Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
19 signatures
150 seconds
General
- Target 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 1.6MB
- Sample260415-rmlbragy5j
- SHA256 3761e17f2da52c5a732b8e0e13d0bb733a332753f00379a074cdc77d7ca22d08
- MD5 1c32d3f0e468c18b164546f101e7dee4
- SHA1 332cec5d64eae9cd46e8a7678011e3e03aec184f
- SHA512 2818f40c6d29d620ef78a7e07c2e9692133883b7a8f54c5189f6cfeeb4c09ba85b50bb10df1c57157baaafeef2a17886706f20e3bdd528249b0fce9fee4c499f
- SSDEEP 49152:Zt7Olywel0x2F6rD/sWuLNiXicJFFRGNzj3:POKl0x6iE7wRGpj3
- TLSH T118856B1267F94129F1F37BB1EEB993645A77BC61AE39C50E5280125E0DB4E80DA32733
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 23 IoCs
pid Process 4476 alg.exe 3056 DiagnosticsHub.StandardCollector.Service.exe 4888 fxssvc.exe 1832 elevation_service.exe 3820 elevation_service.exe 1648 maintenanceservice.exe 1348 msdtc.exe 2828 OSE.EXE 972 PerceptionSimulationService.exe 2532 perfhost.exe 2988 locator.exe 1556 SensorDataService.exe 3364 snmptrap.exe 5032 spectrum.exe 3732 ssh-agent.exe 1748 TieringEngineService.exe 4512 AgentService.exe 3676 vds.exe 2164 vssvc.exe 988 wbengine.exe 2576 WmiApSrv.exe 3720 SearchIndexer.exe 1496 Reader_sl.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\e: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe - Drops file in System32 directory 42 IoCs
description ioc Process File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db spectrum.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4b859407932a944.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\java.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaws.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Reader_sl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2696cb9e3ccdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce48cab8e3ccdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000155bb3bfe3ccdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e26380c0e3ccdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b047e9b8e3ccdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3056 DiagnosticsHub.StandardCollector.Service.exe 3056 DiagnosticsHub.StandardCollector.Service.exe 3056 DiagnosticsHub.StandardCollector.Service.exe 3056 DiagnosticsHub.StandardCollector.Service.exe 3056 DiagnosticsHub.StandardCollector.Service.exe 3056 DiagnosticsHub.StandardCollector.Service.exe 3056 DiagnosticsHub.StandardCollector.Service.exe 1832 elevation_service.exe 1832 elevation_service.exe 1832 elevation_service.exe 1832 elevation_service.exe 1832 elevation_service.exe 1832 elevation_service.exe 1832 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeAuditPrivilege 4888 fxssvc.exe Token: SeRestorePrivilege 1748 TieringEngineService.exe Token: SeManageVolumePrivilege 1748 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4512 AgentService.exe Token: SeBackupPrivilege 2164 vssvc.exe Token: SeRestorePrivilege 2164 vssvc.exe Token: SeAuditPrivilege 2164 vssvc.exe Token: SeBackupPrivilege 988 wbengine.exe Token: SeRestorePrivilege 988 wbengine.exe Token: SeSecurityPrivilege 988 wbengine.exe Token: 33 3720 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3720 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3720 SearchIndexer.exe Token: SeDebugPrivilege 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3056 DiagnosticsHub.StandardCollector.Service.exe Token: SeDebugPrivilege 1832 elevation_service.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3720 wrote to memory of 3120 3720 SearchIndexer.exe 106 PID 3720 wrote to memory of 3008 3720 SearchIndexer.exe 107 PID 3720 wrote to memory of 788 3720 SearchIndexer.exe 108 PID 3048 wrote to memory of 1496 3048 2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 109 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_1c32d3f0e468c18b164546f101e7dee4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4476
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4244
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3820
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1648
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1348
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2828
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:972
