Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 03:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe
- Size 2.5MB
- Sample261024-d8dbdawz3j
- SHA256 a4ddab1471466fbdece1aac9b58d5614612b304c7e0c72cee8a022fea4cc70bc
- MD5 986f85ec65df407ae6358e68a0e2b986
- SHA1 209281395eff6caad985069a38c8428a187dd251
- SHA512 2469d0b737cb451411e65dcd8448e80a3005a82630c2188dc37954f07ddc162a8cfdf38987b0a922c91322164167b3e3b50ad7eb5b0a8492ddef4bd8b193dd9b
- SSDEEP 49152:HK5/2Emx3wO699I8OpTNpTGuG7YaAKSsGJ6gg2k2feshA+IdkhjU/QUSI7w:KOEmxw39/OpZpTGurKOJ6gg2k2vQdkYY
- TLSH T16AC5C031F990907AC63317319F4DB3A877BDFBB11A35024732951E6D2E70887AA29763
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe -
resource yara_rule behavioral2/files/0x0001000000009323-214.dat upx behavioral2/files/0x00010000000093b2-218.dat upx behavioral2/files/0x000100000000994e-222.dat upx behavioral2/files/0x000100000001b987-234.dat upx behavioral2/files/0x0001000000009cd2-238.dat upx behavioral2/files/0x0001000000009cfa-242.dat upx behavioral2/files/0x000300000001a29e-246.dat upx behavioral2/files/0x000100000000b972-250.dat upx behavioral2/files/0x000100000000df1e-254.dat upx behavioral2/files/0x0001000000009fd0-258.dat upx behavioral2/files/0x0001000000009b8e-262.dat upx behavioral2/files/0x0001000000006211-266.dat upx behavioral2/files/0x000100000000a04c-270.dat upx behavioral2/files/0x000100000000ba3b-274.dat upx behavioral2/files/0x000100000000a0ca-278.dat upx behavioral2/files/0x000100000000b94c-282.dat upx behavioral2/files/0x000100000000a1d0-286.dat upx behavioral2/files/0x0001000000009369-290.dat upx behavioral2/files/0x000100000000a2bd-294.dat upx behavioral2/files/0x000100000000a300-298.dat upx behavioral2/files/0x000100000000a315-302.dat upx behavioral2/files/0x000100000000621f-306.dat upx behavioral2/files/0x000100000000bd4b-310.dat upx behavioral2/files/0x0001000000006276-314.dat upx behavioral2/files/0x000100000000a028-318.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe Token: SeDebugPrivilege 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe Token: SeDebugPrivilege 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe Token: SeDebugPrivilege 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe Token: SeDebugPrivilege 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe 5956 2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_986f85ec65df407ae6358e68a0e2b986_bkransomware_darkgate_elex_maze.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5956
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 95f052951e5079c45b4cc5228a4facd126ec198ec1ab31082172cfe1caa3a754
- MD5 292134a1d2ed27ac253f513f23dce628
- SHA1 2069ef07451856a9a280eda7c2d80226b6d178e1
- SHA512 f48172064b0f345802d78993340c534e723b2d9a90792c85a9ba47341b2dd552c701d7833cd91e03ca611cfef3043c8a17a561a298e8a244483b539635341029
