53570946e5ea3381f775535eaeec3285683920d779064690ce3210992033bcfd

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
Size 25.8MB
Sample260831-kc797sfd63
SHA256 53570946e5ea3381f775535eaeec3285683920d779064690ce3210992033bcfd
MD5 8bf4873d7f59f775bbf5a40e01042a4c
SHA1 56365fb65d1e653e83d4e8a1ce88445656b0589d
SHA512 a97c7c222d18e0803b877cde36cf0815581618d1c615a2a28ab8c5a404b1019ed36b31e692b4a95ae4918a0bbbc35c803fdff7a7dd754dfba140c735c031d182
SSDEEP 786432:S56YCMfzBmnnS7W/1k/uNxsnu38pn9g1UKtnjC4Xl2SkKQ:S5RCazUnoo1CkvZjC4sSkh
TLSH
T18F473331B5D1D0BAE5330271C6DDB72875BDBEB05A3A015723D53F2E2DB40A2A938663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 16 IoCs

pid	Process
3536	elevation_service.exe
4336	elevation_service.exe
3812	maintenanceservice.exe
2900	OSE.EXE
5844	PerceptionSimulationService.exe
5736	perfhost.exe
3208	ReFsDedupSvc.exe
5544	SensorDataService.exe
4996	ssh-agent.exe
3292	AgentService.exe
3452	SearchIndexer.exe
1476	msiexec.exe
4844	vssvc.exe
1408	InstallationPathWriter.exe
6092	SWMAgent.exe
1084	sAgentSetup.exe

Loads dropped DLL 7 IoCs

pid	Process
2764	MsiExec.exe
2764	MsiExec.exe
988	MsiExec.exe
988	MsiExec.exe
2624	MsiExec.exe
2624	MsiExec.exe
2624	MsiExec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 54 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4448f8a124febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SWE.chm	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ARA.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_AZE.chm	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\sManager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GER.chm	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_MAY.chm	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_DAN.chm	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_RUM.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_POR.chm	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_DAN.chm	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_MAY.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SLV.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_KOR.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_TUR.chm	msiexec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_RUM.chm	msiexec.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF6E102AAAF93BFA06.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF195B1414842868CD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9CA45C4887BA3A53.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{06E8E156-6993-4A23-805A-B95C0012D743}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\Installer\{06E8E156-6993-4A23-805A-B95C0012D743}\_79B6780305DEA69442E63D.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\Installer\e599e3a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA280.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA810.tmp	msiexec.exe
File created	C:\Windows\Installer\e599e3a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA698.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{06E8E156-6993-4A23-805A-B95C0012D743}\_79B6780305DEA69442E63D.exe	msiexec.exe
File created	C:\Windows\Installer\e599e3c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFED95921748A645FF.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{06E8E156-6993-4A23-805A-B95C0012D743}	msiexec.exe
File created	C:\Windows\Installer\{06E8E156-6993-4A23-805A-B95C0012D743}\_853F67D554F05449430E7E.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallationPathWriter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sAgentSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SWMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe

Checks SCSI registry key(s) 3 TTPs 41 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000508ea0cb0cbd3e300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801508ea0cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101508ea0cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3508ea0cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6508ea0cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
3128	taskkill.exe
1084	taskkill.exe
5720	taskkill.exe
4108	taskkill.exe
5352	taskkill.exe
5320	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e1e25c92239dd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5b5a3ca2239dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b846ac72239dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Samsung\\SWUpdate\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\SourceList\Net\1 = "C:\\ProgramData\\Samsung\\SWUpdate\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\ProductIcon = "C:\\Windows\\Installer\\{06E8E156-6993-4A23-805A-B95C0012D743}\\_853F67D554F05449430E7E.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\651E8E60399632A408A59BC500217D34	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\651E8E60399632A408A59BC500217D34\DefaultFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\ProductName = "Samsung Update"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\Version = "33685548"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BF3805105D8948C4D93B598B404C92A9\651E8E60399632A408A59BC500217D34	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\SourceList\PackageName = "sManagerSetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\PackageCode = "625F65FC532D92D489D40A168586A985"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BF3805105D8948C4D93B598B404C92A9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\651E8E60399632A408A59BC500217D34\SourceList\Net	msiexec.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1476	msiexec.exe
1476	msiexec.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
2624	MsiExec.exe
2624	MsiExec.exe
2624	MsiExec.exe
2624	MsiExec.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	5352	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeShutdownPrivilege	236	msiexec.exe
Token: SeIncreaseQuotaPrivilege	236	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3292	AgentService.exe
Token: 33	3452	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3452	SearchIndexer.exe
Token: SeBackupPrivilege	3208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3208	ReFsDedupSvc.exe
Token: SeSecurityPrivilege	1476	msiexec.exe
Token: SeCreateTokenPrivilege	236	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	236	msiexec.exe
Token: SeLockMemoryPrivilege	236	msiexec.exe
Token: SeIncreaseQuotaPrivilege	236	msiexec.exe
Token: SeMachineAccountPrivilege	236	msiexec.exe
Token: SeTcbPrivilege	236	msiexec.exe
Token: SeSecurityPrivilege	236	msiexec.exe
Token: SeTakeOwnershipPrivilege	236	msiexec.exe
Token: SeLoadDriverPrivilege	236	msiexec.exe
Token: SeSystemProfilePrivilege	236	msiexec.exe
Token: SeSystemtimePrivilege	236	msiexec.exe
Token: SeProfSingleProcessPrivilege	236	msiexec.exe
Token: SeIncBasePriorityPrivilege	236	msiexec.exe
Token: SeCreatePagefilePrivilege	236	msiexec.exe
Token: SeCreatePermanentPrivilege	236	msiexec.exe
Token: SeBackupPrivilege	236	msiexec.exe
Token: SeRestorePrivilege	236	msiexec.exe
Token: SeShutdownPrivilege	236	msiexec.exe
Token: SeDebugPrivilege	236	msiexec.exe
Token: SeAuditPrivilege	236	msiexec.exe
Token: SeSystemEnvironmentPrivilege	236	msiexec.exe
Token: SeChangeNotifyPrivilege	236	msiexec.exe
Token: SeRemoteShutdownPrivilege	236	msiexec.exe
Token: SeUndockPrivilege	236	msiexec.exe
Token: SeSyncAgentPrivilege	236	msiexec.exe
Token: SeEnableDelegationPrivilege	236	msiexec.exe
Token: SeManageVolumePrivilege	236	msiexec.exe
Token: SeImpersonatePrivilege	236	msiexec.exe
Token: SeCreateGlobalPrivilege	236	msiexec.exe
Token: SeCreateTokenPrivilege	236	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	236	msiexec.exe
Token: SeLockMemoryPrivilege	236	msiexec.exe
Token: SeIncreaseQuotaPrivilege	236	msiexec.exe
Token: SeMachineAccountPrivilege	236	msiexec.exe
Token: SeTcbPrivilege	236	msiexec.exe
Token: SeSecurityPrivilege	236	msiexec.exe
Token: SeTakeOwnershipPrivilege	236	msiexec.exe
Token: SeLoadDriverPrivilege	236	msiexec.exe
Token: SeSystemProfilePrivilege	236	msiexec.exe
Token: SeSystemtimePrivilege	236	msiexec.exe
Token: SeProfSingleProcessPrivilege	236	msiexec.exe
Token: SeIncBasePriorityPrivilege	236	msiexec.exe
Token: SeCreatePagefilePrivilege	236	msiexec.exe
Token: SeCreatePermanentPrivilege	236	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
236	msiexec.exe
236	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
236	msiexec.exe
1476	msiexec.exe
2764	MsiExec.exe
988	MsiExec.exe
2624	MsiExec.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 5352	3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe	92
PID 3132 wrote to memory of 4108	3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe	94
PID 3132 wrote to memory of 236	3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe	97
PID 3452 wrote to memory of 3200	3452	SearchIndexer.exe	106
PID 1476 wrote to memory of 2764	1476	msiexec.exe	108
PID 3452 wrote to memory of 6020	3452	SearchIndexer.exe	111
PID 3452 wrote to memory of 1068	3452	SearchIndexer.exe	112
PID 3452 wrote to memory of 2712	3452	SearchIndexer.exe	114
PID 1476 wrote to memory of 3696	1476	msiexec.exe	116
PID 1476 wrote to memory of 988	1476	msiexec.exe	118
PID 1476 wrote to memory of 2624	1476	msiexec.exe	120
PID 2624 wrote to memory of 5320	2624	MsiExec.exe	121
PID 2624 wrote to memory of 3128	2624	MsiExec.exe	123
PID 2624 wrote to memory of 1084	2624	MsiExec.exe	136
PID 2624 wrote to memory of 5720	2624	MsiExec.exe	127
PID 2624 wrote to memory of 1128	2624	MsiExec.exe	131
PID 2624 wrote to memory of 1408	2624	MsiExec.exe	133
PID 3132 wrote to memory of 1084	3132	2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe	136
PID 3452 wrote to memory of 5772	3452	SearchIndexer.exe	137
PID 3452 wrote to memory of 3980	3452	SearchIndexer.exe	138
PID 3452 wrote to memory of 3768	3452	SearchIndexer.exe	139