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2532
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2988
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1556
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3364
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5032
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3840
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3676
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:988
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2576
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3120
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2800 2796 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:3008
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2840 2836 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵
- Modifies data under HKEY_USERS
PID:788
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 1.3MB
- SHA256 418202e34ab8a2d93b91afef40e7d88ff32a9a2b6e1963587654670b5e9f3b49
- MD5 505975e719e7d8281b200a125fe06137
- SHA1 16dfd030d111c597c40716d4a0717920f08cf06c
- SHA512 1f737190f9b938eb093122c18df529b2e2cad18e63a14440b69d1e918dae4f38481cd5c9a09bb11aec2c122bcb03049aadfa7b3791d06b2060cd7d64b90d0fa3
- SSDEEP 24576:AQ//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:F/LNiXicJFFRGNzj3
- TLSH T1735523932A869B72E9B8003509795B78E0ADDD38DF151AE393003A1F957CBD78E3512F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 63bf9700c457c0c6cfdcdd336a47bb0b7908dafddd38952cb20e954f00bce9ef
- MD5 16c297c5f1d289d461c52cec6727e6ff
- SHA1 a49a0f6469aea18501c7a20e3ffe9434b1c5fc4f
- SHA512 ff0ca475ae73b72e8eaf3e3bc5e160e91840f7b14a4dbbf4203e015f74bebfadee98cddcb452ffd482d00e55591a213718777bb301de7884b95e661c797f0cdb
- SSDEEP 49152:4b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnYLNiXicJFFRGNzj3:S3q6mjB37wRGpj3
- TLSH T101D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 04acee63503903652ab8ec97cd7f1f44c70bf6545ded7f0728d47ee45efb8218
- MD5 0c07ecf197baa122eb562184bc79852a
- SHA1 afbc8810e67b68258e8c2917b0f3da5826839800
- SHA512 fdcce96e90c409c63010f3445c453d98e9d5a99afa45434fa1c21348be596817c364877aef2189873bbd1bde9f2400627ea646091bf59d0d227fb31c42544294
- SSDEEP 24576:MXYfDtczAT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rtcOLNiXicJFFRGNzj3
- TLSH T17C75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 a180f83385a61b0defde9dbca6afb9fc7744ce5aef8a53cb695a16a1351c12f0
- MD5 1067a83be7adfaa67fbfc859b5069941
- SHA1 434bfbce665eb9e0fca3e7c2723a9882acd0077e
- SHA512 649d874f0c8367b09fcacbd6160d7cb7f6fe3ae309b5f2e67df92213151243042dfe03a93c399d40fc69e6133a42709415128f6ad59d2e11427af1a86f81990b
- SSDEEP 24576:Q0Le5ji0hmxhrMQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QPji0Az9LNiXicJFFRGNzj3
- TLSH T1B585AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 c5f39aea4b9ad1b44afe36b86f8a0240d541f3e9276b7d10eda33d426190978b
- MD5 7937bf8bcf1b8e67eec1d0d3df1fca9f
- SHA1 9f93bafa49a7d93ecaa686beacb8b53932b5c7cc
- SHA512 65611e25a79ed72e8e27b457aa846a80f44eb8638d920e574e024acbdb4e678f5b5230f2b2b296ffc84cb5ea6c4c6390889cf347f0a40429f0a8514e2622d728
- SSDEEP 24576:la7/ezSC6vUyD/aqgrvWj6q8wyu+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s/ezSC6vUzPv+HjyJLNiXicJFFRGNzj3
- TLSH T194756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 a2b50d82c20f2a4198af913b1e905d5ab471c079db07f27f8e56c19356f53351
- MD5 23e8f6bd95234c4e4ebd25b474e63f6c
- SHA1 92afd284b71fcbf2b9334a9e46725a989a7f9548
- SHA512 a83d769cdc50ddcfb1cd4671ca78e8d60c36acbff1e6118af67ae463a01d3334a52ae94dcf7fe58e7ceb294a2fbb5cf2e13a38baf0aa803a98d20c765263ebca
- SSDEEP 24576:oVbqPb88hv/l+Bn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oVO88hXl+dLNiXicJFFRGNzj3
- TLSH T1B3559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 c516adf3ee7bf81f71d0ab9888e01abe946a5a0c00654dc9c1915b12cda5f7a8
- MD5 4fa52cd39bd7ae83dc60b3f31b15fc47
- SHA1 2f2a078b764a9708284948687f727d48d9f5010e
- SHA512 19c552d347a6bfcefb7d350e8a5742330bbe574f9405c190b07b34e4fcaf7931ae3bdddc03b6bd939e8eb03ce6cd56394a0c797ec4dffcd59bb092665ed2b1df
- SSDEEP 24576:rGE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pLNiXicJFFRGNzj3
