512 16bb0f90492289a26680637d92e67cb3d6337816c10745831ebf92073a9675c54ce1437faf01c1063fc765994ffccae32b0d9635a87e4a314d35ac8e38bc37a0
SSDEEP 24576:38RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCNsqjnhMgeiCl7G0nehbGZpbD:sRZwQCyiHiQEaiPnMcDmg27RnWGj
TLSH
T10185B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 1112e108d1425db08f81726dc8a857dba6aa824cd03bf4f05acc39aeab039a5a
MD5 aa3ee3da0b6b1a9eaa05c002c47837ad
SHA1 428ef7246f1a8a22d93a1ef83db79878019b074d
SHA512 72d0011a4330dc9ec19bf14c84905b315774e0d137649014856d84e17076e55ef0e38b78752928a9eaa06e86bef5675993bc4019f38e273759b70c7cebb967b7
SSDEEP 12288:rbxA1U7KrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rbxA1UGrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E155123E62AC20E5E176957D86D2C10AD7327C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 cbff2e18a423200d4b72d2532d0ad4eba68fa4135a5167cca4b2be63423be054
MD5 2c04b9f3dea7e31f8a9a50746f694822
SHA1 248f7d10a59c5897fda644c15b9658788383542c
SHA512 19981e24e59ebcb10458ce95276f948560bd3dbf930dbab9f3803ff031cd599c205ec9d656ec6dfea1e68b3f1f04eb65c339b5513b3146a5b3d94ba2a8b76a72
SSDEEP 24576:0jsmP0yHaqrVqHra44KDzMsrnOsqjnhMgeiCl7G0nehbGZpbD:0jRP0yHfVqzlAsrniDmg27RnWGj
TLSH
T1ED45AF2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 667b13a4b1638cbf26b99f5a80213d2df6e1be1d5ab0120343e73c82d3a61073
MD5 61eb2a7c5155c8b3a5c4e826e2ca7b5f
SHA1 63fb2a762e4e05f5db4e6eed3956d85faeddb8f4
SHA512 8045ddec00f9409cd61b49ee338f62c3dad621034dcfbe1db6c646377622c86ab2daa40f09f3d8b5777bdc4c599b496785e40215bd52489b11266b4fcf7e05f0
SSDEEP 12288:jlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD4523BE924C51CAE93609B5C3E5E11DA8073E669B2004D379977CFEEBB54D84B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 2f930aea7e5e8de0eaef370a804a63a36ff29c76a4dbcf20cde7f2af1c345f19
MD5 512014e9487b26613cfd70a298ee25e4
SHA1 9301cc4655d57d8ccef83781f9bd40c9fa562d79
SHA512 050e8c98a13bcadb0f7253f4db1a70d2df8154d01a5b2cc0c73a8cae2a6c75b363dad0bbeb56181ddcaae30c70c64a5a04ce01afa4f79f5aa14607a859847cde
SSDEEP 12288:NObfA4LWO+vAYFTnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:qbLBUTnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T130750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b575069eff744a19562463a5a55b91010c4cf20849c92ba4f11f23d89c10a7ff
MD5 a8378787f98bd4de9f5323ad7ba79239
SHA1 0c242fa67e095c1f97195133b373371a544d204d
SHA512 9ed8335ec72348df5ac206cd2e1ecfaaed3f65b84526df1ba6f3e747ae054c0c1b5a7c28fca6a2c6c01f90a49b742e041e86d79d6a78f4ce19a990a2dd05d6c7
SSDEEP 12288:o70Vm9IYNvUyBpMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:FpYNHqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10965E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3f187448752e7fa89ae79c331699c77137a95be4e68f365620b81f354cafc9fc
MD5 45b9caf411ec3cacd2dc65d7d1fa07fb
SHA1 f42fea033d2640a2ac63499cbbbf01d36a3d436f
SHA512 20df1a137df372d1fdf510903ab79d6b7afe16d7016587a29ed99880cbb2e0e3cfc88a6da8249a6546f048cc0a2d87e1131a09361d8052d4b5000240679e8e83
SSDEEP 24576:7nXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKm:7nXoJJYH84VVS6AmEOJas+cHBjSSKHPY
TLSH
T1CF65BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 406c1e7d5acc22d60f32ce393b9cdb0a729e9b0cb10cbf1ad6b7d4d89bc5e90f
MD5 5591d2b3aa3ca6934729fe02a1263d73
SHA1 8df3996241808ecca3aa5ff47635fd51781a6dcc
SHA512 91fbd1d55c709cfebf2236c51d26dace6173833e7feaa318e2f5743b27bfb99db481fa9fb02d3cea30602c78cdcd8bef29858531a881c453e8a493635e9bee3e
SSDEEP 24576:fv7Xbxd9Tuycf8M/TYlSuxrr2PCEsqjnhMgeiCl7G0nehbGZpbD:fDLL9TuJ0M/TYj2P5Dmg27RnWGj
TLSH
T16D858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 267229e53539002ddf307d2ef64784bcf5b7fa09df8d179b8bc7c982cd8c9d8f
MD5 c5a75db969e78c039612a684f0ba8d42
SHA1 f40f24edd3fb3bb86b50aecdfb0f0b643ca5233d
SHA512 3f700855d52627bee0c2f58af6279d3169ecc7678ed302395c6974d09f4e0521548757553eac7ca1119f99d997f615cd32196ee1f798b1e6d27de73d307f79c3
SSDEEP 24576:jegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wnsqjnhMgeiCl7G0nehbGZpbD:jngOJOmPOHz7Dmg27RnWGj
TLSH
T16955CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 146ccbe83462a32fb7f0d7f6c16e8cabf31fcf534aa11a3b243c96305ec3eaff
MD5 c1607189ff4e4c639d40ddf2b7aa7e21
SHA1 85a6339831d13f128a5062897a376c3d7e6e3caa
SHA512 ee6cdc738e575b1dee152aaeced80a7b2f5813cf191900fd084d37a5ec72bd4a1a8cf2789fb15f56ad34889af34048c077dc886ec598699962f1d5c94fcdb0d4
SSDEEP 24576:ALJnJiTk3R3waE4JrOFsqjnhMgeiCl7G0nehbGZpbD:ALJnJK8R304lyDmg27RnWGj
TLSH
T13075E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5b3b8704f2351605bc6529148629a3485f1d492687143facc8c04c8774dad3a8
MD5 320a58751bd6aeec7579966a4f6b88f7
SHA1 3e021ca9bb3c1330fc2e5727fb6d24c773280cb3
SHA512 615ec806528e187e78662adc142b2678089cf0a9a95776b58d8c3ae42698f83de6010e09787758e420a7cdf8f5bee421f95ad438f0ed1067773de786c52583c2
