a247bc42bea0a51d6968aec477054181f463426a148168734657d6ad00898d41

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
Size 3.9MB
Sample260729-3vsatayses
SHA256 a247bc42bea0a51d6968aec477054181f463426a148168734657d6ad00898d41
MD5 c331c206101acba945306b96e063e2b0
SHA1 3653b2548b2c3183142a8b91ee351996a60a0197
SHA512 915ec3fc0f774463e3a8b2717177df4374e6ae225014e7bb8d80177cd1fd5acb0fd646fcaf80468e7c1cd4757b98620f1e19030648d391cd2a3a5735cd4dbad8
SSDEEP 98304:ht9dswhwQxn0lcw1qKN45qZbVDGna92m7wRGpj3:hVswChsiGna9FF9
TLSH
T141169D2167D99029F5B30F755A3C666DA169BE310F30E0CF93880D6E1DB1AD2A931B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4588	elevation_service.exe
2632	elevation_service.exe
2684	maintenanceservice.exe
424	OSE.EXE
1104	PerceptionSimulationService.exe
3800	perfhost.exe
2852	ReFsDedupSvc.exe
1384	SensorDataService.exe
5176	ssh-agent.exe
1180	AgentService.exe
2276	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9ced0c81e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000095092a15b51fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b586a14b51fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000450b4815b51fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2335416b51fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1032	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
Token: SeTakeOwnershipPrivilege	4588	elevation_service.exe
Token: SeBackupPrivilege	2852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2852	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1180	AgentService.exe
Token: 33	2276	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeDebugPrivilege	4588	elevation_service.exe
Token: SeDebugPrivilege	2632	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1032	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1912	2276	SearchIndexer.exe	101
PID 2276 wrote to memory of 3788	2276	SearchIndexer.exe	102
PID 2276 wrote to memory of 3488	2276	SearchIndexer.exe	103
PID 2276 wrote to memory of 5400	2276	SearchIndexer.exe	104
PID 2276 wrote to memory of 5952	2276	SearchIndexer.exe	106
PID 2276 wrote to memory of 3400	2276	SearchIndexer.exe	107
PID 2276 wrote to memory of 3136	2276	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:424