- TLSH T1AB5523D3468864B1FBFD003A867A5828B5845E2C9A595DE3D2503E5E913CFEBCF38123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 64d5c4dd510194d171eca497f58b73b9f04eb827183952c0e8151a5d73354951
- MD5 13e0ddee3545bd2dc83891329f400bca
- SHA1 0a16408cbf12f1959873ecce5e948d79c1a4af3d
- SHA512 8ae9b783c1f59a4df8e943b8054086f821fb6f2d95661a4e1ede79e9bff14b58b96ac38713feeafec90ccefd49686c9db656d5cb14eb9e9206a3f74820e3ccf6
- SSDEEP 24576:DJIU//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DJIU/LNiXicJFFRGNzj3
- TLSH T1D075CF7BEE28FCE2C27E4C7957518600E76278304F6293CBD165820EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 3d57564d6675cf2abbfa2bcee967f0527a92bcf98594b51baf59dfc6b1894dc2
- MD5 e27a576e5d4ed26f5131818996f582c5
- SHA1 7f237bc68a529e21e63d2357fee147af10798c66
- SHA512 0defc3eba32da459914bd05686fdef5291dc5ba0859a311671da6ce0438f0c3ac99d577ae86f6076dc696f6a71efa7631b18b75f3c0503610b848e77f4ff05ea
- SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH7:zQvGAdlCEL8c/WRNw5Cu7wRGpj3
- TLSH T12D266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 6f346745d54a0fd8f016f1dffd42320d556177345615af6c4fe476776fae97a5
- MD5 72ea3c3b5a8084ecc6c53583f63dcd9c
- SHA1 16b3530f277a79f2335300a8afcec10aa0f12622
- SHA512 46fa314a2a3d97bd4d4f38b7b944c9de6cc2a74501863f45c556c75f601611f33aaf60e4799bc7825f06d508c606b6df701a55b6c908d460fa3a67f5b16a6e9d
- SSDEEP 24576:MfewsAjt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uljtLNiXicJFFRGNzj3
- TLSH T1E975E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 da92dc8f5d81241740d7921897a030b1571c712112fd441019bc9e738a7655d6
- MD5 3de98e07f47824b428d874ced5c15615
- SHA1 cb591ade127ffc97643888e96cb1eb220690dd5a
- SHA512 2564e39a59c3556e0d6984cdbdfeb883e2ec3489ee6d67b9b64fc4afdbdec39df8a3c08526b807b6e2253006bbb01a2ea1dcda43455067f79296d76802cad4a6
- SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHpF9:1UEtQevvqc2W1cpV20I32v9
- TLSH T18A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 d23409a4744b700e31761e3f11713cf69c0cb6b518fc0c5ffe450c9fe24305bb
- MD5 e6611dd97c3a8899b5e07c14af7a8f4a
- SHA1 8b27d7d13d28f07db445540eb27d115ad2bbe0b6
- SHA512 319ee71ad8804c519dcffccf5f52f99675dde72e874b6b7579a97482b09dddab8778f31c938a5687ebc6eb9a553e01cf43f8f6f11f6ca50b1570edfa11820865
- SSDEEP 49152:KCbRquA/m2yL5zLfFiV+XenmE3/zNLNiXicJFFRGNzj3:/oq2Vjnm67wRGpj3
- TLSH T1E5D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 0de34b8d94cc66b11e7d446aa9197fa15d698e6591714241fc5fcb68540cc6d2
- MD5 88a4132d33fc9418b90c732953763a6a
- SHA1 72ba570aeacde77c53b69a0db632385a9af5b13e
- SHA512 e0c973985515b49d496c12eb606640bb858af8a538106dfb3e4ed0c9195687b1f9d7bafca5e41af0cbb38f46d2ec873b3d7cbd64c95822caedaa9f28e5f5db8b
- SSDEEP 24576:QAhGL6IFoiwtA5l7S53a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QAM5Foiq5qLNiXicJFFRGNzj3
- TLSH T18C359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 9ac0d5e6f62b546d39f6ba085570920d6b37b7bb5b0f47d94bcdbeced4138620
- MD5 a1bca6f4a3393b335558a20de082001f
- SHA1 27a72e0d5a847f458c57e5f5e6457b931f923595
- SHA512 16e203856ca73dc4d43de6610d2c7ad70cfcb12c8a8ebf07d534104d80777be0fc8edf7c65e016f0afe02c3d3d4184308ee921571eaacdce9e8784b0c1ed49d9
- SSDEEP 24576:AwuROWp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AwSO2LNiXicJFFRGNzj3
- TLSH T1AC65F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 34d75cd6f83dad155092d39c1e7be18e00818635e1a27d49afb33159c18f6fc4
- MD5 38c3e5a2216ab7d9e32a2614a1322ff4
- SHA1 604edf8a100da946e1d7df865fdb7640ffa7d075
- SHA512 a96e82bdc73bff9c77b7380a15877293c0ad320f56ee9fe851b8e27e0c6bd3d011344c53b4eeefb43e36aa8de1d6a5c61140af6b523ca4041951faecae40ccf9
- SSDEEP 24576:oZuI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2LNiXicJFFRGNzj3
- TLSH T14E55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 05a1026ca7a8d7e999bd8baf98a22ce6e6ba8285abd1a0c2c3514a30df9e188a
- MD5 1b361dbfa76ce5dbc09625e78966bab9
- SHA1 e0d84980d1e7a0cf852de4df6ac344c0cc4977bf
- SHA512 50b8c3c9caa183f1456eb8a347d2660fe7532d6010faef1d3be8cd9155943e116681a9660543acdbe80676bece845a5324b1025608c3711f33b614d96b096542
- SSDEEP 98304:0QRQyi36YOcPDLvw2gAf+PN3r7wRGpj3:bQyiKanX+PN/F9
- TLSH T1C1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 4aba5200da2e3d7e0754e7f7f8f3019176edf4eb87f51b3ad13524cea5b77b54
- MD5 c315e793394f57c0096b8558e845d29b
- SHA1 5147aa655b9fe85677bba90303eeb62ed280f3ec