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_8bf4873d7f59f775bbf5a40e01042a4c_bkransomware_darkgate_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /F /IM sManager.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5352
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /F /IM SWMAgent.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe /i sManagerSetup.msi /norestart
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:236
- C:\ProgramData\Samsung\SWUpdate\Temp\sAgentSetup.exe
  sAgentSetup.exe /OEMINSTALL
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4336

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3812

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2900

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5844

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5736

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3208

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5544

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 2984 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 2984 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3768

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E356EEC96CB7E464E1463DCC230D69ED C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2764
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 10FAE36045A326B05A577A4831B3F8D9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:988
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 04216E4861AC99F67E8487B2C303B16F E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM SWMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5320
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM SWMFileDownloadUtil.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3128
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM SWUInterfaceLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1084
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM SWMLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5720
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /delete /tn "SWUpdateAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1128
- - C:\Program Files (x86)\Samsung\SW Update\InstallationPathWriter.exe
    "C:\Program Files (x86)\Samsung\SW Update\InstallationPathWriter.exe" -task="write" -id="20000" -name="sManager.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4844

C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
"C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe" /SERVICE
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599e3b.rbs

Path C:\Config.Msi\e599e3b.rbs
Size 20KB
SHA256 9b67e8b947dccce87bac2db2f8a6c7c280a3f3768b0cbc5ef31fb9fd24995f41
MD5 d5c2e882f052d0236a34216d7b5335ce
SHA1 89f17e7cb99ac9af03c9b8925a7cb4e5e047fee9
SHA512 28cd848eb360f6eaa059961d1f3d097303efa9f0439690ff37ced430e4b37057fadd9e6315236627e20ae14e11172b8630b5cf33438121114ceafde7bfd76040
SSDEEP 384:pLt2mZ0rn3JuVe9Z4DAKMShwMShvqI82WCUHQI:pRZ0r3JuVe9eDb4T8Ge
TLSH
T120924271BC53C2F1F8456BBDB7D92F20230BADF45B99411B18CC8B960581AC31E7E6A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8e93764a0a0e75553e3bc72249dc409468272dde862eff4e514cf811dba2e62a
MD5 04a96c5c44a1813ae8ba6d4be770cd1f
SHA1 a8e80c2986670212e4447e1075545383849b2271
SHA512 1643a54243e9fa53694224a1719bc972d0707c5d068df7b9c2fc789a31072002c7bc9bfb47dfbe51d6eccd12ab4c4b872653f823c5521d258371f46d5a32ee01
SSDEEP 49152:Fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnTkEPJ4HOvhb:b3q6sjB4bx4uR
TLSH
T169D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7755bccdfbefdd3ba29e0321a5c6e32208c8563a227c80a7587e59dfb42d1b49
MD5 b67ab3ece1a7b0a1f02485287a07cd87
SHA1 f87c5254d0de788aed87f1d9b618c2a5995755bd
SHA512 3d18cd8488b595ad084f946483a928d5155fdc4aeaf83f1f3ae8928bc961c7eba308052cfd9cc848d56b9f6b8da697683b968fe9b5e224bff4898701866509ae
SSDEEP 24576:qXYfDtczAzsBxk80eP8WPQHxIvxDO3YR:xtcNkEPJ4HOvhb
TLSH
T12F65012C639409F9ED678279C8E28511EA337C9543A0E79F03E49A651F337C85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_CHT-HK.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHT-HK.chm
Size 12KB
SHA256 43934c228d8911033336f67b3000700e001b6602a2c02c1fe440a1108f183605
MD5 03544bf81c3aaa2adcccb7a1ae0c76bf
SHA1 bc80ab03b78cd2202f2e653330c8b3dd0a4adad2
SHA512 6d70d2c264bdcaa1b6a82be9f43d886ff010c61e87868659d7457502475602ea3dcafc93ce9ee2d30ae91ff9ec82fb986be4577928e14bd60e8d40b66f332600
SSDEEP 96:1bXrqekqyWSDAvSy9CI2i+v7DbdTzi7IAeiV7bCVdTck:FXrq7qOf9IkjDbdO7eiV7Gd
TLSH
T1DA427EF43660C332C06531396B6B5099392A7D01BEA78295310A7A2F1CBA73997348D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_CZE.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CZE.chm
Size 12KB
SHA256 89ffa2573caadca618457b8304f5576cbcdc798d5a7639414137c0ae64607d3a
MD5 3c5162a1115c57b66ae6c9b20bcb7418
SHA1 5541851e393f41327634a8d1246e642d79091b19
SHA512 c300c6b6ab45fbde33025d4dc0029d593816f30feeecac5dae18bd5fb05650352c11097ab93bc31831c5d464c3cb35c1ef5b4b0758c141ebfe9c8d73e5ce998b
SSDEEP 96:9CUaWqWI29hYyJgJGMdpvGN3shd/m03uTcGFY9k5LysH:9HhZYxJZpeim03QUeu
TLSH
T1F0427D52B315C821C14C8134BFC25BACB0D63CD0AF6D99D13218F11C6B7BA2D3BA056E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_DAN.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_DAN.chm