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1104

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3800

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1384

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5176

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 2760 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2900 2888 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5400
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2900 2888 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 2760 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 faf7ff0ed96944f85542cb3ecdbb7630e1bb102a991c6dc06112c0509db1e6fd
MD5 bafd631254c08ecd744a65266051c847
SHA1 624ee8e65da6cfbd6bf6d7f7d4336cfc2bff89b5
SHA512 97c5dfc0ec769a9d996c7da3a52ddd9669e57b8cf6cf585b10e34e735636a375c351c8c6c9dffef8d3d98e59e820acbc719441b20af6c279b964560dde18be40
SSDEEP 49152:Hb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnsLNiXicJFFRGNzj3:13q6mjBX7wRGpj3
TLSH
T192D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c5dafdecdefbbacc67d12dcf16de0a6e18b0bdade4dfa90496ed250ab790fa14
MD5 7130a20ff5c22df49f123abcfc985d02
SHA1 3eb742bda6c36ceb2c2f30d7847ec1afdcad2511
SHA512 566e2bf07bab00a4c5cccaa1e1312c39aa2888deb36a73fc51bc4f9a67b90a8d51774d30c06b72e2d6794b192628ae5400bf4b191003bf5a38ab8ac70ab44a37
SSDEEP 24576:NXYfDtczAr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YtcOLNiXicJFFRGNzj3
TLSH
T1CE75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 528fac3694419b283ef4edc145e15646176d952e2d67b3c668dfc2a565d1f56d
MD5 bc8abaee7748f74b77afaff821754a48
SHA1 e85c0f15c627c7ec10570032f67dfcbe5af4404c
SHA512 69b076d516499866a529dadffb1f5ac672ec5babaa2ac80742938deba903d183034a01f2cb91a1f5cdf9eb2c71c5d633c4b6af894f642ab034077de50009274b
SSDEEP 24576:H0Le5ji0hmxhrMm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HPji0AzjLNiXicJFFRGNzj3
TLSH
T18F85AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7891d74197f53a913bf52a354b470ffce1ab8c6dd17c85fd64e6e978cc4aace8
MD5 6c67d234f8186280bdc61e2d9d6ecf17
SHA1 962d60df0cd673af6914235fa6862f54efd89508
SHA512 ad00e6e0b2c6069556977a503ad5c91fd19bc4b428cf2c3657718d4b61fb29c462b02d27f301551df6ff85ae21ccb586dc6595c226b069b1ff3bb2d8e8617c1e
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWj6q8wyuQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:v/ezSC6vUzPv+Hjy3LNiXicJFFRGNzj3
TLSH
T18A756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 90081947faacdcedb820aeea6e44f97c5c921ea467ae6e5d61d7dc8260327c50
MD5 dd8832e391ee8327e4708406f91ca5e8
SHA1 525d7a9604e6e53576d123440b442326a05df1f8
SHA512 6a2cbc886bcdbb7cd748c85c6daf97e73b0cee64097c1d519059d3ed6e8e744c8b424820ca3d20ed14d8f22763487d00bec3d39207021376c22529000bcea921
SSDEEP 24576:PVbqPb88hv/l+BR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PVO88hXl+DLNiXicJFFRGNzj3
TLSH
T1E8559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8b8b3bdcc414bd61d370336d0b3b28e0a530338ec39f8a34db7e99ef6cc507de
MD5 847084c316cf4f2f05eab44b21143219
SHA1 b324c09b1e102fbb6340cc9e2a2905b609355845
SHA512 62d21d245882173289b87f19454231c0b720a2b6eadcf4dab0ca2e967aebe1788b562bd99b5937adb41d62050475cf48c36d191d44034a30eae88663fdf32ece
SSDEEP 24576:gGi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WLNiXicJFFRGNzj3
TLSH
T1855523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 86589c926864240cdda3299b5fb5a450925849f789c31d0bdbd7797974c4ee54
MD5 de5892d7c6d54ee03ed2f686cb6d2ff7
SHA1 b1418ca5de06b28cc78a9c80f8c821a669e9c2aa
SHA512 bef79d872d354cdf130df9f38ca45198c30a9aa7b590bb528d8bd6d1d9c99848888913545bc18e2734d2fbcbab65b3e711426fb5d086ebcde182286b36beebd3
SSDEEP 24576:uJIUp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uJIUpLNiXicJFFRGNzj3
TLSH
T10775CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0b0ecfbf4533829532b329a9b00af8eb1f19175826b4262846d18a358410655c
MD5 87d9f33dc6e511677b4eaed657017d4a
SHA1 3e897900954888618bf3b13f931b3fae0da72e01