- SHA512 5ca009f5a6675268f29b2d578023b8b815ad3908d9f8519f63edce0f7bcbc0819b3a184138f85e6aafc7a76289628560a941ec7d25a1313f3f5f62ef290b2a9a
- SSDEEP 98304:JQRQyi36YOcPDLvw2gAf+PN3r7wRGpj3:gQyiKanX+PN/F9
- TLSH T119667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 31706a6428abb9f1d85f01339e4c132797e195712e71ce9b578aefab8862722f
- MD5 2a4beb19410b8ee8c218ecd628e019e1
- SHA1 66aaf1ab508f526bf79f09812e14f0df0b1c5e17
- SHA512 ba21b6b653c3722538acf04e41d9b4683c802729f059a68762ec3a4cbe6319576d4511cfe0e8ca238febe34abbba8c0e9584d04e65daf7b3a4fd6d046a18453e
- SSDEEP 49152:e68Qg55nhkeWu7PNU3/9LNiXicJFFRGNzj3:sthTRc/97wRGpj3
- TLSH T1A8B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 e09cd3228a70cdb070a4df27613939b365a64a0378262e53c7b0f1702ac39950
- MD5 270cf792bf4de947108f3cbca99d7763
- SHA1 f11b04aaebec752f9a29b9bf1388aa2fff46fd6b
- SHA512 7a5627474afbb5cb68bfe7fed8fa83347ae4ce7d943fadde8b5e8bf115c6e8a785d302724318acd676dcd4c61d64deff867b8f18274cd632e50b06f3d991def4
- SSDEEP 98304:vy5112gYy5azzVvU69nLKnhZE7wRGpj3:iLIHRWhGF9
- TLSH T1E9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 f9045d2731e1eab9f31b0d955b365eea48fa644b1ebd6b013cec78912c41da2b
- MD5 260d87470854a3137d0ea08a84f51f0b
- SHA1 f4ee8ad84bad7323dab4faacbd8923bc12451abd
- SHA512 392da1228bb5a46abb49ba09560047ddd72f31702cefcdee57017adc730c4af823899b7bbf9e07efe6ba784095df32a9d2ac0236497c76d715e2b19f4ec1dd9a
- SSDEEP 49152:DB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gljLNiXicJFFRGNzj3:1u6JmIxd2dj7wRGpj3
- TLSH T115D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 ad67aa115a69891b79fc2bfe69d6a10f0fdb24691db09cb09131a33ff67eea53
- MD5 2faddc8ad41b31bd360e91188dc1c2eb
- SHA1 e84d63bef765834e1ae0e986f01f02fa53b52add
- SHA512 da7749095b34b297e2b082afac3f95d3df482fd66f16a713e235d9a1b42efb904e9f70e221ffe6b925f828080a0de3b6f8dfe1ebb66f2f4f35adcbd327b842c9
- SSDEEP 49152:K1hpsNoJpF1A67U44CwH7R4xfLNiXicJFFRGNzj3:KmifPqR67wRGpj3
- TLSH T150B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 9b8a13b442b23ced2c02794d250ad357e7326410833bae02041a8cef9ceaf6ee
- MD5 3df562d3f638b0a57210f96b007cc527
- SHA1 1fa53a4cd9681e0faa01076fbf7bf704155e8fad
- SHA512 1b927735afe80aecc3437a426982a832b919021c42f6d6d75fb820f991cfe8c76f55439f6e283715d889554cd632f3e4cde62fe11970e543d8c24f3ed89e1c3c
- SSDEEP 49152:XSuZQIY0Be2KkRVtOnks6NMHqILNiXicJFFRGNzj3:N5dKqi61I7wRGpj3
- TLSH T132C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 cc3ce5ae623d0b0663505dbe41343f2bfa1baef1fbda4b54abfbb4a6ee6e1521
- MD5 ae4c7879f810ed226a033075114d942a
- SHA1 05e896c1bac7ba257203ca88aaf5563f1b44906d
- SHA512 29fa5072e78095c01864c00f8a5cd34d635c97fe21f89a9df4d9b0d7d654cb1bbd28f842606ca133e7efacae5df7fbc95e7db2c35fc7ceb2b7da1fa183a142f3
- SSDEEP 49152:NhtSn8EApI0figjgiDn0AP5wTLNiXicJFFRGNzj3:cX2iWphW7wRGpj3
- TLSH T11095BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 130119c4e8f87c816f69b9a53efe26ca44757ae021258327a00baf736bb9c549
- MD5 06d4029de2e767f89fb8d24fb51d60ac
- SHA1 e4db05d5d3889f31334356f8dbab4122268401f8
- SHA512 1a72d3657abb14e3e135fad7e84fcbf00fe5aa4137f70dae686dcbcd81bcef409bd6692bc5d257554134e4ffc9df6289f8373155318a930769c902698d456132
- SSDEEP 12288:9aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:98/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1395523D3548955B1FAFC0039C6755428F5882E2DEB5618E3E3083D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 d0586f310e85908b300317b74bdbc91acd477cf5ed36cede8f315ca88033b431
- MD5 6e25a27b32b604b571ff6aed6b223f26
- SHA1 09f6f234a7d27bf1a0c62fcddd98c75bf797aa93
- SHA512 85504c263f7c042ebd1354e2a4e8d094e42a835c7aab9a6cbcac1f40916b525931eaf2329538e260a1bbbbcb85ebe7c94aef4226e0ba6662e323763564285ca3
- SSDEEP 12288:EtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ex/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1A55523D3548955B1FABC0039C6755428F5882E2DEB5618E3E3483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 633b98e2faef9a1515f5f46c57a4671f1effae9a1da87a511996e8e64be6eb1b
- MD5 29150f7a7748d8688f2b44d69003b225
- SHA1 4f8d500c916c350cacf59afcf9469734ff91a833
- SHA512 0fefc21be9ccd433c34eb9f948fa5aeb9e1963b3076f897aa59221a8856e8a71f8017513f1a686e18b8adbbab31ab878163ba9e33e742af4da853bdf48537093