Size 12KB
SHA256 f22a1660fbce1ffd16cc762e6fe4247bf5118f878c97b3c36cb076fadd15fbd4
MD5 ce333b283ff145024a3867be22c8707e
SHA1 2cbf665dd0f2ea6c47c8de2b9bccde0f5382c932
SHA512 fb2b7bd6c1798743de3c166000b63917bd665982ae9967588e23185dcc18e3157e3c513b0c67da5fbbb5de7440a7c1f77376709a6b55994002342ddb21aea79e
SSDEEP 96:SUGWPxdbre9Q9nSt/9iQMkko2i+YOUVZsntp/gtheXjHx6jRjDXvkX:SU1br5ngc/lYO+WrgqHxGDXvk
TLSH
T133424DF1B7708A14D4A74332BA8507CDF2BADDA3AE5412B71014775D25B3E490A385AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_DUT.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_DUT.chm
Size 12KB
SHA256 d57584717b1d12968cdf165858852f36c3b26e6bb605d247f09d32739356805a
MD5 f1e3392dea3ffa56fe92a6c2ee27c3d0
SHA1 c9a63e3babc0e34843f0244511fbfee5637a96c1
SHA512 25d23f7023966ffdebf4d79e65cfa6a27b0380641f4c1fc48f25e82bc296edabce854d1ee24a961849c20ad51f84181f722a4daabe09136e8f91b34228a485e4
SSDEEP 96:cQGWsn15PNEQNSC2bZT9G+eFPOhTUxSK61FV+P69UyJGeI91:cQ2Pubo+eMVVrnVA6W3
TLSH
T173426DF078100615D45487313BC5255F6AA03D63ECA096977136B73F39F2C0CAB726C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_FIN.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FIN.chm
Size 12KB
SHA256 29a11cb22438d1a0f0b67066f5615e9896ea481ec41e0847ea1446c30e8878d2
MD5 e9f9020f9a6c79a2e8c265cdeb5a024e
SHA1 59c6d9f1a833c9aa1d0a0d876f273e305b217777
SHA512 b554bd728a01cbf3018c3a65addcb174974e6b6f8650432c643ae9cf9ad4b1e6298af356345a6cfb99b63d5f720b1907b3e9ae215601423b79471ada6cf5c466
SSDEEP 96:esSuWR9N0eL81zbfUsSAo+o2xXwlTrInR31RYLCU0y7q+XEn:edhr8hbetEwl47YLCty7qmo
TLSH
T158424C747263C621ED9499315F35B4CDA150BD41E934A2DF206AFB1E14B5E0D2E209EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_FRE.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FRE.chm
Size 12KB
SHA256 cc96740ae9e161323c0a873f75a0c90f5cafb371f5d270b5ff4011ce6014fe7d
MD5 2a765e66267f53c6ff8a3bffdc069f6c
SHA1 883993f9d24068edac04b6d638ecb036ec9132e4
SHA512 f97c69998552aa422d0de5addcedb68e840b02450b3327ce65a4702ed31c679a99df2c7ef6a1dddbd0978e88561c06581ed47e0c870e6047cec0de02de8095ad
SSDEEP 96:R2UTXWGfYwPIDKHtp9L1r/s56S89ceOAR6qIzXHVJlbRA0j:R2UTjgwPX3I56zOA/Iz3f9RZ
TLSH
T148425CD072054024E5D88A73FFB8559922A1FCD2E4B4598720DAFB3F35F9E0C0B14768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_GER.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GER.chm
Size 12KB
SHA256 4a1250f21c6645e71341c41d07372c84332733f76553c55acf8fa96651a6d719
MD5 710431b364edd8ddd4305e898c4a7c14
SHA1 5497e3a79dcc5efd7548aa3c51b1a9f41ecb6c5d
SHA512 d2df6b1d6aaa0b0507b5d96324261ee217c4ffa35b8c572c89ec293a9565c2b1f95f777bc0375565954d2dcfb1596fc5261f62cde703ab8ec381f649ec5ffc34
SSDEEP 96:vvQfL/WuBljvu30LCoDpkXcY6sajWyYXcy+BF31LND:vqLFnjvdLz9kXcopXchPx
TLSH
T199427C7476004625C2D18A31EFCB9662753B3CA29E22DB5FC206F12C39F6E0D3739999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_GRE.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GRE.chm
Size 13KB
SHA256 a1c33f3290105ccd733b0da45b0e2683b5ac7f70b6b1b811e22b453b5623a26a
MD5 10b1bed1205fdbb945b8b0aac22deb60
SHA1 19482e6ba4df50b562fc3a4b76b693453a6121e2
SHA512 ae1eb1ab76116d417165b07a82ba939ec2141a2a134c87a6fd481b3efdcf01177a133b68b4a89fe4fe90e93d54a82bc6156ab0903ca5e61772c2e6dd9bf02b20
SSDEEP 96:9VP+5/XCsJnSeL8LFg5GwRhIHNKwLEsJidphsdOq8x7+PHa/Tf54qOPT6qL/T:9VPCXOLFg5XrsNKwn+zsvKN2
TLSH
T145529F38B948511CD0438B3B774622973199FDB68ABC95163206F2799AF16190EBD0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_HUN.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_HUN.chm
Size 12KB
SHA256 174b9813d53dbac56107845445e7d8ea3aca59bd69ca81674a7356b01598ba5a
MD5 897c6b651e11df797fb16e2e418ff1ed
SHA1 a2f0c9730cd0fb47262957329494b0331f311f78
SHA512 b7e506a992f04cee34f90817e44e709e0488ced10a3cbca08eb5c72fae7d781a86562c40cc47a9a3ec40248fd932c351cc5512649ce4ce2902db79193dbf3811
SSDEEP 96:uqJ5WLMMHvmIBTdviQWWAWmswGpxO7ofCgQdwZ8+bFdR:uyivmIBBv7wJfp9+vx
TLSH
T11A527D717B9EC260C59D95733FC2814DB532EE011668E3C72256721C6AF0D5C8BBA8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_ITA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ITA.chm
Size 12KB
SHA256 f3ca54e15d56f337376c4c1a6ddf9d58709ebcb11511c9bde90fecca42dd4fbd
MD5 9f2ca3154a8ea91071b9a46c0aea4c1d
SHA1 babb64a1e950d4a054e2ffd0341cc95e4d9b3e53
SHA512 72f0b0eabb7faa0b5f6ac9ae3b54212649fec4fd693939187be2c082b752166cf698873e204db858ca1ebd1024dfc85fde1b870cf1eb0928e12e768d69f989ff
SSDEEP 96:WFFUSZW3GGgkR2tGIND1kfFh3mT7Wrx/SInUw:KKSKUtfp1Oh3mTSN/j
TLSH
T131426CF432904324C24A2333FE549ADE72613D11DD706097B159EBAE6DF9A2C67708AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_JPN.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_JPN.chm
Size 12KB
SHA256 b6bfd4032111c8c707fa7f21756eb81a47ef2b46e44c9683236ea42705a7cd54
MD5 76a81cf425795e6b1cee94710a08c890
SHA1 dbaeff5062c84443e1fdf9346de3acacbfebeb96
SHA512 99ca2e8aa62fe615f1806cc78c1cccfc9955acb047c1e6f559f3dde322f538ea5ea61719f78f6a36a691fce48bb67587784476688673409a5e335e549f567c1e
SSDEEP 96:pQoObkFhRUMhbBLRe1Cz2Su5hSMGPPzJpTvJrv8ojz1S1Rc6n:pQoWAUUBI1Cz2r3j6Pz3tv8ojzyK
TLSH
T1D1423B10FB688803C5284F767FD1905A9E862E91DD740593350BB6AD3DB3E4C6F618EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_NOR.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_NOR.chm