SHA512 072763fac6f13c8f1f400d827a24c28ff38c8e8154c1cc326177cd9a833fd9617ac44da1be13308e9c72934878eb59273ddfd74c2cd3eccf2e2324e16ed520d9
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THp:VQvGAdlCEL8c/WRNw5CA7wRGpj3
TLSH
T15F266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a0829ccdcdd6461267c0439aa6b232d4b0f1c0ee60b138463ceeef2fbe2b37d5
MD5 c3455453275b069ca0f66e474f3b5f0a
SHA1 6fc961f1e1954e1090f7e8b1af430e6226d03d48
SHA512 4c7c9ffa525b35980d400f0f80a4a7b76424439eee1641d6fc92ae850f139d2d0c44884c5aa94dfef3727dd55d008463a91415d4ac5b9bd7576b82568d2d5cbf
SSDEEP 24576:EfewsAjT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WljTLNiXicJFFRGNzj3
TLSH
T10375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b4ba02e07e2ae6bbb4c6af4185cef2f47bdc59e10bb337f199e07034c1b5f8ea
MD5 a53f269241b0848ed535505a07fc6acb
SHA1 82735aacff14943b728fea6d440f5454e4471ea4
SHA512 1208b9db7b374e0e1d0b49b30bfbddda31069bf2322c2b1aae90e5676ea2f1e3c2e243ae29f205912bd9623fc98185768febfc9c1b6f0c00f54e5a3e0f5b9675
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHfF9:jUEtQevvqc2W1cpV20I32t9
TLSH
T1D9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3e8b9273e7aabe282f2d6413c6549a1c60705f71837cf776a18e57d3720a9c00
MD5 a8c1db1714944e73283cafce8bd1b986
SHA1 01756d310fa4f5ee59534e35ad97ad29ec88cb47
SHA512 d10100d5f852bc1f904c25a54d76d53d4b41d5b71d7cbb34e4f062793f06a40405decf7840a47f49c0d4a5d1552dbecaa88d16a53efc203d51d092552f14fd77
SSDEEP 49152:oCbRquA/m2yL5zLfFiV+XenmE3/zzLNiXicJFFRGNzj3:Boq2Vjnm07wRGpj3
TLSH
T140D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2695cb4985f329813977a59ce955e9102962f9abe9e4454b08ef0922b4a74238
MD5 6a50b92bf549bbcb6d66f560437e65d6
SHA1 6e1ef174b61ef9f56fe4aa2e48b3d256c84fb850
SHA512 4e917835809cfde9868343ce0e0363c24f8a850e2488e84b762e505dc94498cb45709713caca84e5962bb53f01bc1348ee51a2ca1e3421b60699cd48d0326e9e
SSDEEP 24576:dAhGL6IFoiwtA5l7S53U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dAM5Foiq5kLNiXicJFFRGNzj3
TLSH
T1C7359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 c7d1bb64f4acb384446c3de7a5df15881db3a527bdbac44e9a9e1f647c574228
MD5 c5d2d0120b8d2943fe8d528153cc3892
SHA1 3e01a0a2a8180d9cdcd10f9c84fb85c563b31df5
SHA512 e4c9bf62a41b02114b865b5e2ab16173b486a824f8a4ddf4dd2819310a342cb399fea8c0945bee6d6c01f4a076216440cadd8591e56d5ab299f2c36a96e6b044
SSDEEP 24576:swuROWN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:swSO2LNiXicJFFRGNzj3
TLSH
T17065F08632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5f683bd5c7b69a37ddbef12bfde00c881ffb0497b4e30f280199adfb1ba60ac7
MD5 ccd9e92be77f106f216dc8705d641a3f
SHA1 3c05234c985860d3da25f92f560dca6ce875a133
SHA512 32cda14e4f7746bd3bde8e8d667b706f915f2f78de91a00223edcdde646ff33764dac9cb582e7bc4e2821820f2d5418d51cc64b26de323378670950afd108d0c
SSDEEP 24576:CZu+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OLNiXicJFFRGNzj3
TLSH
T13B55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 657d4c62b9f0e7d41ffee601b0df196cb0708fda5f63d80853c712c228e1c523
MD5 7633dedea59a7aed80dbcb3fd3c3f52f
SHA1 6ed443c80736948f5f6ebf80526c186940c93d35
SHA512 0e3fa0c6729efb10a97abe32fd779ebf07cd92c0c1aa92438fdb6d09bfffc3fb0378dcabf6bfbe2ef4bb7d53548b011c2735e0a0d2fdf7c10dfaab72ba16a96d
SSDEEP 98304:nQRQyi36YOcPDLvw2gAf+PN397wRGpj3:2QyiKanX+PNxF9
TLSH
T177667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a1a19092b3c24f857d373f3150cb69c9484a4d06dcfb63851b8fd3d2fffa8d05
MD5 02417a89ce72ce6f813f61b3b61fd087
SHA1 df09ffa71e4fc6a070525d90fb022e37ae5fa290
SHA512 58e93448d85c0abfb2c2d041e6f481b1df52fccc465c5465d87fc59bdee09ae59ff3378448261a03002210ddc68174453d56e461ab668057d61f68bd46887795
SSDEEP 98304:GQRQyi36YOcPDLvw2gAf+PN397wRGpj3:tQyiKanX+PNxF9
TLSH
T1DC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8bd4f75fffe9a4b9602426344780090bee883af9db8ad5e71d98dc79fff1058b
MD5 b4e3a732bb9043221832bcf02265d590
SHA1 2925c23236deb21d7e6c3b643f8069e2fb0a8bae