- SSDEEP 12288:MDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1C95523D3558955B1F6FC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 ee26166c77f3cb3765474b8c76df78b65deadec3c91e013392e2971dff779162
- MD5 10fe7254f00a258b9826afcc7afad4f9
- SHA1 912f49415aa3a793eefddb2e9abdcbbeb0640e36
- SHA512 7fe699351b3b86cd251e388be35bbf5ebadbea0be1e0a028f0a7f6987ee87d475e353e535e50c0941ad3a0b6e95c99beeea67986248310e26a5d4fefdcb978b3
- SSDEEP 12288:hVIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T166552393168901F1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A74FDA9F38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 925e83cb608363a96503ebee28c5616c1ca0055f349026eb576206840a6dd6fc
- MD5 ac25604007f4b84dd55b57d3aacc0071
- SHA1 6973e626830b4ca52100062c0bb9c445b0df70b7
- SHA512 62a869a667e148dbf872f55c821927cd9155ad4b9c6f4aac5ac3293f3b4e0abf430869ac093c3778bc7b23e15efb2a0ac7179ec090f59f42d95332f889a79520
- SSDEEP 12288:AQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T15C5523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 3189156aa80e176093e0f41de4817f7960f1e46b5ce77714474f9b86c1f361d2
- MD5 dde8d6dd2a571126e8d64d6f752a85ad
- SHA1 ef4ce9e85bedadec93f0a77eab4495636fb6368c
- SHA512 5a557a3a57f8c109e31bcaa56a7891c95cec03a28befc21ec3ef5560c116df81aaafcb903c237282f04f43a820e87b6fd75a00d52ee1c90728dc3990203651f5
- SSDEEP 12288:GZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1C65523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 fd63a2bc3cfbe2b94b664c46441bc3af099ff784986ac9b707a76ca54cbdff4a
- MD5 3e1c81bcb2ec5d19d64cfb777f5aa3c1
- SHA1 da4cd467241f93ee60eaa8ad7df336a6484a4887
- SHA512 0a96187e0b74fe45d7b1bcad6cd99379959e726dae47bc6eb8e24737175a6756b8283e4bc32b0bfd9119a5f8e5f4cd3dfa8ef3d15f4880f403225e3155c81e23
- SSDEEP 12288:2ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:25/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1255523D3548955B1FABC003986754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 e739bb4223aa1e9dbe85aede42cd11a8b3c14ed64a577a9e9c406d8b6ecb97bd
- MD5 01777bfb5a39fbd1635fc5df0bf7fa29
- SHA1 6299e85ce95f87ff9c1c8bca8122e96cdeb7a7fc
- SHA512 769f92364e61d12316d0ca733ea586d2404057e23a157428ae28b812f6adccd5072f045e1828ea418bc4a09f8f554ab53ae731d4b0a6fdfeb3b8b525dc6e7620
- SSDEEP 24576:4ZM3zFVSOR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4ZM3zf1LNiXicJFFRGNzj3
- TLSH T14D750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 ed7774c60c3fa2236f700859cdbafde6fc29777baa22c97a6f958f46ea8f1e8d
- MD5 7cefd8be318d874f71424e86c0c1a698
- SHA1 083867690a8906a122cf086214293a59ab86742f
- SHA512 7e208e8b35cc99ffd571045aeeb4b5d88ef13333f2660c527c86f62d2cf13929d19d44ea67c706f9626a31ce0f06cf3e504dcb4d2d4230d5d00c0b939960a4dc
- SSDEEP 12288:5OiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:54/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1C25523D3548955B1FAFC003DC6754428F5882E2DEB5658E3E2083D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 10b17877f881f982702068d4e239fdaf9d5a70a543dd7ccde190cd1f2690ecc9
- MD5 a3de60378298a76e1192b6154db1dd97
- SHA1 d66cc1659ea53e8bf7de6909a68298271c3ae00f
- SHA512 9a5ee21f71ee87c62e82d08e1ca718a79170d83c2787741966a10e4e6e8b42b88c3924b014630175bf4a7decbac82e2d3a4a7225e1e7f6abed3187bf7dcbcbf2
- SSDEEP 12288:RSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:R0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1535523D3548955B1FABC0039C6754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 e5fbf48c9ba96611e447689410bc98cd86cfefe9f802043ff77ff49e06b38dcc
- MD5 d8b0279b67bc637d7c3d83eb34d4c4ea
- SHA1 20b49ad302c1ccdd8080790d1a679dd107fc6144
- SHA512 8e4af83a0192df28effc7d9f84f5ad15e3f454f380c66b2a3780209ff2b970e5bd86528f6a93681afb89a975903474f662b56ff9dd005565e82adf0a80b86e9e
- SSDEEP 24576:FCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA7/TwSfVcYG3K/cJHlnFR+IGe:FCUAPTY+8Wg2lIL8lrIUJLWwCLNiXico
- TLSH T1AD65BE1EA3DC0896D4BB81358A518A16FB723C2E1B2296CF1160C73D6F27ED95E35F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 cb801092f5ec12dbdb02b4180bc02066afd690e7deda03801e67d6a0faf54ef3
- MD5 f02a80f9d7a8f703a513f126cebc7fe8
- SHA1 7e09481ef02fac0364189cba5113bbdd1891c345
- SHA512 7e20485bc86f9c035178fb4ab83b23bc808c927b6ae081a083963abac249e25d28f684ac96604a0a98281b880539aa8c7bd1c1182e3d662232a737da47db7af5