Size 12KB
SHA256 bde1c85416cf46ce12e45ada973382b48a5a210692a9dda3354df586537f41fc
MD5 96eecca90564af257cd656c136ff9e7b
SHA1 9f09f61d964d3049390ed9f5e91f6b3144e0d3a5
SHA512 0e1f387a7b84119b28da15912fce45800bfc409672abd3e444931839cd929a2f8b5d1d6f59f1f4531ad929a80662f0d771260a2f6466af6e1214070a60d7c1d6
SSDEEP 96:5wnSWWmsdvwb5/IuqwAsKoERv+EsuSlP5p5OjvLRte+fYaEum0:5wnSttwb5/jj2B+6SlRp5EvAI
TLSH
T1AB428E12F770021DE85951762F92924796317C41B678E143712B3B3A3E77E0C5AA09E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_POL.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_POL.chm
Size 12KB
SHA256 a5a2ee74b57e0ceaf5ee9f980b5c0962a784d246bdd004b33b315d7d30096ec7
MD5 42bc73c076c7c32a7b21febdc4608075
SHA1 386b838e5b76df2dcb620873e40873c50ff6f68b
SHA512 a2f43784fbbd0ab0c98a30429ea68c76b989e24852d5bf44b2d99ddf6b960a70eafda211dbdeb4208ed0e83a45da2e108dbd0a66ee886a183901e7e496b22f96
SSDEEP 96:AGvWs8Np7IxHZ/hl9zYOY/qZaV38alNO:AG7ANMZ/1YOlZksaT
TLSH
T1EF429D7073259934C5A2873BABCEAF8710447F5987A85512461D373C2DF9719CF70E86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_RUS.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_RUS.chm
Size 12KB
SHA256 8dd28725c67075ae1c2d41406343bd5777a644b2b826831d0b8eb489369a288b
MD5 81b75e63131b1b69bd22affabedd6ee2
SHA1 446efc3ee0183175f1f9e49f7f079dd87a406617
SHA512 8b264180454cff29c99334bb680ebd7620f87dfad851db0c8db9d347dfcb822c9c9dbe878aeeddc9daf6aebac65e89ba0c54917efc094b811f76ac153a97957b
SSDEEP 192:U9bzpGZfJ1GzO7ZzJW9+cVvNCc51AWfHZZRPK:U9bifCaF/c/CuHZZR
TLSH
T1A7529EE237124B32D249D4365AF9A7892C178F9EB7902157314AB74993B5F0637B18C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_SLV.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SLV.chm
Size 12KB
SHA256 d28d5e3f3bd15a36af501fe580e3bf159039935fab9644d060e1af616736aa44
MD5 38e0cc1e160cf4a0c70b404351719644
SHA1 ed12b1f084974116fb829561a6fc9b1e184b9c35
SHA512 f1e51f010f4d393c922a517bde97f5dc85b7f53937f7b8530e3ac7299874800a138a284413e2f6d93800a9ee45d28971468c77174aa521b8e18567bd2f28bd71
SSDEEP 96:OEWWdCdmvdWE0TDjKgP9oZ5QosLslFtV+HasbRaMCdvaagNUJ:OEnCyqfDPU4sPtZMCkxUJ
TLSH
T1ED426CF032430335D7644A372F422144A759BDB69AF4565033A27B6E24B3B2EB33519F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_SPA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SPA.chm
Size 12KB
SHA256 adf78f2ae5ae0d8eeaf8b4cf1c558ce8190dde3198e1e718102d98797acd2f55
MD5 a5c2183747be4a6cfba2c1359f4d7299
SHA1 0033c5073f7d3d4704b1d86175faea756aceb380
SHA512 fbd5e10ab22b2ee9b0c7840a553fd28944a3a3a9d202a1b9dfb204c352fb5334f58601fb908c29b80293f874529bf2f9fa6ea38d31948e3afea2b96318564e5a
SSDEEP 96:6BXlWfx7q5CMIWYV5AQUEQOoctVMWOn7uUkDbak8x7T5q/Q3hCoEH:6tKAkTWYV5AQUEQOoGVEk4lo
TLSH
T127424BF43A589B21E1948A3BAFCB5503B322BC62F93066177259730C2473F1C5B658D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_THA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_THA.chm
Size 12KB
SHA256 3b531362244dd1ab03cb32f2d19969dbdbb142fc1283fa80269791d420b7e721
MD5 0bcadde3239017157a34fae425d0499a
SHA1 adc8dbf0e323c7656eb65aa51f9fb280df77ef86
SHA512 29db62795ddba65d495817d48948fd24a85bb50e981aad89c05b65186186a37dbebbfec752f56a2e29ff04e85a6391f6803c3e8c2532a21c97ba6676a173ada5
SSDEEP 96:oivn6g9evzQrBE+TDRb+C3gGPnmdc1whjW4H9XpUZGToWjIjf0Ja:oi/6i/rBrN+hGjdm9XpfToEeMc
TLSH
T13A424C50324D8214C1D48D3A3ECD734E70226D91DB70A24B112DEB68E8B7B1D9B45AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_TUR.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_TUR.chm
Size 12KB
SHA256 9ebeda2cffc1b3eb4ccfd4ccd0b26e725705405f94b5189ca758d5b18b62ceb3
MD5 aabf2533183d94d809586cfdd4f1624a
SHA1 a509bd048023344ef0209065203d0038b0b39532
SHA512 7bf880605d6513fc46ab09fe806be6f6cce51cf5500fe7839d69286c5781fddc925a8f985f0c5b9bb380db67e3cb525216c7b712a4eea82b192b1cec442ea4ca
SSDEEP 96:ej5SjOWK042M4b+hwKourMeuVQ4c6xGixpHaegpK2F0NoD/Z9/YeRTyhUd:eNczm4b+hlDkNxp6hZrWha
TLSH
T1E0426EE437164369E444657F1FDB750E66157F42CBA4A0088160FB2F157AD0C4BBEED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_UKR.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_UKR.chm
Size 13KB
SHA256 f14f22fb50bfdcc0925177f838708e7512ed7df8387dfc12179541cef15d9445
MD5 950c0228cdd5b7e77fb9c4652b42ddf5
SHA1 cdf32bb93006f0ea08b1c87977ecda9ae3dc27e2
SHA512 d1c702cdb3e69cb894af5767bd787acde1ca630d82d180d20e7ecedbf0a312cf588cfc6849473378e3f04638496838788decf85432810a16399ab98febca54df
SSDEEP 96:LKJ2ySWbWVrXFtIBCm56lQTiNlgVV+ND2Q0HYltDYVG5ZjM0w2kI7WpJU:LKJW4WdX/IB/klQTs12Q0mt8VKL7W
TLSH
T19A525BB5308E4605D67050BBBF4DF6C52431FD82FEA28A0E704EB77A3478A1C63219A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_UZB.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_UZB.chm
Size 12KB
SHA256 ef4f4946f59708cfb39a95ddc94d3ecc65b188a0660e7f0d8268585ba8bfcce3
MD5 409772699f707ff40ab616eb091a143c
SHA1 e172c11214336c320f91a226e1d82ad12688b1b7
SHA512 e0d1926e6839cb44246b4705a40750ed371d6415ba28239c439b8a2d516ee628a2f720e764391ed2042659975356e90967c7074c0d532293dcad5b14f84e7298
SSDEEP 96:pLCZGWqGX8g1HQYMMwZSZBROplixQzTDZameA3knxfH9n:pe8Gv6nMlxQHVaEEph
TLSH
T14A426D7972748212C43ED3360BF396CA56B27C41566851CA31097E5DA4BBD0F1F3F929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallationPathWriter.exe