SHA512 afb2fc71ddaa9c3ebcada4f03723e4c8fb658d54e84d04425624f4b6e4f9a517e105c67a7f30a8b9fd3cf34785ef74c7e69850c53ff632bf5f1d7f2cad8e4263
SSDEEP 49152:z68Qg55nhkeWu7PNU3/jLNiXicJFFRGNzj3:tthTRc/j7wRGpj3
TLSH
T184B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3ae815a85ccfa5f6caf6e1af541155c882d33e03b84a90cceb92a2b3c20da54e
MD5 238cf43fe926059332876ea0410b97ed
SHA1 7d90e093c51cb471310a1223a925f678a76e9869
SHA512 4594d1719aeb2cfe2b6f3b1280b71f9125d8b90b2f330ddf644034c74a305edf8ce2bb05fdfbc37f8d344cecb7f459053ebcd4d72530745c0e73da79ead1df15
SSDEEP 98304:Qy5112gYy5azzVvU69nLKnhZi7wRGpj3:pLIHRWhYF9
TLSH
T124167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cccf0b3754cd894f69fae39dd6b7b4ca41b6330845ca432c191c83763eaa5e02
MD5 f5be3fe783922ddecd568c4507621e7d
SHA1 4c2e60e26654c2c32ab84b9fbf53a9b6a9c3d99d
SHA512 f12e4e5322551bcf443f1f22a9a81a018c9cfea66cffce08bb21f996fb7d751d003cc938b0d13a73f6343ae27853f10655ac399ed82a1d2f0d58a5e6dc6d0859
SSDEEP 49152:IB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl7LNiXicJFFRGNzj3:Cu6JmIxd2d77wRGpj3
TLSH
T15BD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 22997c36f73b9c260fc2a833d977f5d70e177f370ac078c39199659432d1a725
MD5 3e0390e25720fd805cc904ea7dbe284b
SHA1 825bc17bc6dd3662571a40be545bf4ef495dae42
SHA512 bf9e573f3bb26320921a5f8e823f8aa952e00c7d472166ddad7f0cc7c0f9c3e8f8ea899b7fce523f4b53a6e4bff134c319abdbb4b9c89b1e00cf86d333e4a9c8
SSDEEP 49152:61hpsNoJpF1A67U44CwH7R4xJLNiXicJFFRGNzj3:6mifPqR07wRGpj3
TLSH
T14FB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6e5c548480c9a4443b8fe116d1a75890e60a4c4f77888c5ffaeb36e3d9f1ef46
MD5 63f1422cd935911643b1bcf96f782ecb
SHA1 2da838ede6530397daf9a65a584f67702b899364
SHA512 54c707fd7f15eb01a4b581917e232422eef5f66621c9a788806d821c690572bbf4dcb03e25e77c83c43b5c2d9d483c33c059d4d28c31078bb5b60aea4b730084
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHq+LNiXicJFFRGNzj3:A5dKqi61+7wRGpj3
TLSH
T10AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ebd6f12aae4ef18d7d2dc8927085e25b8fb70993b58e1b11b0604597e10099d6
MD5 df1ee0441dff34a3a1334a587abc87b2
SHA1 41f08370d95367ac164d19b78de7d477b7903a48
SHA512 e5a39608e7510ee93c4edc0bb162f8a1fe16761354acfb35d702e65626665f49cb345a8220e6f97a0bd2c137ed63fd07b7d0303476868bc545c4285a08336c70
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5wlLNiXicJFFRGNzj3:FX2iWphI7wRGpj3
TLSH
T15095BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b58a35ff61e1d0851c417ec8a7f01ee79be678f8b1ba42d6760f6cf2463c308d
MD5 8066df2f28e8c1b07313def65d6423a3
SHA1 6f39163976994042a262bf6280dc0bd572d68b1d
SHA512 0bd46683e1aa74c973665d88eced65782396da6f22c2a6f838f25d0211c5db7ae8315cf90368865bebf716f1cd990d032eb84fa761d82648e47b071152a2438c
SSDEEP 12288:ooiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1195523D3558955B1FAFC003AC6754428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f2f578b7f3c1f927f266f2b89b6f1d59d5d25e0d49e22286cfe20a808e890968
MD5 3f711eff0bfc83a19d2af2753da951ee
SHA1 b41dc6f5c161dc06ad7adbe05c0128acfab904c9
SHA512 50120f3759ffd45ec4f8b0d7b0d245fcfa25f6360a24619a7ae1d28c0a2ecc7e45d31da5de55dca38ffa3317b9712de8f6ab41c3899163862c87acd406808a44
SSDEEP 12288:briJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:b//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13D5523D3548955B1FAFC003AC6754428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6275830772613999560525ed6a2e58603a209173e599f99f3bc1fe707cdb07ab
MD5 168c2b3b126bbd7a1f225f1b403ee9a4
SHA1 7f254f131b26aa42444998085d2a7aa742942218
SHA512 712f2fc64ce5f3bc0dcddf022b5bec17231b5fe856ed6f442ba1501e081fe248219c971b8c7ceb0c716a58ac3f1974cd8da252c0dc95ee7ad8fe216921bbbe43
SSDEEP 12288:G9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11A5523D3548955B1F6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0f0045028b1cad2d445f3a1a35888e1fbb8a8afe009606206163abaf86908e72
MD5 7c31dae00b4a9515afc4e4189277e9a0
SHA1 453cb32cacae66591bfe22efa1644bc4f7af0c11