- SSDEEP 12288:5psf+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1FE65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\ARM\ArmReport.ini
- Size 746B
- SHA256 d33f7174ff6e717d72bfb38cf92e25135823d3d02273bf3f575f95d2afdc12dc
- MD5 5757246b0746f04f7c6c7685c433d80f
- SHA1 910a75876285c35fe0fa03c11f36257aeba8a2b3
- SHA512 8f2f3642154d4f016f7679567cc5879e8d4a794a07b62b9663905406a77aebb111b04032353588719a631d9e5223acf543499ef7f7b36e0e15ec966c638219f4
- TLSH T1530178831AE91160F1B25F45EFF9907357327CA35C2DC86C90D8420E89E1A80E5B2BBB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
- Size 251KB
- SHA256 fca76f0688d1e64392dcf74a83fedd18d402ce4faf80572d65bc2c0a3947362f
- MD5 1e2e855388fae67e8242ff4482f75b2d
- SHA1 c7cf193170e91382a8c3ef26a81389042f5bb95a
- SHA512 05674178115c2f921a3dc767afd16b0e269ed61ccf75f521ebe359fcebfbb44888344ae526f8c4ce05a6811ff959145ab6e5f96650bccf8c870732f0d440fd89
- SSDEEP 3072:wT4DJAlCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549XHmYPCjTMNro0Jnxu4Fn:xgUzH5
- TLSH T18444E44263FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\4b859407932a944.bin
- Size 12KB
- SHA256 bb995c134370b3f71eaf36bf2f9e9aa93037849492dc679c4d156cf5acfaab41
- MD5 b9d29a59f11ce51416809a21eca33eb8
- SHA1 547ec0ae592ac5e67b99a4a20bc187541e11c2fa
- SHA512 1054efaec15b70c7d241fd868402f92296a2491329adca08f9adfdc39c0513b810442598479a51c69a2f2e516634180734f092365009927cc4f14c68363cd914
- SSDEEP 384:qZj6j3/s9dY9vIuiLyRRzNJo9Oe6SZeXN:qkDs9dMvjLRRzToVJQXN
- TLSH T10342C087F9A019095D3CE3628701CC9EF6BC53DEF6E1F9C861CA63216647F9F48080A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 8dee7b28782286ebe7f1f6852a2e1f62caa637da3cacc804a9e9d163e5955d3a
- MD5 5f5d0df76805be6b6732e7897f9cdd67
- SHA1 998120c66f54240ab213e93c8b7153f37b3f329d
- SHA512 9a9bff1e93b19adba03034ab7b043eedea3ceef8ebd6a02e5382df3aff9a732649009816f5862d980a3166587c69e7b1b9bfcf99dbec0b6b2ca2be3bae476368
- SSDEEP 12288:bjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T12C552392428C59B1FAFD1039857A9438B54C7E2C9F1598D3E2043A5EA238FDBDF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 f1d038322298520b2886c3162a76fd25d08087a9cf0a30f604f451d9681ba055
- MD5 71ae1bc501fc70b6faa30b22a4df4808
- SHA1 2f4cff33e73d392c80e72360d750f40ef399b1d6
- SHA512 9ed9f9a00edcbdb99495e3c8f56bedb0f74687027053d835b42b5c5d5e375132603263500c61851fc59bc96b09daa7867c6f9da0405cad9487e57dc150165e09
- SSDEEP 49152:lRZwQCyiHiQEaaPnMwLNiXicJFFRGNzj3:X9xvPB7wRGpj3
- TLSH T16285B01E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 bd29af87369c1be76a9a5421754b99c7727e615b47db028e9ce2f6e8dfc5dbdb
- MD5 b19d98973fa2b427ba1296c0b68b9c2e
- SHA1 34d0a57d4722eac969df5cedd6f0438f5053d657
- SHA512 d46f34a58d1f8072c93d68f7297553ff8428b4a90f60becb68dd2ad97361092e49d07ec09396e3ab89580c969d6c88dadf498476845bc614914b0157f85a8e06
- SSDEEP 24576:KbxA1UGH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KbxA1U8LNiXicJFFRGNzj3
- TLSH T12D55126E129C14F0F5B9903D89A68005E3317C2A572197EF6180927E4F3BFE99E39F52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 82fc412882f12c531ddfd0c824a34f72cc6aae4f94403d0fe644b7cd05c94ee4
- MD5 61ee0d38d57318e131f27ae0acf81152
- SHA1 a19981526fce7d65c5f1da5524a485815fc217ea
- SHA512 e8189aa46c92703cb1d071801b9fc98e20b1175a70b1da546924aaf863792eeaf3300861c8d3f4a55c7340826a789b64c5034b17da5217763226a0f6994619d4
- SSDEEP 24576:MjsmP0yHaqrVqHra44KDzMsrnq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MjRP0yHfVqzlAsrnqLNiXicJFFRGNzj3
- TLSH T17245AF2EF2B910B9D4AAD136454107B5FB71782D1F209AC70170C635AF0AEE89F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.3MB
- SHA256 311a63b236a0c2f6f2ab141eb4cf656eadc982f49d5fbf5895fd4a7c9c5df7d3
- MD5 261a9e6d1e82bfd201aee9eda6011086
- SHA1 55a732d27464e30672000ca27a0183fcd79f910d
- SHA512 efa630b4b23b59654f8855fcbed4bc1ebc3a70ba78c41e807bf53870523175009e967b5eab98e00a5788276868156c391f3588b1da79682deb7f0635eae8a91d
- SSDEEP 12288:45iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1015523D2518955B1FAFD003D867A4428B5486F2C9B2619E3E1543E1EA27CFEFCF38462
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 79b426a35c2e42942ce9886b364ba2497c8c6ab81755415d2105aabfa9f82267
- MD5 6ece4bfbe22ca43de537daccb5b025ee