Path C:\Program Files (x86)\Samsung\SW Update\InstallationPathWriter.exe
Size 76KB
SHA256 9a49d2b85ca9f571e08e0e3ccbee0da17b639b3b5ccaeb15df7b169b4ec61213
MD5 4890467988ed368e5b0da465ed78f7de
SHA1 234adaf3a1950aff6ec04d4097fdeb9765f3ffe0
SHA512 9f6bfd86cc89de6a779190577b50bd23e6837d8623c7c9bf7d535280f5c6b81cff2464c76cd88a94be95c9f4b84325493c8837267e98623b21355570ad8e5cb9
SSDEEP 1536:OQ0RGh9LUCU1+m7KTXbkk3/pMfPdscVqA:O3REREUX/pMfPdscVd
TLSH
T10D738B127AA0D037E493093049B4C2666E7F7A7157F584CF779803A95FE2BD02A7932B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWMSetupCustomAction.dll

Path C:\Program Files (x86)\Samsung\SW Update\SWMSetupCustomAction.dll
Size 1.8MB
SHA256 da78e73cd178829cdec5fcbd8837d850f615c7e99a340d8119bed2e072ff4af9
MD5 ed42059d3cbc3ed334682afb62286f20
SHA1 e0ce5730b5e9af5379c907cc949b473061051482
SHA512 a31c6d0deb81f1b2ebc04eb7a86ecb3e596213303fc096d5f7de0cce8a6764a490bb77372d7bc03eaa95d300214a89ea83c1f438a58e81240f36f29f57863350
SSDEEP 49152:ol69YhoYw1hh69F0GLVCnicVWXSFo2qMc4cxr53/NI0BlClF:oMYhoYwnh80GLGiuWX+AFXxt3/NI0W
TLSH
T1EF958D2375C5807FC56B0331991DB72C62EEA6B00A39D28766E9DF3D6D70842E638763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWM_ChangeShortcutToChinese.exe

Path C:\Program Files (x86)\Samsung\SW Update\SWM_ChangeShortcutToChinese.exe
Size 1.9MB
SHA256 8daa8598fa179f0a0da6acaaa8c6e7cd5d10f80c73b6c47bd16b025b385d38e9
MD5 b3081b9af05c1789263624667290580d
SHA1 3803f252004c4559074205374ac2086348e8dd1d
SHA512 ec3a55ba6cff8f7479d1994491f1305d362fbc968d981381ee55420cbea20a2667ea821d1d0502a58d59cb6118a3a23cea9b5f93417881da28b9b6fe9edd1b41
SSDEEP 49152:3fDZlp2fPUA96HVxAR4doutLuTQbdj5GqTE8kgoLC4juAl:37WUA9OVxAR4dZLK8dj5GqTE8kgoLF/
TLSH
T192959F3279E290B7D23327305A5D736862ADB7705B35479722D54F2E2DB0482DA2CBB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupLogCollector.exe