SHA512 733d7773826c52c146395115b60937d7b8b9293533b86502cc4fe36c8226b76050eac99a47940cf2257f1c7218ad9df3552ce2a6806b82f96a0ad4c0da3d3910
SSDEEP 12288:iVSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E6552392168901E1E9FD803DC6764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a4bd7562e0358a524cd38981c4342aceb03b6a5556d160185697da6c086ebf2c
MD5 7561483c0cbd5712bb3a40b3bb733bd2
SHA1 dde4267d2b79e8f2fe43c9c0ba68a4658ab8e3e2
SHA512 9814d4c34ce8251575d3c45b6f1c7079b36fa5a312ea10363ed6ccf8cbf37f230e8f0b672ef3ef9dd5ee6450f13b397be65bb664112957f4eb45a32913b4603a
SSDEEP 12288:n6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15D5523D3548955B1F6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ea52291da8636bc6c3de9d90208019a8848eebaaaa91c09f9d8c710d9ab0a4bf
MD5 528ce964e944be8bdc67be5be81573d2
SHA1 d0cca948c339e880e2873b8f414090b09d32f27a
SHA512 9400fcc155a6956970dd866c914862259e8c7afb5450f62ebc12a37f53ec9937e7bcf185b50cecf53104be33370148c01fa0c5225d13944e63f3605dc1d2c4e2
SSDEEP 12288:J/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1735523D3548955B1FABC003AC6754428F5881E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 93efc3961d5a5f4fc82e12accad233c284f82d8c91eef74dc759560d947611e6
MD5 e4688e571838f3058052c9dc31a4a63f
SHA1 01e6af221e4a9c16161722bdf048586dc7873b10
SHA512 f6d94ecb76575eb3299854ea1397a6685a96f81033e2ab49daeb3d589b7cd834e3da211ef227804e355f25c7b2a8758c4de4020fc28feb005549038cd79d4f29
SSDEEP 12288:wTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1825523D3558955B1EAFC0039C6354428F5881E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 0fbcb51f6afff908ed93af781ff5dd6d9c37ba662152c52c0f87fc69ab72106e
MD5 2dc864fcd8a0ee04cb6c302ab0f11b25
SHA1 19b966fab6b7edfadcf2356e4da3f9ee9f93d682
SHA512 2eb2c6997f413fbc2fbe227dac5607889595005a165d4d225abb06c01aa2c109d966fc31854bc8a8e0b14e2de114135389e4670cbd9053775e9467212a242601
SSDEEP 24576:sZM3zFVSOf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sZM3zf7LNiXicJFFRGNzj3
TLSH
T176750295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 014262d17b62921fc416c43626e24de2286ceaa09bfa7f3849cfb78db3a5e30b
MD5 9d1fd199d9e02e4ba81f3c367d0f188c
SHA1 07d96e6628738490cdb9351069cafd66c5b0339f
SHA512 70259ffcfce82086862c35dc9c40623103168112bf7579bedae1bf5f4bb56b0fad32b9318a4eb33381d84cc4b9bf5f734ab58fcc985d160f5c4ca364a55ea859
SSDEEP 12288:bkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1265523D3548955B1FAFC0039C6764428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e2039ff3b24d9c694f30f7e0c97718fdd56a1ec69462305bc6128959ce4c9af9
MD5 8cccd52854f917c62d433d24da38db52
SHA1 fdd79b4f8f564b790e20b9663fada02577c4b534
SHA512 a7bb4d9fbbda7bdfd7cf3042d2523d7127fa82999a3ddbbad64bd3f11f3eaa4b16f1b45c8fdc847156334222a62b04181a06d4b4534e6995d08dfa26a99db009
SSDEEP 12288:SAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16D5523D3548955B1FABC003AC6754428F5881E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 896a8cce772cc55057aa4b6d28aa2e5ab8b2d624411e768e446f28160e01b0e5
MD5 ca6bbc46d46f887adc268c143946ee47
SHA1 58cf5511ccbfe155322c99342ffc830a05e0e4b1
SHA512 12cf181557f5818ee71ce27c906ee8694e1a7dd8a4eb4f3442a8ccdd6b940d5730a1ad6bfef780cd042e06f2208f97b704a2708d41d62535a270a1eddffd669b
SSDEEP 24576:lzyD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lILNiXicJFFRGNzj3
TLSH
T1C7650247629530F9E17A4139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c8f14f50c53ed5288eac2564ccf1fa120daf47823017a992673ebaa44029a577
MD5 383fd672b22cbb51fc3027c17ff4ed71
SHA1 c8d96362c62689cc7d00f355f01264acccd794bc
SHA512 2be6f0f936488ff1e447a339ec35f4c736d5b72a042cec928d987e13cdc60b59d6a74543094fea74163df8d8a2cc1e1ea3f30ca89ed121e38e8c3c9139e7b885
SSDEEP 12288:jkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ju/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AD5523D3548955B1FAFC003AC6754428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 26338b70c53970f8b7f23ace0f58d5424364cca62588a5d23121fa0baa794166