- SHA1 ceaa75692f26a701528ff1ecb657c8e58489bde2
- SHA512 e8140e2406a44cf3d774a007f43f717d25b8c01afdab397c246b8c10bf9a75440d84e89634665121dab22d4ef021b2e7cb9bcacadf7aa4a1ff842bed189ca145
- SSDEEP 24576:FALBUTT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FALBU/LNiXicJFFRGNzj3
- TLSH T1F7750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 36080c0df3af1a6372ac43b7aff7a1321cd9fc8015ad1aeebe614fec8c03d71f
- MD5 046ec97a0fca7e083b5650343062c680
- SHA1 21682cd98952143efd9871b12acccb145d2813ad
- SHA512 e18ad5b21c560b2cade6e19b78b47f2783f5907eb26e6a6a45d28ca2fa2e9fece2510b87245814fe90cc9b4fb6311203af7ae6452022945d9de456fbb92cb5e6
- SSDEEP 24576:EfYNHG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EfYtGLNiXicJFFRGNzj3
- TLSH T1A665F12F629D18E4E57BA13DCA828109F2727C66171192DF01A0827E1F27FE9BD3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 ced24ae8a04f9da3242b18516ec2e64f7226f340931a2623b39f4e3b126f32cb
- MD5 bf4dbfd7f0123cdbb5f661b491e21280
- SHA1 2101c4bb285be48466ea261edfe530e0c0a0828c
- SHA512 8e7e1d8b8d71d8dc988b105c66cb45b735f883fb17472c8e6230cd97e53e0e3a13980078538a7574ff90f8c0329811ff9c7d42f06f430429f64eb958f825aed1
- SSDEEP 24576:vnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKy:vnXoJJYH84VVS6AmETJas+cHBjSSKHPp
- TLSH T11365BFAEA2BC04E8D5BBD17DC5C24506F5B178651331C6CF026082BA7F27AF59E39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 f787fe5217fc30dcb879eb193bbf30c3b0368019bf77d9f2e0981ad0bc76f46e
- MD5 a38e5f5ad2bf7e60b0b144a4ad9c6f9c
- SHA1 a8bdae5d9aaa8fbd37921449e9551620903b1d97
- SHA512 44b8658ca94115bc41d086671611fae9a3c932a034166b179acb539d1d6521b98d005f088dee6494a599f98ee77af69936d9cc6d62692033614eb4c80d568900
- SSDEEP 49152:1DLL9TuJ0M/TYW2PFLNiXicJFFRGNzj3:GO7wRGpj3
- TLSH T146858D5EA2EC42D8E4BBD6BD85B79046FAB2B855173081CF0251856E1F23BF05D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 87f807df97c12a711a27a93ed2075256dd041b08afd951d57bf1b3678c308bc4
- MD5 6dc6a466a8493f66c8c03fa009dbde6b
- SHA1 173c8e08d638c007c713b6f81bfc2b08e839f371
- SHA512 a346a2103450f49c3ca140da0e45b84ac3048e7a386cb585d64083d0face992ce22fa2ff014e2cdc3408e6f074a3a24311a6541c5b00f6e3f5615c16bd501823
- SSDEEP 24576:/egJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wT/TwSfVcYG3K/cJHlnFR+IGNe8j3w:/ngOJOmPOHkTLNiXicJFFRGNzj3
- TLSH T14255CF3FA7BC15D5E07EC13DCA968816F6B1782603255ACF0160827E5F2BEE46E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.6MB
- SHA256 48f293fc24c42f85fdedc36ce106593af815d20509a6d4419d6d1f1df66d4967
- MD5 c3b36706522c76922bcd633f6ba371b6
- SHA1 442efd8819454ea54b6f1ec5853d882f60759c06
- SHA512 36af0941cfbeea0f41d93543572c26a6b7a26e8eff48b314c47ce6ec388113bd3d674bc5f4ad69fc2c2e81f44fe274117e741951fa7a846a499d0994d61bc667
- SSDEEP 24576:zLJnJiTk3R3waE4JrOF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zLJnJK8R304l6LNiXicJFFRGNzj3
- TLSH T13D75E07DD2A810E8E4B7C2B4825A1656FF31387C2B2169CB55B4D5353F12FE0AA39F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 361e69c47963701a8e31df82a71a4ad70816ba80d3ee8e8d3c7a68ecffd3c3c8
- MD5 ee8f8bef2b5fe97e60bd447582458a35
- SHA1 5e7e99451c6e1fdd80e45eae1b6439d21f58fa00
- SHA512 d4923f84092e78f63976b4fd761f5cc06fd154141b0f2c910a93e453f5f02e7d2188ad0b34eead1ab0af51aefbf610327e36c58f1e1946287fbeb3714c3e2d16
- SSDEEP 49152:59GqCzDScAZmlvTcFg8Ph65LNiXicJFFRGNzj3:1m7wRGpj3
- TLSH T142955D05F7EB5298E8B3C9F1C96294159B327C509B34F7EF4A80CA6A1E32BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 982cfdc5d035a89d23ef2883e9cedc2bb7b0ab7ff64dbd9a84d3b4c9ead75191
- MD5 fce5124a3f7a58e776d655db4941fe53
- SHA1 e0eaefdbcbdadd0a2d7f7d565f84f74f18bf34f3
- SHA512 aac153b430f9304775b9e6b1fd4c0eeb09d1399fbabd57679679317e555f807027f24c99cc66ee7a12d4ea6db9824e5324cdc9dd58feea033e48a27f19c49d2a
- SSDEEP 24576:4lYJeXm5jUuED/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4lYJeXmRUuEDLNiXicJFFRGNzj3
- TLSH T17455129E268C30F0E27E403D85A24414E371B879571217FF91A0A57E8F7AFE65F38A51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 e5e081104ff88677b7ff373462ff9b3e6bad637675e19ee2bc2062669291ebee
- MD5 c5d56923f41f3cb17682e5219342d7a8
- SHA1 d1817e9d27cb2d6b983c44603e36b2e95d0ec913
- SHA512 81f55e046fa9c4e6b9087c9c952c0433d415d30bcc2ad32205d75284d7722febebb35c4cf7073ec334bfdc4c9d8f4c800ccc8caa80e83e9320b95d26f88eb8d1