- SSDEEP 49152:8b+632BuPkFKRrdE6oh7stBhuXjfS4LWxn9hjU/QUSI7w:m3q6gjB+YjSI7w
- TLSH T13CE59D03F2D900E8E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 f10a2eb9d97d11b7b3755dc055a00a1bef3d58e631431f591bc72d508fe1c9ec
- MD5 ee866f7cda318cbf3618858b84c0e16b
- SHA1 9587c0b7ed60fadddcdd30a4c1397f8fdc11b882
- SHA512 9a4ccb238901a7701ca1783bd1cde920b9e07a2996040a9683140b041706f5f53b3e2b59dc4bd624f2afdee7a33a328afb9287571ae403a1dee931e2282ff603
- SSDEEP 24576:kXYgDRczA5htNF5gnh/RyShsESwrqIf9xwFo:+Rc4hjU/QUSI7w
- TLSH T1FE250228B7D458F8ED6B427CCDA2C511EA7378954360E74B43A489261F232D85F3FB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 997KB
- SHA256 9b9e53adc74e1caebb0ef9cba3743052cb41d304b1370cf01bbac7d52a0dc861
- MD5 5047b5c3e5bb6345c51ff6e8328b5a3e
- SHA1 f71ccad6578217cb3675e6e62fbc94f380f348d1
- SHA512 62d7a245b1ca07a87f92f3ab1742d99d49073be230fa9a5ab6310b60e312c252c9dd29a2b4e70a75c49724a11cf54835ce592d7b720839a90266775267abab00
- SSDEEP 24576:3wutOWvhtNF5gnh/RyShsESwrqIf9xwFo:3w2OghjU/QUSI7w
- TLSH T16B25024576942CF8EA6742388697D132F7F2BC422621C71F5760CA5B5F33261BE2EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.8MB
- SHA256 8f55ec913313e9e6d67920db29cc4949c297f94eb98000157e24458b8566013b
- MD5 43c7d942076570dddacc8f99d24a7e22
- SHA1 1d21686a1c30f26bffe075304d5ac1524ba1a54d
- SHA512 8c669f9b662bb2b295f8261c7bb1cea88d7d75b7166ae32ad93d10d5237d01012861aabc99c59a620e28f35865cf576e5c307d67d6848df4656c0e710bf98ff1
- SSDEEP 98304:9QRQyi36YOcP8Lvw2gAf+PN3j7UUfc9etuGN:0QyiKa+X+PNz7UUfc90T
- TLSH T1DF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 f7f17c582cc852a758947ee05f9a4b35bedd1433d074f55a80faa62975b2d4e8
- MD5 d70f5d7d93351316bf7ac4a011cecdd4
- SHA1 43e83869a9d24abd7d5bcdebe54d114485bafa67
- SHA512 db147eb84ff4559ede67c33b9d19d0d79496e1b8fe5811704d1bcdec3e80aa7650c7a3f32b3a000044dd16159271aea713e5ea8b897f116ba20f271021390a50
- SSDEEP 49152:2B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glLhjU/QUSI7w:Eu6JmTxd2dLYjSI7w
- TLSH T1C2E5AE13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9077562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.2MB
- SHA256 0c196464cc01e3545465d2cfb0c2af5247b22f9ad3858f9f3eab4b5f54589e62
- MD5 ffcb929bc4e678e6cf87e4d9930c805e
- SHA1 fc91d43b95f26b02fab4e53cd00a6cfa1babc2b4
- SHA512 ff622aabe691cf20d1ae4deb104e7f17979808863d68706a9fa0159122901a8f23a6701a6cd3c3b7b7ceca122e3d256a1bb5d26de8fa6addc06b60fdbd8febfa
- SSDEEP 24576:nPwvtk9RX6wkyAIYhtNF5gnh/RyShsESwrqIf9xwFo:cMnYIYhjU/QUSI7w
- TLSH T1C645E029EBC854E5E177823C99F34646F6B178695B31C2CF0259536E0E33ED4AE3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.7MB
- SHA256 7703c96d44c85b1520f6cfdbda2f61cfa3aaf1e2d23188a78690108c22759f2b
- MD5 471ef231ae5cdc3378452f9fc7bc2cce
- SHA1 2f179a16f62b8ac0d09603b3874dd290b0d62a51