MD5 73fb5d0845338e3a2167a95558e533c7
SHA1 d9483be9af34d31238a769063acaadb03ddf8edf
SHA512 da5dd29dacac98d6e53ad3abaffdd2d55c9d72275c70e5a2b78ceb938953cc1548f71ab31040965e274acfd8877fd264bbf872c8794ed344aa9512b436d5e8a8
SSDEEP 12288:9kiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D55523D3548955B1FAFC003AC6754428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f7e0c596c21efdaf02c53da14e61aa94f42657dbaba7b942baa43a772a52a938
MD5 eb90f8cdc6ebc280ae71fe9b62151532
SHA1 442d950a63fac89fec9f66a4644c7db07cfef0b2
SHA512 6f8ae9ce792ba5bca1209d97db35a0535723d483b160cf0bea1c75a582f1c1649eb31d5ea8e99de14e506b7c15a1c5e06212d3afdbf0ae0d5ef8ddf50fde60cd
SSDEEP 24576:RzyD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RILNiXicJFFRGNzj3
TLSH
T19B650247629530F9E17A4139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c3bfdf9f656e0db08931fdf69e323420a2ba795435dd867e7cdb581354619137
MD5 44af02bac0b6ad85ccce644ff16f20d0
SHA1 81ff44ebdb7101459470b91a763ab791cccd1cab
SHA512 fbfb9807c46e28938a17fe180e4fd3fae2aed64dd84ba26861c741ae59b6a14043694e281bd4d614587a0361879178231a752cea68fb5c7230764da304531f6b
SSDEEP 24576:PT8aLl3z0zDx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PT7LljQLNiXicJFFRGNzj3
TLSH
T1597502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 46065de381eff4caa3a21323dc1fff29af21d4d2676eb70f653b65b4d13ac67a
MD5 a2900cbcf75eebad3d92d9c9ba40704e
SHA1 def6886dafe343a0c6543dad639f54e837862fb5
SHA512 dd94918861bdc7d6d51f05f34e5c47d5f3ba52911326bb7a40d262d46fd1383709663802a12ce50cf7d3072a97c8f50309fc6337b10f6b65cd84e2be62b241c7
SSDEEP 24576:23rd9CHKy7GZd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Yrd9CHKya7LNiXicJFFRGNzj3
TLSH
T1DB85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 eb722034f3c9cce3f8a2771babcef0fdf354b48338c995a56fd56e11db770d25
MD5 c6867b35274bf9ec50d29149c393dcd4
SHA1 39aa5183837bcd4fcf50ca05a687d9c00e7cd582
SHA512 df772e9deb1cece71d0cc8d9067651e3d47cd32982ba8634d6d61770e5e10cc124355e44b5732932476824b5425bd6b30a7b130f4da49bb28a6c579f986a2765
SSDEEP 12288:4diJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523D3548955B1FAFC0039C6364428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 3bf835a87c1a3954bb065dbf218971627d1591c7d9d7a38c20261e4f1122b157
MD5 fcc2a1763c2db3b9afbae1cb4dcf9f9b
SHA1 111694923b42dc836294ec802dcc3364b2a2350a
SHA512 c743b953564f1196f6723e64039a40befe7a05bbc457184d3ba3301f756cee872b7d3614eb348bbb0b2f078715e6e97708488f7c14fdba3dbf8329cb689a4369
SSDEEP 12288:+XiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+j/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B85523D2558955B1F6BC003A867A4428F5881E2DDB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 70ab063c6bee9c133b6349b8806dd8974d8a22c64af3eb2b85032ba75f41e40c
MD5 8dd7f1bedf73e24ed56fa56a4baf12cc
SHA1 4c9d99d872da282cf084a9f853ace3c447bf925b
SHA512 cb03a26906d3e43c57669e66e00bd24e057499ec39b612441c07fa892955bb95aaa1f3efb6ae63013d7226cf7a2f705f23d59793b6c204cbc2c47e720da6a3d3
SSDEEP 12288:AOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19D5523D3548955B1EAFC0039C6354428F5881E2DEB5659E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 10f9860486c61ce47628ec00288ab15cd74f5074945022e536af4f6da4ee115b
MD5 e731dfc1ea4a70c289c8e76f85cb455d
SHA1 fb81661d45cb3ad7ebd3bf10fbaf7d10d0da1f56
SHA512 9ddda001f35246be9edc2d673ecaee69c947fce371cf435f5dba99bcf130c0d0cb32aa04fc7dc222b8625d095876202d0bf2baf4fa0ea005563e692cd58cf55d
SSDEEP 12288:akiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:au/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13D5523D3548955B1FAFC003AC6754428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 aa14b653e97b18b0ba49dbdea021855748a20dbf7932131324272d437839d9f0
MD5 93bcdc8ef342f4fe4dd33a045b99c30c
SHA1 08294f87ba45f48a6bed408470d338e5229aab4b
SHA512 71d0619f503c41ee5734fb21832f73f530261a3816cd2f00675bd41f14cfab2d0ff31d4b171dcdf8df257d936d62539bc3f11eca61d4ffd915107f21a16a7a4d