SSDEEP 49152:j9mqCzDScAZmlvTcFg8Ph6dDmg27RnWGj:3eD527BWG
TLSH
T142955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 b45244abc1f577723f6ca922c204757a1d7c1c09f760115340e6e27f7ef04204
MD5 9586f81c7f7ab7bf8fdff62892b032e7
SHA1 b6d6a515d2ee90e18799308202a8f63f2f2b1f6c
SHA512 8920ee53e1ab9c21991451f656988da507139efe1143eb5d1c3be71c799301be6e8acfce4b79685037f29f303a935f62e5774ce70da560e4ea45468b7be6fae9
SSDEEP 24576:clYJeXm5jUuEXsqjnhMgeiCl7G0nehbGZpbD:clYJeXmRUuErDmg27RnWGj
TLSH
T1A655126E669C30E5E13A8079C2E2C508E633B872671017EF65E1D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 6f5fd71ad4530a33b9bd8fe888da28ce645ef5d987620e83eb85eba169615660
MD5 eebc714442a4779622dff512f81db414
SHA1 fb3a935f3473cbd6bafa0f9318c9eeb0b14d36cb
SHA512 43fdd138e340098ad9dd7f7b33988a57481580b9c84aa90fcd0c8e1d90d11cdb7c16efe5d5e0c38316f4d9d86d4b9a1e927bf11ea2b06cb988e51cd1a5bb88cb
SSDEEP 12288:Mmu6kyuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:M7tyusqjnhMgeiCl7G0nehbGZpbD
TLSH
T159552219639860D9EA760978C6B3C158DD367C219F2002DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 2c35e41ed36ce2423a8cf1e851da8f53d92694990b1d2c00771c279db153ed56
MD5 b85b66d9cff9e569367ade651f64b154
SHA1 2b7eb9f76e2622a60e61c505e35bc41d230a7a83
SHA512 315c2552d3ac76edcdef847aa51a051125dac92329b1a4ec28c5e37ef64f666592dabeb525d45f1b7e835926f22ae28cdda206aaebeb25bac53e2f572048144f
SSDEEP 12288:pPnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE45237E525C61CAD93209B4C2A5E10DA8173E76AB2014E779E3FCB9EBB54D44B38813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7281cff9e8154fc8f624ef328a404d7419e7281748d99378ff30ea412e1c2394
MD5 5dd4668bae2df2a379ec398de5dbe8b9
SHA1 d3118a75b4a49113d909fad97de4c8354a9297d6
SHA512 0055813e349057581d7eb50c7fcbececc99750418053f761e91c1739aa0300b667ec2070a78460331515d6941ea35908d24e438734b07f246602c7d626457190
SSDEEP 24576:JC+TyQIu93VAumZr7jmYsqjnhMgeiCl7G0nehbGZpbD:J/TfIq+YEDmg27RnWGj
TLSH
T111558D2DA7E91DCAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a577c79d5325834042e1d68e3e616b33eca56700ce38e185bff19ca78ba9ac09
MD5 1f8e158ecf47be8f18c1623e69904dc4
SHA1 5360c1970964b9a04433c867f7e1596a787047f2
SHA512 5fdc860107958bc580e56fb5350f5434158ed14c738e56f18ea6714b57c8a37e6e144644ad6d00689088cb388a0cfebf7e5d04a0e3f1378b006d609858c60141
SSDEEP 12288:UcyrWOstaa3kcsTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9D6:BLQikZTsqjnhMgeiCl7G0nehbGZpbD8
TLSH
T1BC65F11FB3AE00A5E067817CC8858116FA737835571163DF06A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 af25e53bee4d5b1e6fbb363f3a8695b94f2b2e621767030d3659c40a2fff817f
MD5 b5a30dd27207c1f3a484e185ba416210
SHA1 3bf3ab356c123896868d95cf92f00545f4cdf5d5
SHA512 62051b14cca400f651494d7a3bebeeafeda30fee8b87ff1df3889193f8eeb37a7be3b7c2bf734882f65fdeebeae78a475d097f5b21236824ad0df8e950c2cc32
SSDEEP 49152:JpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPCDmg27RnWm:apC7b4+80GTk1D527BWG
TLSH
T121A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9727c2523c4d77c7caa34a43266bcefafd354654e5c4c51916ff2442086cdf80
MD5 7cf6ab758d5e4e379104de73ceda2198
SHA1 817c0f069f04493188f58775f5413e9e86a4f927
SHA512 596026d03308acaa970b047f00a97ca7637153383ba62a804d461ef7045a69417f7c8d06cbe9bee4f410cf141ee114d67df28f56d4dbaf4a07288c1132841ff9
SSDEEP 24576:0SAwJPE1IDAo+4Kt+l4413JUQGsqjnhMgeiCl7G0nehbGZpbD:0qPCIo4Kol4vQKDmg27RnWGj
TLSH
T1B355BF2AA7F956E5E17ACBB4C663C601FB733822133163CF5290857E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 d7554f31869181a25a826fa6669daf419a62b1eac028bf954b0379f352c16c69
MD5 4ef10ca9a8347dea78f63527472d87e3
SHA1 95fe4bee178b119886a46e6783f6faad322991ad
SHA512 dcbf87eee7c5edb425d1ed36d20d39ebd19c198251053ec2ca64fc988860f27f1f558bf098e08e8c8f3d99574dddf5d17dedee9b0029a3cecae0e48d9854e2ad
SSDEEP 24576:uyLXPLcw94t2sqjnhMgeiCl7G0nehbGZpbD:uy7PoXt6Dmg27RnWGj
TLSH
T1A375D03ED76C04E5E47AC27CC6A3C506F6723CAD033166CB19A095792F6BEE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 3e078aadc09c5d78172f06a2a4cc7ff31e13b831e63c50b68120f5d2343a85bc
MD5 567ba02f3b7cb24edcc917305d5b7087
SHA1 4d7d96ffcc6a96fdeb7ba4268978fb648f0163a4
SHA512 ece1d74f61ab09c556570001cfb2055cbdcbea595a2731a1d403e5e1f1f0baabbf6440a3cf76e3843d60f48f94a69c6962e53983d0701c7743ddc6e30e3c0086
SSDEEP 12288:g9lyvj3IkxjbBzjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:gWv8qjpjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10565126E529820D9F43A4674C2A6D12994337C77173459EF75C5E8BE8B31AC0CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/448-470-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/448-258-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/448-261-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/796-0-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/796-2-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/796-83-0x0000000000400000-0x00000000005C4000-memory.dmp