- SHA512 d6a6a0fa532eaea7587f17bfc5cc24bf9d180b327562abf729cf4135c07e5a5ff66dcb0d371a01b52a1df4ab904c80686fe9666c6ce996f06b58a9e71cffa89f
- SSDEEP 49152:RYUwNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0KhjU/QUSI7w:4ySzPyYjSI7w
- TLSH T1C7067D56A1A841D4C1B9C1B98F1BCC17FAB134490335ABEB03E546935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.6MB
- SHA256 001870d545abb40ae9023d6aedfa49592c2a92eb0e3e21894078f947c2d1fcfa
- MD5 eaf142cd0e0b4974cfc30691f8e57ed0
- SHA1 9dddce5138c08ef7e9f790040637e0fc6a66916a
- SHA512 8b14695e10209f9af7f9da0d04626c704f7ad831195bd83c3566e9118748d2b3c3b9419d706e26e1ceb3fc1e34621f452c6095f16f214f566bafe6a62daa46cc
- SSDEEP 49152:W47JUQjXirIhCnDHUPfF/ghjU/QUSI7w:BJtglD0PaYjSI7w
- TLSH T15175BF1DA3EC01E5E1BA827885558A5AEA71782E1B31CACF1270437D6F23ED45F36F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 32b204f21b232dcd27ff27d008b5c4efa55309f1fd2f2382e5c3d09eef9fcb63
- MD5 5394637563d14baaadbab7e242033f33
- SHA1 c0c57cb4c1a0cbd4e637877d17c8e1a433e1336c
- SHA512 ecb1375e52a79f95ca2f497c0a863753ecf247a0a2096482783af84ceb9b4a29f9c07943d4b350b7ef6d3a8bdb72f39bdadb14f9804ffcea834b1645c137c3ca
- SSDEEP 12288:DU7rhObP4j7vYHKqq/zjsKFL5++oo4Vph/214F494hsmFSwrqS4Af9xwFpy:IrhtNF5gnh/RyShsESwrqIf9xwFo
- TLSH T174052311EE49F478EB3C06F42AE7F1A06878BEEAE710C157ED180D5225704D8AF37996
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.6MB
- SHA256 3541df82b0fb81efc634486cc81881b0c7a14a72be090ea1542544b89e76d534
- MD5 23577641b6863583f6d3f3ffeef124f7
- SHA1 6f9f447a9ed24b60304b62992ad496c778e9ff8a
- SHA512 ae564bceebe2fa7cf0e970ace4d83a4fe5eced7c55b1446a730323ac7499e1919949adf90e1b1e6901930d2275736692778fa7e640ce28e63e23168b95755e30
- SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bYWhtNF5gnh/RyShsESwrqIf9xwFo:2gb4mBIBhGFthjU/QUSI7w
- TLSH T13B75BF1E22EC02F5E1F9D2B89DA64417D6B278160731D2DF1151423D2F3BEE89E3AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 aad38629141ba589ce1740bfa34c2b98b55900189515c13643ad6afe8846fa2f
- MD5 b57c88e1ac406d0ebd195772fc43255d
- SHA1 41f2c3ece743fd8c74e1d543305d75b65f642841
- SHA512 213ec7514f900f0f425620ae9d5b2de6211be819f8107da15161a8d00775c9c9382aedb6a51ace180648c7d6e83f5be2794a7be7339acc5015ae8bf0b8e93d9e
- SSDEEP 24576:aTkNvNnaFeYhJNtmZBmhhtNF5gnh/RyShsESwrqIf9xwFo:aTMwBtOmhhjU/QUSI7w
- TLSH T17075B02EBAB855E4D1FEC6B48D238512E6727461173293CB9390C13F0E679D89E36F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 832KB
- SHA256 541457261b78f499a2c121d9372be1da453ae3782dd3be149dbda218be6d935a
- MD5 9a1853f9f34c771c11767cdc7c233b9e
- SHA1 08334cdfccfc3920a2bde5bd2815750858a91081
- SHA512 e5dffe336f04bcc0c063916714242e978f5709a4a6462a491fe5cc7bcbe832e09af944329f0dc120e488727bc0deea0f9a590f5e52c488fb47a45f0425c6a600
- SSDEEP 12288:IKGhhObP4j7vYHKqq/zjsKFL5++oo4Vph/214F494hsmFSwrqS4Af9xwFpy:PGhhtNF5gnh/RyShsESwrqIf9xwFo