SSDEEP 12288:jdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A85523D3548955B1F6FC003AC6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 fa47a5003a3d12a76b12bc64d3a8f0a80ef6a120b5362832e723b3ceaa5be92d
MD5 0f23270f76f833f9a2986fb48ae6cd76
SHA1 438d182fe26a3ff011eb8beb55bc6e38c22e84ab
SHA512 0f59038ad6915dc7baad3fd49e2ebdeadabb9122049f4ba511615b999575fab3eb7bdc84820464d5a73acca8bdc770de0aa7b3fba37c210f867d7cf576e963ea
SSDEEP 12288:UMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F5523D3548955B1EAFC003AC6754428F5881E2DEB5659E3E2083D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b7b3828677deae2e1d0d04eb28d0ad7c4d816b1399f50f062cc8bc202ef56757
MD5 7a9ee2771ed769b7e4e192249329457e
SHA1 6a4c85832bd6c9a75df1b58a0f3038c5ac33b5b2
SHA512 3eb2d177eb98c0ed8e8d3b9466e32b4a1a5b2b60905dae71ba195b0f96756311a49adf350314784b73ef97900eed3461beb2345efd66f38d84f9da5f1a5793d7
SSDEEP 12288:L6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11B5523D3548955B1F6FC003AC6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 29b49586a06f019adfafaf6d13f21f690cd8c2422658438fb21eec23bf53e63b
MD5 273a0ffac132f46e3dd219950c820a01
SHA1 983855658385c6f3c915bba1ffe71cc6dc93785f
SHA512 a9c56739dc2e3bf42cb1e854e9a89f6ce0d85d6395b9ca58e594842e5bc358817267e9cf9ea24f427d9200b625c9b347027b2fa4d022c03719ac5e2ade515c21
SSDEEP 24576:hfwvzk9RX6wkyAIC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AMnYICLNiXicJFFRGNzj3
TLSH
T1BC85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 42320195ac66e2ab5433d769c4cd8e0f88f9add53f318684aae0a9c9f79ab91b
MD5 cbae1ac821af0c33f14e40312e15909d
SHA1 a577b1f809b9e799ebd4ca04241e0729717499c3
SHA512 2cc7a3d38dc52af6761a33291e1385d1f03175aaa6b27e181528e53737d95dbac6b425c6e2ab930834a7142c45eb944b4eb4337caf7aafa4f8ca8cb5bef02ae0
SSDEEP 49152:VYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FLNiXicJFFRGN:EySzPd7wRGpj3
TLSH
T162066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 48f1e5194c0029ac7d637840693032ef2594f4adc8847da81dae0700cf347f56
MD5 a25fe51d1ffbab6c2f33ad9b6bb0991e
SHA1 bebd9ac94a4f95e9b39cfc108581139e871ae1d6
SHA512 1457dfe1a60e28e53a3c700787f7fae4b418c6e41f5a4294ee98954a447fd6b295a58f51ac739b388f79c49b86b2f8914bab247328018c8f0b89202c97576366
SSDEEP 24576:v47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:v47JUQjqirIhCnDHUPfF/1LNiXicJFFS
TLSH
T1EF65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e022378f58f3dab1c1f26754765476e0438e0d34288185eeb980fcd8e8b6aed8
MD5 9d9548da54039e965ebf76e6d5e82732
SHA1 c6c4748db75c294ba1855ba5728147951adc9fff
SHA512 58063416152244320cc5f7288c3ea4f548386b5ef0d8290670ac2dc72b5216194b49ea483630102c92e95b6d4aad93712e9762bf9aaeacca2dd55301c550434b
SSDEEP 12288:ppsfUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:K+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13D65F15AD28802E8D1AE5139C7664900F3673C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b21a387db7c956cb7fb3a6f01690aa11f77505ad8fd2794285aac8d0f7189cd9
MD5 8ba48342530d6d9f3b51c24a0c53699f
SHA1 2ced7a57f4e7db6953e4c0db72d2e408cf071e39
SHA512 266dc52c3db22d2cdc5c1d395aaad000610d9a49c485bb3693b7e4f9886f5011ce351161b88226475c580a79b327cce6a7b70d3b1537c0b02fbc10fe47fbfe43
SSDEEP 12288:WxBI+5U3fZhE7QyrEMPeCE0ctvS1RhfDZvgSnqnZo8JhSkPZ:WxmuUPUcyPy0L1H5gSqZo8HSkPZ
TLSH
T1A4352910766AD75FC6AD80321E33D2CCA7707D41EE049B0772C8873F9576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 1a18a0b7c9ec2c8ff7aa35df913a4a882c0174f8fcac9d584d3aba79fad72181
MD5 1261f8ddb41a3909690c33085b4a899b
SHA1 7ef4eacc48b56211bbb2189d2cba84b14da16211
SHA512 0366802e4945202686d373f884fd5f5bce2f7864ac291f1d21faf2a2342ded4a29af38a12cd618811fdeb3df488e51dd7928f095206cc8201fe366736674528a
SSDEEP 6144:Ut9DcAntovtoDY3YlDzDEzmjxJh3QjPYeeu26tMxR26tMxl8zpMhIQQfFYE:QotoJHVJSjPYeezuyF
TLSH
T17E55C7815537A38FD1FA603207296B4CA764DC077709AF26B3C8553ADC2AB25A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze_PCULog0.txt