- SSDEEP 24576:1VtyK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1VtBLNiXicJFFRGNzj3
- TLSH T1A365124522C465E4EABD053CCA734064EA747C249F2147EF9190BA3F6B36FD5AE34B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.3MB
- SHA256 f2bb51387374d048434fa86cdbdf1cebc3aa4c13658ed47dfa3432815bc8fb72
- MD5 41989432e70a4163a6c7159b26cd2a6e
- SHA1 ba311ae540dab7f47cab434f2944b04310a805f8
- SHA512 c0c1e2bf026cc52d08368580ca91512e6b37c0e521dc042dc6e42e94c8d6860bdf0f04c7a584d6cc9c3f5a4061a71c8d28dcd9b1c4c345b54303aac39da526d9
- SSDEEP 12288:MPniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8T/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1D95523DA118965B1EABD003D86364424F1983E3C9B2528F7A194793ED379FDBCF38852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 29dcbdf3d5c08f97e4c7f25e6e6233ae7fd533dbf44e8ea29d945be106c2d6e1
- MD5 908639d948be4d827802f67e6a77a682
- SHA1 4c197c2a9527bcd210252040ea2311fed758b1e0
- SHA512 f875d60337a694ccebd22405bde7a843d0b8454129a7cc082a383ba4b01d8cdb2be3b49a8d74781c140aabf27ef8c7d0444bee3ef16cabb45570e50f977a3313
- SSDEEP 24576:5C+TyQIu93VAumZr7jmo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5/TfIq+YoLNiXicJFFRGNzj3
- TLSH T116558C1DA7E919CAE2B6C575C8A34493E633B872137186CF2044C07D499EFE9AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 e1ba2c587b1f9c7c84322b38028436b3cacc54ce8b4f6b6630dcee40dfba83bd
- MD5 7f23fe937292eec7d069bf908316685d
- SHA1 d33c6b74c461bd16c53e12dcfcefcf8c486f4840
- SHA512 1dfc23ad6b450f02741c74df67da03373c374c77776e4a60f52239fb134705053b84cf3fe177545d989629333a5ae60b907f64dec2f30494e1fb58c46cdd107e
- SSDEEP 24576:xLQikZP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VQiktLNiXicJFFRGNzj3
- TLSH T19365F10FB3AA00A5E1BB813C88554115F6B37834571267DF4290CB7E4B77AEABE38B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 d193465e59688765c82ad2f547a0d374c5b20558a2cbc1c9a8e068ba0cb43834
- MD5 63ec80e61d965295557c737945870145
- SHA1 b0d04c4d3cc7e8598ca50b35d892f12491234493
- SHA512 59cc53e934ddc6dd666fc219a9c1e19ac91089a1d621d541154021e26c332d14c51b85df5d059da05e428a06910e9baa86c3640ea570606eae4d33a87cd07b24
- SSDEEP 49152:EpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPKLNiXicJFc:FpC7b4+80GTkh7wRGpj3
- TLSH T13EA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 25b6b12ee371add98a1225f41a15ee262c05070370b56229d1ba71a285af0e86
- MD5 8b1b08b203ae5d00784d92b24a67d620
- SHA1 d537654c3f57cad425d465d89923bd5a0156144a
- SHA512 630b3112db2f20e16db0babe2b896117339a6c4a20179a7a75a5947a720862639d5216b1eab54be86ba9b7ce6f60cb318c6ef7f6192d061a82c63da8561166c9
- SSDEEP 24576:KSAwJPE1IDAo+4Kt+l4413lUQi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KqPCIo4Kol4jQiLNiXicJFFRGNzj3
- TLSH T15655B02AA7F956F4E17AC774C663C511FB723822133163CF9290953E0E16AE89E39F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.6MB
- SHA256 551b1b1f6eaa5dfe0e538ca33e0af6abd3bb599424391d7f207c2e5fac81c2c6
- MD5 689f770e219214cc37a02c8dee465290
- SHA1 295b93b334c3df1deac321727014d886b6fc3f8b
- SHA512 b338f91fc52601b26ba69b4d6d71e69149be005c6a7a26e7f036673fcf6c6d192d83cd4c9fd455beac84853d9324fba56db95e537fa82b9f486f867e60292df3
- SSDEEP 24576:6yLXPLcT94tS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6y7PoqtSLNiXicJFFRGNzj3
- TLSH T1B975D03ED66D04F4E57AC13CC6A38906F6723CAD033166CB15A0957A1F6BFE4A939B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
- Size 414KB
- SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
- MD5 16b9618962f5623ca791a1366eee5708
- SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
- SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
- SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
- TLSH T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 8b49861e2efd28f3f6ed34610f0e599cbed25c67900f756fbd91987f05c4769d
- MD5 b69809655235df2bfdc06c4a415d8ee7
- SHA1 ca1797195b90149b4048c663e55aca1473afae05
- SHA512 3c279d12a68c724120ad3fbb8aa2d1b2f60fcac8fb8d7b75cdbd664220e5e50b0154a5a8b35d27b44bef9fb20c998775e5c62737b67d9e64e98602850d7f8fbb
- SSDEEP 24576:xWv8qjpf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xWv8aLNiXicJFFRGNzj3
- TLSH T19465129E12C424E4F5BD4138C636802490B17D3A176559FFB1C4A97E8B39BD6CA3EF22
- MD5 SHA1 SHA512 SSDEEP TLSH