- TLSH T19405231C7996B0B8C73D46B86AF2A091787079A5A31092EFCDA48C325B604E47F3BDD5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 796KB
- SHA256 8b9c902837b73b4935939593cead7ca6353e7b83ddec045a5711bd101d935ae7
- MD5 c305544ea780eda342eb7bb30f39423e
- SHA1 ddd5c2bbb63e0104cd601cabf4e4c6efcbca4ec3
- SHA512 f09f86a4344c3ea06917f6b6fd2701264325f163f25cfc34f329714e284fd56661e7c961f6435952bc331f7606050a7d0a31725fd10e3b28cf026e0b1a59400a
- SSDEEP 12288:lohObP4j7vYHKqq/zjsKFL5++oo4Vph/214F494hsmFSwrqS4Af9xwFpy:lohtNF5gnh/RyShsESwrqIf9xwFo
- TLSH T14F052354AD45F0BCD72C0AF82BE3F1D06864AE9AE35182D7ED280D1256600EDBF379E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.3MB
- SHA256 61aefce732b07ee7ac90f55584ce693f101290f18355ac2322f9f9647a58ac96
- MD5 5c1074c2a94c85c5eee99be2d2de8cee
- SHA1 0ad84462e3f3a3ff960f50a97fda67db683362bf
- SHA512 1fbe3ccf0af98acc19db0aaf29935d55925baaabdc350231141ea901c1e2b2ab7c8d04f1f38480292899e7fe8a3ba0e42cbc53b00b8c2857931139643d5087f8
- SSDEEP 24576:Lyy8u8FpJqH1xzria7/mvhtNF5gnh/RyShsESwrqIf9xwFo:OBZFPqV4a7/UhjU/QUSI7w
- TLSH T10D55016576E111F4D47BC1388A8246A3F6B1B8251360EBDF4BAC8E511F236E54B3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1000KB
- SHA256 cdcbebae7f8e23c09c9929f0592b3fb024b1df302541183979c13bf8fc26103c
- MD5 3cb87fd94f50618b8a2a78ed1b3715a7
- SHA1 ee3a6f92ee63e7e3c5b375aad022a235b80e41fb
- SHA512 4785029d5bde331ed31d371fadb4b9ddee2b568a0c2824a115e48ec80facc54302bf75fba079069559af57aa48e7f57782666312ebf175ba439d2926d563362d
- SSDEEP 24576:vPUr+NQ8htNF5gnh/RyShsESwrqIf9xwFo:vJQ8hjU/QUSI7w
- TLSH T16525021F669D28F4E77A917C8A829215F771B8621311D2CF02A0817E5F63DE8BD3EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.8MB
- SHA256 a25860b24c5e44ea90b903e4c2d0f77b9ac5714660631cb3d362039e4c66c872
- MD5 b1b54e940639d1e68e8153bcf886a769
- SHA1 02b89c753913544cf21f2b50c6d37a094cfc91da
- SHA512 8c276319ded5bfc4a74bc82bfd3bd145d2490c43a9a14265ee6c02894f5a79e114af722fe6fc28eaa2ea2d8a62c9eb894cdb73d16f581d898380bd8ce8c20967
- SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjphjU/QUSI7w:BG05lO43b8YjSI7w
- TLSH T1A8D5C06E62EC11F9D1BBC17CDAC6460BEBB23415033556CB02A486A91F27FF46A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 fb853ba275117302c0896164ac5a01849e51bd995774a462b2e78b6b199f8a93
- MD5 38f27023c86a48fff938dcf0f6c8032b
- SHA1 c544e35fe84df7789274ec8af00e0e00f2328866
- SHA512 e0742bfac56e82b188ba6772fa01f17debb3204e9a36e5a1b06bf2088a43e8bd82555c24fadef5e4701cdfcab521f105c0f8cb018a31fc86398d3709d0f8e718
- SSDEEP 24576:9Ka5POZ3dpbWVM50JicR2hG0lasx2+47eidnIhtNF5gnh/RyShsESwrqIf9xwFo:Qa5POZ3wJt2pasx2+mKhjU/QUSI7w
- TLSH T14775C05EA6FC01D4D679D17CC583861AF5B1342653319BCB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 996c19e7aedde549d045986d6ca9a1f8b89b5fa8937a668cff191a583f1f2465
- MD5 4de31e7905d1488343e5ea5dfbd02240