Path C:\Program Files (x86)\Samsung\SW Update\SetupLogCollector.exe
Size 1.8MB
SHA256 c01ccce6b11f345b130eed051b80b78d05a15aae5f6bebb3e56dac758de746d0
MD5 2c8e2a69caa4902d59ad2d845ca78cdb
SHA1 14878d029f63a2a3ee0fc3710478e85ddbd5e694
SHA512 2f476f3695f17d77294de969a123617d4b7c045dd6038df26f56a5e221f5088277a4571331f73f620349c7056c969d3af490eaf1c0ddc0d2ed4dce8473d4de0a
SSDEEP 49152:qLKpF8udK0IqsIrLl/4I6ssTQrdEw8HzDMBEiopuVcO:Nwu80IgrLlwI6sKCdEw8HzDMBEiopuN
TLSH
T1CC959D32F9D0D036C92303359A5EB32DB6EDF6B11B36524722951E7D2D70492AB386B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sManager.ico

Path C:\Program Files (x86)\Samsung\SW Update\sManager.ico
Size 269KB
SHA256 b3b02831d15640c83efb7a20e045deacb55a0573609f7ffb18b50b2e7083cd89
MD5 de8871fd5f27e83cb255da1ae3f84c01
SHA1 a4cb1157df8314e1d1f9b19c4c1d6298762b86a1
SHA512 cda4a5bd25424bc62417f47a8942ee464f00cc9b80c32fbe54e188fc638f3963af7ddec83a9f82cd5bd9299c15668877bddf32a2bcf1d8940a974f5716398fdc
SSDEEP 6144:ITtDdn9zN/ev4H34chKVEPGA1P1k43zlERGfKzzVAcj:ybn9JT3CW19kgGNXVAq
TLSH
T18644BF22B0068012D9D8E7F4458EDF7361549DBDEA803C0E35E9BB5E2CF1B6786295CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 cd995a7e311ee9818085071c7e1d986a93324d9af7acc9ae89b7a324b6630dec
MD5 03c53dc2aa1a4d8bc14efbb5eeaee9bd
SHA1 a2c902943ff5011820d54823bb1488d44755445f
SHA512 23446d4f10ea004f0b3ff1be7af15292c1b3e1b75a693191c31e4e9f57022ee97d71d234abdcf65f7fee46b4d79a85ddeaf4113b383b0dd1b45530ef384ce519
SSDEEP 12288:bmw5HEjsChNVBFgl0WDm+CusBR+SjuXdi0eNB+pvGFO1Ur+FAMHxTNqWfmdeOa0f:6wu4OW9sBxk80eP8WPQHxIvxDO3YR
TLSH
T13965F14A37A81CF9E6A782398593C636F7B2BC452625CB1F1360C75B5F37211AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3b4c19b66f97a640358580cbeb4201c1b0877a4bc8d32f4ea0617060f25268eb
MD5 ef98ce3458ff3bca4152282adf9be750
SHA1 7b6c7b63695ed629815f8cd81b0871e876c18c53
SHA512 8e5287c50de15a50bec439937c21a8ddfeb2014106735897ffbce34e1d3322e1eccf9a874f3a8f73e8cb0619efe30baa9fbb958d4e24159a79091c54cb0d1994
SSDEEP 49152:/B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glEkEPJ4HOvhb:Bu6Jmdxd2dEbx4uR
TLSH
T11FD59D13F2DA01E8D05ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 0154a4dd483b4db70238ccfa4d7c0c0b2374475d48148a562093dbd2029ac4d4
MD5 52656da90780c8db7b050ad812299e15
SHA1 52edaf0f640d74340ebbbd322808d27474880f63
SHA512 4460be778c6ea3aee06b191a1ec426d4a7a74b924b2f734b7fca7210ea8cabb89b9fe1dc52efcab00830ab1c26218c2f4408ac09653bdb1a5594e6b17815f45f
SSDEEP 12288:coOmyvvU3fa7Whhfwwq8wQptCj2+5OeADAaAfWt1v:coRyXUPaehfwwq8wQW75jAGfWtt
TLSH
T103452741762BD74BC6A950321E36D6CCAB70BC01EE485F0773C9873FD476668BAB5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 a9dcf82e36aba5507eff134e2fa6b5f3286eba637dd9cdbc1e5f797f3af9187c
MD5 21b52be1f005c139cf06641a5e29f506
SHA1 9387b4f129bfd5192bafb2c4cfc906ff8ab41e4b
SHA512 d22f4e93677ab35f5f90697da6cbc01a621124d49ce173d592fd3dd4163c97b8282a4ab7dceb60eb5ef09827a88d0465870243affa8023a3e935ea32434d2783
SSDEEP 24576:AxbX5KMS9MOS0fafwwq8uQEQAb2PpdtD9:QX5KMSWNfwwq8uQEQAb2Ppdt5
TLSH
T106452A01A5B7E31FC9FE5037433686CDAB745C06B7492B0573448A3C8866A7EB6E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWMAgent.exe

Path C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
Size 3.1MB
SHA256 07789938099f085cc4383e27def364bf954178f5fb973794754d1e4a954061e2
MD5 0c1b672620f907f9a09efe5376f5aa02
SHA1 9601f9714408fcf58d5be413b68edc51cef2db8c
SHA512 e72a8c35f84b144a8c9343519d57656963231754d83badb938507811733e25712dc51a08b5b9104b380028f2e3fec083387cec6e67e93582f7143f6adbc5687e
SSDEEP 98304:1AbyeR0gK1sILUp6Wd0KXOTz5FYx8TNUbfn34fVCmZ:eOseOebNUbfKTZ
TLSH
T137E5AF62B6D08036D5B302714ABCB3AD657EBB70673581D793C90E5C2E714C2AA39F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWMLauncher.exe

Path C:\ProgramData\Samsung\SW Update Service\SWMLauncher.exe
Size 24KB
SHA256 6e90cc1e1d2a503e327fe66f5448fc37fe0b7c895e54eaad28d167628874f224
MD5 0f0a896955e10b38ccfa02ab1826bafa
SHA1 97fd8c2961c088489cf2092c261aba817eb8aec8
SHA512 b8caa2e17a675201aeebd7229d9886904ad33219d4aa568cd330073e30116c916eaa283da1940da83f61b5f8dc7d7c45b1318400c39f8cfaad4fc69424f44295
SSDEEP 384:V0zQSoF0tNWGyGpDqCzEEBnYPLJo7onG5GEnh0z:HlF0tNWGyLCzEEBuo7oAaz
TLSH
T10BB24BC72E1A7023FBC38D7111E5D62A5D76F3E0ABE518DB74A892011ED5BE13A7900E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWUInterfaceLauncher.exe