Path C:\Users\Admin\AppData\Local\Temp\2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze_PCULog0.txt
Size 646B
SHA256 785417aa03184a08060817659dce98b4b1bf1096f031c7c07883f4d1c324c4ca
MD5 8ea25feb2134ab4b59730eb59f5fcf86
SHA1 b8977b8abbc931e672f6ded1c772f9c43e1df8d2
SHA512 03822fd2bed85a2cc1eac38e099037f45196fc82893c29b0027988426a463da0e27987269668f66a8ce0de88f5dbdbdf1f5a6e7a094936f1791010a74c6fb345
TLSH
T13DF06850A1EBEC012931165ADA1AEAC8E3E8F0979796177426CA711B21DE00F65E6C04
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bfa66e27351684ac211cd02849f1dd34a0601e19558c39b9eac6506c015c9209
MD5 ea21f46a43890d60465cda3dbe0dedd7
SHA1 7f8ce16d52e45a6ab49f5aaf79288ce70df52f9c
SHA512 88e257aa82b085df06c0a0b7189e77da044333319f7d9008d61f5a2b441579e51d65b9dbd7726b8879a05f089d7d1669d364cde2c1a77f384ad753571d4a2698
SSDEEP 12288:bF78iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1785523A3568C59A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e8348a25634a8bf5d2f462704911d551656a785cbef245c62f70066398129c0b
MD5 501d78304f14bc92501c94c7f6bac8ec
SHA1 a4089b018f66892ddc2c71e6f248f703aab7a00f
SHA512 deacbf9ac82568b071fe6c09696ddeb14169e7ccad07597987d37ad9127b73ad06694175383f8e29364cc15aabffbacba4391b5f809f81ee93a33755461365d3
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Qgb4mBIBhGFPLNiXicJFFRGNzj3
TLSH
T16965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 5ba2a0fb733b2056f318a32de419b7257291fe2f1a793fecf46129ea2b939758
MD5 c4c9c8f11bb8ed45b9329b103e7ab347
SHA1 fa88805ebbcfaf122b1b1bdeec1f018f75f95211
SHA512 d29f8e243ea190d6039cb4b827ef11a84e81714b18c4dd85f123a00230fafd1eb106a99433258011f3ed2d0717063719d7217897456bc36534ac091995462152
SSDEEP 24576:oG88u8FpJqH1vzria7/mf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:L7ZFPqVya7/YLNiXicJFFRGNzj3
TLSH
T11C85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b6d5a1a81146069b8f6fb6378ec35571321cf00f7fb42092b69f3017d76a39de
MD5 934715931aa2695f1f6b260ab0c652e0
SHA1 58710ec3381dd038f0d1d6cebbb7c5962061a7a7
SHA512 86d4ee7401cc4a5285d1ec753d3a6d49b56f184c65154f9851458991e01349db1b77917cab0c210e19c77dcd166238f84e2a23c994ba44f3ab6eebc1d279c700
SSDEEP 24576:5PUr+NQ7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5JQ7LNiXicJFFRGNzj3
TLSH
T1EE65F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2b5d55f6f3436915b9716df9411c4a9c8e723026a4b97991c25b4bd5fbdc6b8d
MD5 50d49ce6d8d8e810eda306442d330de6
SHA1 8ee9f3cf4982fc51882ca93d62d92dfac0cdc840
SHA512 8456146ee195496a428f2f27d14d561382da9c433b43a50e6c29c8ba5a3a075d616aab2c4ee99edf2705745fea0297349f5a7248418540afe4a66c02d947db0f
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLLNiXicJFFRGNzj3:kG05lO43bK7wRGpj3
TLSH
T199D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 981296866c8d8daf31231047e8fb4fd830a6e6c8d99b198e87499305392cd1a6
MD5 9fd57913cb10e73e585568088d62e086
SHA1 c9530616481bf075914f15dd5a3fa19d3033dad4
SHA512 53edec58dc35a582bd70f62b0cb305d7536640ce72278e8ff21b5e2032a38ba41fb4e11d00feda0c05afa093e0b200224a6004e447c25dfad9cbad00f95afcdc
SSDEEP 24576:Efa5POZ3dpyWVM50JicR2hG0lasx2+47eidnF/TwSfVcYG3K/cJHlnFR+IGNe8jg:ca5POZ3lJt2pasx2+mjLNiXicJFFRGNf
TLSH
T17665BF5EA2FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 31a31be11113d3410991de4abd14a7f44c0758d6b0555eef22b9b2da55792d0d
MD5 37ee4fdafa942045a4556edb58dfcf3c
SHA1 07ebdabe3fd142ef9cadb6303c2e31cb197c6e91
SHA512 14456afd1d26513997b9202adc4743431962757f2a2791a1b6e026e9dd72ac30734052bfd9b72b875d6ce63dd330a962ffc5016665b0a78d7b37ab9165f6b0dd
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7Fk3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BNc/zEOVHF4LNiXicJFFRGNzj3
TLSH
T1BA858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 da038754a69bd9fe9f7ebc10c43ee614aac92eb502680592bff0ebe90f801b2a
MD5 9a8bfc8f806cb069e6df36e39fa3eb71
SHA1 e2948b4580c0ed1714a10299e5d82fce646e4a06
SHA512 fd40b837281b3a0f50c061f93f6d5a72b20dadd686265d4ade6ce51ec920248847338663b8de11d8e1abcc10995210fa5f2b3d100b42187dcf835eb4c177869c
SSDEEP 24576:uzkNvNnaFeYhJNtmZBmP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uzMwBtOmPLNiXicJFFRGNzj3
TLSH
T15355AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 64203170c5bcc9308673829728e58aaa8a810bbba22a6a2ab4175de8afb74c41
MD5 ee5d65874b65a3f7c19287e394593eb2
SHA1 06c8933e7697e36fe938a478d00b28be14736561
SHA512 081b8dfad3d34f55be1fca3c6f5ac699123d309c1d4c4b536101f53841b035462952bcb653a1cdc7482c4726fc89a7870b542f03ed7295ccb33c65de51a3e804
SSDEEP 24576:LD3FHshBIYQgA6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LDVHeBIAA6LNiXicJFFRGNzj3
TLSH
T1DB75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/424-71-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/424-64-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/424-74-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/424-306-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1032-73-0x0000000000400000-0x0000000000800000-memory.dmp

Download

memory/1032-0-0x0000000000400000-0x0000000000800000-memory.dmp

Download

memory/1032-8-0x0000000002730000-0x0000000002796000-memory.dmp

Download

memory/1032-1-0x0000000002730000-0x0000000002796000-memory.dmp

Download

memory/1104-320-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1104-87-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1104-79-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1104-81-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1180-151-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1180-148-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1180-145-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1180-139-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1180-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1384-114-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1384-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1384-113-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1384-325-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1384-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1384-120-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2276-157-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2276-163-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2276-156-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2276-328-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2632-155-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2632-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2632-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2632-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2684-60-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2684-47-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2684-48-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2684-54-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2684-58-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2852-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2852-108-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2852-341-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2852-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2852-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2852-102-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3400-405-0x000002227BB00000-0x000002227BCCA000-memory.dmp

Download

memory/3800-92-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/3800-97-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/3800-321-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3800-91-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4588-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4588-24-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4588-30-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4588-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5176-128-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5176-134-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5176-127-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5176-324-0x0000000140000000-0x0000000140295000-memory.dmp

Download