Download

memory/796-8-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/1180-174-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1180-170-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1180-418-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1180-164-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1572-126-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1572-248-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1612-274-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1612-271-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1612-299-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1612-315-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1612-283-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1612-265-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1612-471-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1628-81-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1628-61-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1628-67-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1628-172-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1704-37-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1704-246-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1704-469-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1704-240-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1704-249-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1704-48-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1704-44-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/1704-38-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/1704-46-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2000-260-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2000-135-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2000-137-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2000-129-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2300-459-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2300-197-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2300-195-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2300-189-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2408-20-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2408-18-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2408-12-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2408-88-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2824-89-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2824-97-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2824-209-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2824-95-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3040-33-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3040-25-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3040-34-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3172-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3172-84-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3172-85-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3172-78-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3176-152-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3176-158-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3176-397-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3176-161-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3284-236-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3284-114-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3284-120-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3284-122-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3316-225-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3316-464-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3316-222-0x0000000000B00000-0x0000000000B60000-memory.dmp

Download

memory/3316-216-0x0000000000B00000-0x0000000000B60000-memory.dmp

Download

memory/3760-51-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3760-69-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3760-57-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3760-160-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4416-237-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4416-468-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4416-228-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4416-234-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4832-140-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/4832-273-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4832-146-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/4832-467-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4832-466-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/4832-148-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4912-479-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-478-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-483-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-475-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-484-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-474-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-476-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-477-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-482-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-481-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-490-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-485-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-486-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-480-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-487-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-488-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4912-489-0x00000229458A0000-0x00000229458B0000-memory.dmp

Download

memory/4920-210-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4920-214-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4920-212-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4920-207-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5008-224-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5008-107-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5008-110-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5008-101-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5080-186-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5080-439-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5080-184-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5080-178-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download