- SHA1 ac61dee0275d3bd18496875e7a4ddfda01f65500
- SHA512 395896166257db1cf14c72b18d9d0ffabbce5b12619b0d85038e360dd196b52c7978260568cf5c0fd91973b27b0f60d1db05a0d4219e569eed0a2bbe047d7598
- SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fk1htNF5gnh/RyShsESwrqIf9xwFo:FNc/zEOVHFuhjU/QUSI7w
- TLSH T1E1959C1623E901E4F2BBE1BD89779546FA717869533086CF0291851B1E73BF46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 1.1MB
- SHA256 aaa565adc660e209650efd3e97953be621e3ed80098af99b92589c5ce3efc689
- MD5 4cbc4f2247736c9dcb0ce0a7a5ecf044
- SHA1 dc6e7ae28189a0f7f95872d9ca33b68b1c0293fd
- SHA512 2d6dfc14fee5007f963c0ecf492f760eecb84a77520784e76c9ef58d97fcb8e289310e7a250367af5a11d51f1e067de1a8c4940a16cd746769c31b7b11b03f6a
- SSDEEP 24576:oD3FHshBIYQgAPhtNF5gnh/RyShsESwrqIf9xwFo:oDVHeBIAAPhjU/QUSI7w
- TLSH T1AB45F23DEA5C10F4E57AC1BCDAA38502E67138AD032256CB469481B61F67EE47E3EF50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 48f37d4745b9742f2910e6c9e15576e660b68adcbc146bfa6c80203d28979c45
- MD5 ca29f6913b62d054d90a8ab4d12f964c
- SHA1 7baae36eea2bfd5a83a1b064478a5b91d940d2a4
- SHA512 a8da3bc46f59a5ab3545411b73f0c8f77cc7e64feab30392265934797c051a10b4982e5b354ae2db5d33d5f4b9a88c4bd604762b85608f9703d3454aa9b0465a
- SSDEEP 24576:OJnJPbzB4SIhtNF5gnh/RyShsESwrqIf9xwFo:OJnJv6SIhjU/QUSI7w
- TLSH T1AF35F13DD29820E8E4B7C2B4815A1795FE31387D2F2169C759B4D4353F12EE0AA3AF58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.2MB
- SHA256 299fce78c1993d2137b785f593599c54d1302753b83223a2821a6ae29edb4b62
- MD5 3263cdc804195765e9c1c33ddba83de8
- SHA1 5bc03ae74e56502959dd49942abf5423459f0bae
- SHA512 53e5a1b8eb73c19df70d4a4f7e9b3fd8a0576082a1142633291db41e6a7ae3401434d3f4efa23e2a14ba3ee2e99492e3f2be5134da0b5305d4b051366762b6e3
- SSDEEP 24576:OCLHGL0MoeVtFumTijCmlKQWDkOhtNF5gnh/RyShsESwrqIf9xwFo:OCLHGeeV5ijCmlDWDkOhjU/QUSI7w
- TLSH T119A57C05E7EB5184E9F3CAF4CA2294169A327C549B34F7EF4E80C96A1E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 948KB
- SHA256 616861987efe042ae760e556a9651559e74763f51797d6e207d970c6e3692f0a
- MD5 7ffdb0af93c9fe1b8c8f488b621b4a1c
- SHA1 43b957c00158127ac7a5198c3b7757beb5b5384f
- SHA512 3cd0633b13d15eaf8ce0eb72b0ad875ff3b609a5f6bc7b460824598395c392d2b109490852bb75ded25b3890c8e348ac3a1d965e59f4a09d9f125b33c0008fac
- SSDEEP 12288:TuHck6j5ZI78hObP4j7vYHKqq/zjsKFL5++oo4Vph/214F494hsmFSwrqS4Af9xV:86DIIhtNF5gnh/RyShsESwrqIf9xwFo
- TLSH T10A25125C736A20F8D26B803C96834141E5B1B5B1D31256DF4A98C97A4FA3DDCBE3EE81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 932KB
- SHA256 02184103425376a5ac3ffabe8ff5e197821525a7ef470f5dac3f6b1a9fb77cc5
- MD5 7c93bcfaa5a24db617a956aca1b88db8
- SHA1 ff0c399c612cd28b4254d318ef898622f70c6fe0
- SHA512 cbf61459498405a06e8b73e8cf7fb3ea2d09883fb4bbf374124b97b6f472e844ecd27b6dab6e438e1372a7782928f8517f28dbd66ee2644549ae1c4526448195