Path C:\ProgramData\Samsung\SW Update Service\SWUInterfaceLauncher.exe
Size 2.1MB
SHA256 27c410592e331708eac9428b2fb1711288bbc899e1eaace5c3ef86b62900845d
MD5 3640ab14265b443ed07e4419d00e31dd
SHA1 2592352cf17fe8f700f17e008327822c943630cc
SHA512 764e36e3a2a5e34ac58481ea0071de1197a0acce95edc71fba9b8abb695b6666e33524a06339b9a03403537077a31d7292d4944c3d28259d4510e0ac380d6b1a
SSDEEP 49152:JJHYpDGg7hu/IJI7cR5ARKMG9x62nuTO3bIZxWwqH2mDnOof1gj:jEDGohu/IJIYR5ARoWO3bIZxWwqL/f1s
TLSH
T189A5AD32F9909076C5231B708B4E776AB2BDBF705A35129722D43F2D2DB0493AA3C567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sManager.lang

Path C:\ProgramData\Samsung\SW Update Service\sManager.lang
Size 1.4MB
SHA256 c6ad61669deba2ba3c07bfa16bbf7d193e514f1795fbc703a9fde29eac3c7cea
MD5 61e6f939c59498f2d5a6bbf1764d32d0
SHA1 97d8e91e5bd9ec2a1c787200eba8488066c42f06
SHA512 ad9c90657d99d57e0a96dd57e367371300394d01487c6b24bd45bbcb2ab50ef62315c489ca35c3d83280cccead2c7caec109ca637e0331f06b5b21eb47d677a5
SSDEEP 3072:BwbXFZOlEnTWKdSTQMV+LjK1/ayjckneBAJwB5gZJ9794n7HavQHMfwlz+S1/diW:tQKt94TQgt5zBT3rty25648awQ
TLSH
T181658A0272FD6029B6B37B51DFB8C5B94727BDE4A97ACE5F0191104B09E0950BB623B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sManagerSetup.msi

Path C:\ProgramData\Samsung\SWUpdate\Temp\sManagerSetup.msi
Size 17.1MB
SHA256 0448b9bee0a619769966f4e64de10634d7bd0442fcfb1990db64e58a0c5ddfa9
MD5 5b8ee67fc4c3506044596a60798ac6f4
SHA1 e56ff465dd8f30c72cc6ed1e0392ec2d071d9aed
SHA512 2782647666c2a7a8044f1ee8ce41300eb8cf517007732b97e153e0562693aa3d508b4896ad1e07a7100b8b4b6d2618bc646fc0d76107eb21c9be73a2fc11ad47
SSDEEP 393216:9TKT4l1MBkfJtY5guE+lch2I6hb8bvg96gNX6XoiicsWE4gUHdG1OEiPxDqwynF:9evBkRtpocMI6F8bvg9IoxdWPLHdPvPw
TLSH
T1E7073312B54A9131D5D957B142AEEF3446B53CB4D8A5241F22D0B70E3DB33B3AA782CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5951.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5951.tmp
Size 246KB
SHA256 1274cca896f0fd797b330e5ea4605a080da505b7e14ffbbf4181b61ac998c649
MD5 dd2fed15306cbb7f32245077364a8fe1
SHA1 57b96a29654e2ce235afcc209af63706341d2b7b
SHA512 02e7616d589cf697413071c14221d970a6992bb07eeff200094bd1abf01a00c47e49fda4e6fed0ded0fa88f1ebe7c355e8182ed774695ddb5523bce93633b6d3
SSDEEP 6144:XqdkSo9TbxFLiDFqhxqGHpH8QSZ69Jn+:XqcBJiDRGF8QV9Jn
TLSH
T1EF348C5277E4A431E0EB02307676A7221E7EBD72A8F0C50B67C4564D5D726C1EB38B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 433025ee024cfb2a2bf2523b71c37bbb832cc568dfa39713773346d85d5740a6
MD5 fbcf587ea13d0828a50c5400e3bc15e1
SHA1 f79f628d2130706c06b346d01aedb3e51c1a26ce
SHA512 61361b13eaf9e99637546a8b107841280b046efcdf77cf92e7f82f0efb68f610fae98259e8571910e5b8435b1ff5186ea011392fc42a95fd47e66183ff9b3143
SSDEEP 12288:8M7MsBR+SjuXdi0eNB+pvGFO1Ur+FAMHxTNqWfmdeOa0aqnO3YJr:dMsBxk80eP8WPQHxIvxDO3YR
TLSH
T1B045230D470D2663E257877150E2E7B4643E7EEC8386829FF201AB909EB4DC5DD3866B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b0e9994c8490aa969a2cfd5ba3bb57e03f53486319386519fe7c77bcc1475695
MD5 9af23c921de9febabbc9aea65756ccb2
SHA1 5320ce96e566e0de9f32c19c746fbb22f152adae
SHA512 ad4347b84da5245884b85b18618d64c32fbafef790d7d56789aca4e547b656aadb1a6224bf54ae0e3aceea32a6d910e9e42b17ae9d05647da4b37570513ddc67
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYOsBxk80eP8WPQHxIvxDO3YR:5gb4mBIBhGFGkEPJ4HOvhb
TLSH
T14065AE1E22EC02F5E1F6D2B8DDA64417D6B278160332D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c912db9c835a48402c123927e6c8546f2ae9901e85ade2549e61ad7763cd69e8
MD5 814191f76f2a0f8d4c9551af701d87cb
SHA1 f7ffef162772c4dc6e6c5828c7ff24ba9fb94d7d
SHA512 ad6997f5dd686b69f582360f62b36f19ee87a2477d04678ff4741495235a23e94a753dc1c582024780ec9e9f52b313d37f9d4eea81f3f5751473637cd0a45c10
SSDEEP 24576:HG88u8FpJqH1bzria7/mFsBxk80eP8WPQHxIvxDO3YR:m7ZFPqVea7/1kEPJ4HOvhb
TLSH
T12C85F16967E102F1D477D138898246A3F6B2B8250364EFDF07A88B511F33AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 45df68e35f0a201c6e4bbafd3322d1d0e6162e5bea79ab76e618b94b56ba4c42
MD5 3934435084fec1f34ec7d1dab79ee9b6
SHA1 d9cebad719ab60973c259973e924e12be336426e
SHA512 2aa0e6511c93f370c078727e7efd5d5d484df3d95b5632b970a244d1c42432cddd818691a63db227eb4b0825b314131e89b660540d338538d8716b8e85244de8
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6kEPJ4HOvhb:iG05lO43bnbx4uR
TLSH
T100D5CF6E62EC11F9D1BBC17CD9C6460BEBB23815032556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5e42cba4084a9aecb5809b50ad99591ab16f89591167a2a730952c35b5da80e0
MD5 bfe9fa367eb7372701d945f3c147306f
SHA1 283868b75d13a46dad7e1ae55da72f69638af15f
SHA512 4d078082477c00791716b3abfc779e85af6f70042b70fd731684ccdbdf62b54cd05b8cefe80f98a8cbf609a788093ba10e33d8d74213d27b1c4a701a71f65881
SSDEEP 24576:dfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnTsBxk80eP8WPQHxIvxDO3YR:ta5POZ3BJt2pasx2+mikEPJ4HOvhb
TLSH
T1D765BF5EA3EC01D5D1B9D17DC583861AE5B1342553329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3bbb04601235951f2dba35a12d517331c92e77e72493150261d2318190d6be2f
MD5 e77c98c4bb8e6d8f44f991568db96b5f
SHA1 4193f0e034079253f1e68ecf0a10404fe4d065ca
SHA512 5db58652884136a2dd1fd27cd7062b64082983b18857cf97bad6cd4f394699310fadc659d7fe68afb51639d499dcf0c7bfbfe3fa9eb7e6d30f422ddb2b7b6c16
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkdsBxk80eP8WPQHxIvxDO3YR:NNc/zEOVHFVkEPJ4HOvhb
TLSH
T10F858C1A23E901E4F1BBE1BE89779546FA717869533086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 1.4MB
SHA256 ca3f42b78aa915f7164964871f514b42b7a4dd01fe2bf92d6458e5549a5de4e6
MD5 b0f9b5cb471ce867209ad3e7f95e131c
SHA1 4ac823e3df1df6957168ac2449b699ebe85df39b
SHA512 71164c06b6d5c0f43f1411ca18b65ae8db4f599978bf947bb0e54795d8bf618a5cc58ba4c458e80e5424de8b6e654ee27ae827d26e55b86451fea7bd298eb5e8
SSDEEP 12288:2IC0wHGLYRvlWaEU6ohtqzvfm1N4wKBQwZo5oYdaku8puwZ9C3jCmklF0yBn6XWQ:1CLHGL0MoeutFumTijCmlKQWDk
TLSH
T138651805A7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\System32\msiexec.exe
Size 176KB
SHA256 5872fe75e96a1c653972421c5874e19ea6181a08bed623c269fd3576c2bb707e
MD5 faa90dd7af5633802f27756d367d3d44
SHA1 0e8b428b24ae565b8e23dea2057112f159c76312
SHA512 eb2dd2c707646c71fb097f0519cd58f713f365c2bec3d2c9895132dd637738680681217cd1e292c5bdefac34dcc3bfbe5e0d48493be5edf1984ab30c0f6d2cdb
SSDEEP 3072:Ej0ye5GMUn3ONeq2yjTx4r/46Vx3Ix3V8xOTIKOZDBZcBk:00yF3OstF46b3IkxsIKABZcy
TLSH
T15B049E5E63D424E9E03A4234D966822681B1BC32177596EF32D8967E8F32EC4953FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 942dfa34ec71214337fa8926eb7765d08ee617d421f8e3716d43e70f600c0eef
MD5 eec93189c4a81931441521f413fb781c
SHA1 2b882a22ce911e7b8949cf268b20e2bdce0a9f99
SHA512 db2fe841a057b5c607002ec8e580ba8ebb119fc767bfeb8b83cc2b7d4154b37f77a3dc92ac3a7bd4e877e5639b4fe6f670ad3c0b1258cb6c85163fb602d6fbc7
SSDEEP 12288:ZHvUrBFrEjwaQRsBR+SjuXdi0eNB+pvGFO1Ur+FAMHxTNqWfmdeOa0aqnO3YJr:ZPUr+NQRsBxk80eP8WPQHxIvxDO3YR
TLSH
T18065E11F22AD18E5E676E17D85828719E7727866031292CF02E0817E4F77ED8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 55551210480ab2f85dc07abdb99b9a445830251259c3ad4ecd486f74fd6838a8
MD5 3af61d6ccb94a27dce1911ca0d8ea751
SHA1 209edc445730c83f17a0497ebdf59f389683309a
SHA512 d384700652a6116d676923373bf2e44de0ac9a2a0b301c0d0042121bd5784bee01b68c00b5802cfb56e9dfb3782a349dd61f0c85ad3306427f2ef347a165b91b
SSDEEP 24576:qFo3DMPmY96/adoO/vveQqKC1gP7egB7tZUHMo93Uy8PE6JdrasIBm6jgb+O:8Ma
TLSH
T11057A31437F92140E7B79E3CA8F06A234D397D5BAC19DE8D45411B4E0922FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a358f893-4241-4e2e-b7e4-312c33947a42}_OnDiskSnapshotProp

Path \??\Volume{cba08e50-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a358f893-4241-4e2e-b7e4-312c33947a42}_OnDiskSnapshotProp
Size 6KB
SHA256 f670f7281e0d0fe3df09f9a09a4a5ed6fffdbd1bd936330a76b6528f6db21e73
MD5 b9e1958e2ea58fe9b1776cf2690592ab
SHA1 60262138ecf3956fe7d75edf60dd8f6cb7d38002
SHA512 a6dcfb57d928da938d112e2703ced468899c1c42a3526d2c6b8357eb2c0ed09f1f95596ddedb95fa1b94520f4eaed24414089a9a8c7f05a9b215c5865adb3170
SSDEEP 96:FBMSpnavc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Pkb++uVm
TLSH
T13DD188081AE54711E2B3AB3229F18557A877B911FF33CB8E0198638E2671910F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1476-337-0x00000237E6150000-0x00000237E6AF4000-memory.dmp

Download

memory/2900-51-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2900-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2900-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2900-243-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3132-0-0x0000000003B60000-0x0000000003BC7000-memory.dmp

Download

memory/3132-479-0x0000000000400000-0x0000000001DCD000-memory.dmp

Download

memory/3132-106-0x0000000000400000-0x0000000001DCD000-memory.dmp

Download

memory/3132-5-0x0000000003B60000-0x0000000003BC7000-memory.dmp

Download

memory/3132-10-0x0000000000400000-0x0000000001DCD000-memory.dmp

Download

memory/3208-471-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3208-469-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3208-296-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3208-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3208-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3208-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3292-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3292-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3292-132-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3292-134-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3452-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3452-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3452-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3452-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3536-12-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3536-20-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3536-19-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3536-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3536-107-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3812-43-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/3812-49-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3812-37-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/3812-47-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4336-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4336-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4336-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4336-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4336-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4996-114-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4996-120-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4996-311-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4996-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5544-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5544-104-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5544-98-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5544-294-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5544-295-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5736-77-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/5736-291-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5736-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5736-82-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/5844-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5844-66-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5844-72-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5844-284-0x0000000140000000-0x000000014020A000-memory.dmp

Download