- SSDEEP 12288:PG6kyuzchObP4j7vYHKqq/zjsKFL5++oo4Vph/214F494hsmFSwrqS4Af9xwFpy:+tydhtNF5gnh/RyShsESwrqIf9xwFo
- TLSH T1541523046784B0E8EB7906785EB391D09D34BC61A72183DF99A09E3E2F316D4BF36B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 940KB
- SHA256 7729a6d683f3682b6c58f201fc44b5488f26a23e4beac6b31e55eba58f0a3d95
- MD5 ea210ff5e351e9cccae5a46d31761502
- SHA1 88b8738869edae5228c44d1ab80c466dbd9f503b
- SHA512 91a0a236452079ac51629ed3fbbd1592f9eb776dfca09542baf87628729b62ca85c844fffb9349043ea26e2611416788bf2bf794b767712d31307df139232680
- SSDEEP 24576:O6Uqjp1htNF5gnh/RyShsESwrqIf9xwFo:O6UYhjU/QUSI7w
- TLSH T18E25234D6AC470F8E6390274AAB2C1618470BCB6537196EFB5D88D3A4B309D49F3FE61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 804KB
- SHA256 9214d2571a7ba0cd81ea8d267ccf72e6bd01ab59d8d93ab74d470866dd4a652a
- MD5 02f4d26ea1decd32c9bd9f58ae3b9ffa
- SHA1 c32bb6e47d05eaaf235d2c2c620b018ec9768a41
- SHA512 2d6f01525f083ba1595c1c22f65f34409449ef424ad329f2738f2938bea9aa0908cdc2f8425d2d8a8b43bf78b6ce9587a7508d95b8727c1352c55adb7683872b
- SSDEEP 12288:HPXhObP4j7vYHKqq/zjsKFL5++oo4Vph/214F494hsmFSwrqS4Af9xwFpy:vXhtNF5gnh/RyShsESwrqIf9xwFo
- TLSH T162052358AD45B0B8DB2C06F82BE3E1D058747ABAE71181DBED684D325A600D8BF37DD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 0da86d3561a787b9c1eece2ab51116037a06c31eb86e2849ee13e569d531238b
- MD5 fe8b0f217bcfb4ba1d39ea4fdb25e73e
- SHA1 67f47eef22fa5c11721022ff60cfd3f9fd8734fb
- SHA512 f16a591570cf7b451981ac3da05470a74dcfc55fed5bbf53926753b8a1d2f30771888632d99d1de8358c57b3877e189d627e547e1c1042dd70bfeb0cea4a46b6
- SSDEEP 24576:iQg6LoTfaidZ0htNF5gnh/RyShsESwrqIf9xwFo:XgJTrZ0hjU/QUSI7w
- TLSH T18B65AE1DA7EA15DAE2B2D275D8731493D633B4315372C6CF2448C03A4DAAED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 964KB
- SHA256 754913d4d2c3a58c2e20750a9322d907425e7044fda21f84c5fef63f3464e6fd
- MD5 c3f88c9637d0b53149ba8f186f556d1b
- SHA1 311ca91f83c7bceb2c062acf489b899b2d380545
- SHA512 9f4dd6cdb19386ca17a5372b1711341573fda64628d18642b0ca59f4539bbac29689f5ca4bef07043aa12fe280ed0213905d085e42ca1299960c901fb9635ff0
- SSDEEP 24576:2rcmR5htNF5gnh/RyShsESwrqIf9xwFo:AcmR5hjU/QUSI7w
- TLSH T18C25010EB66E20F4E27B817C89828141F6B37471631253DF86A08B7E4E635ED7E39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.2MB
- SHA256 7322a29e2c5c36a82c44980d159f5a5d87eba5eaa6e8ad3625b93687bafdb9ad
- MD5 12c4795179a208b3c2e7eb3675d6d8d4
- SHA1 ee8f4d81a576c6e72875b36e8c0f7f3ac308a416
- SHA512 0230ef99d39f8badef735f35681a4b43164b2bc88fb26976984fb0211ca2e4dcdff2610db882a6b2a632746f2153481ab7ba7f5f78a0ce867f062859ae68dafe
- SSDEEP 49152:rDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3KhjU/QUSI7w:A3Upow8sBfYjSI7w
- TLSH T139B59D3DA2E810A8C9AAC379C54213A6EA71782E3F3015DB0174C578BF1BDF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH