6e470b235d98bbd63b436a66d8a22c7fb4eb8eb0c236a28cdb02e5a523998167

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.8MB
Sample260522-c83etscx9l
SHA256 6e470b235d98bbd63b436a66d8a22c7fb4eb8eb0c236a28cdb02e5a523998167
MD5 1522417fb0faefc811746df10efb51fc
SHA1 f2aebc342cd66c248588bf77dbd5563812cf0402
SHA512 7d4dde82213fe08adc46c457f9fd135b5a079bbd1aabae3ddb8994b31f00f17b4d8bbd1e54aea589b7a613af86f664edbbed28adf85ce6cf3d05aa87308d01f7
SSDEEP 49152:JNZCWOLT4fJGBUmqK2MtENthUyaTFxmE:XwnLTWGBBxxmE
TLSH
T1E2855B0667F95128F1F33B71EEB992645A77BC71AE3AC50E5280025E0DB4E90DA72733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4628	alg.exe
3276	DiagnosticsHub.StandardCollector.Service.exe
1188	fxssvc.exe
5024	elevation_service.exe
4280	elevation_service.exe
2956	maintenanceservice.exe
1964	msdtc.exe
1680	OSE.EXE
3024	PerceptionSimulationService.exe
2128	perfhost.exe
2028	locator.exe
4680	SensorDataService.exe
720	snmptrap.exe
4088	spectrum.exe
3548	ssh-agent.exe
1736	TieringEngineService.exe
1616	AgentService.exe
4304	vds.exe
3584	vssvc.exe
2392	wbengine.exe
1592	WmiApSrv.exe
2108	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5cec59be6bf7732a.bin	alg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_176265\javaw.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058ddca3995e9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de7a8a3195e9dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005488fa3195e9dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eaedfc3195e9dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062e6103995e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083edbe3195e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000444a973095e9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006924ce3895e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	1188	fxssvc.exe
Token: SeRestorePrivilege	1736	TieringEngineService.exe
Token: SeManageVolumePrivilege	1736	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1616	AgentService.exe
Token: SeBackupPrivilege	3584	vssvc.exe
Token: SeRestorePrivilege	3584	vssvc.exe
Token: SeAuditPrivilege	3584	vssvc.exe
Token: SeBackupPrivilege	2392	wbengine.exe
Token: SeRestorePrivilege	2392	wbengine.exe
Token: SeSecurityPrivilege	2392	wbengine.exe
Token: 33	2108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2108	SearchIndexer.exe
Token: SeDebugPrivilege	772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
772	2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1944	2108	SearchIndexer.exe	107
PID 2108 wrote to memory of 4460	2108	SearchIndexer.exe	108
PID 2108 wrote to memory of 5116	2108	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_1522417fb0faefc811746df10efb51fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:772

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4628

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2032

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4280

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2956

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1964

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3024

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2128

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2028

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4680

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:720

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4916

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3548

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4304

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1592

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1944
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2860 2848 932 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4460
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2824 2816 932 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7e461926997e1073679bf6c9f12c160d8f75c27ddb6d7c7dd03ee53069eae537
MD5 9b869bf959144310b31a300f4912b16d
SHA1 1aabf06efdb5cf2bf8c82de69821309296b6fec6
SHA512 efd55e399f79ff898f11142904bb1697ef8f22fde157b333ec8222ddbb29e12e0fe1bf4210c0ab4241754073b392919da80a45b53d17111849d97704080ad9a9
SSDEEP 49152:7rf632BuPkFKRrdE6oh7stBhuXjfS4LWxnnhUyaTFxmE:i3q6gjBTxmE
TLSH
T1C3D59D03F2D900E8E06AD178D7469533E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 6982f50ec8456a7cb937750121b6f0f7b55d42dec5663598af34f4fda657d043
MD5 21d857737e82a203d693b42f17b442bb
SHA1 8e33ed2426a80c5fbe6d62ca9748c5b260cb8782
SHA512 00109d7cf4a7543ff484ea53bfbbe6ba166ab4f3bb8cce067b26e1c9bd0809094681757cf6c2343d9b22630f89142faed6c1a413f85345978f9d8d7e338a3f0f
SSDEEP 24576:nXYODQczA6gULhNSzd1RI9VZ8TFcJ+W0JmEo4:RQchhUyaTFxmE
TLSH
T1E5050229B3D00DF8DDA7827CCCA18915EA73785147A0E79B03E885261F237D45E3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 b55a21040595411a5091dcf8f82f793f376b9b4f88ee0d9fc70eb2a2e1261484
MD5 b26c9c4009ee85ced5e1ee4d0589092c
SHA1 62468e0ff841808718e07d179fcc9e2c96df1bc9
SHA512 a7ec0a0212383cd0c093134bf7fea1312aa98610d7f3e1096a5e5f4d7891a7759a96020df8734a5d24c7e7c315872edfaffb2135766564ae338d5edc6b194b1c
SSDEEP 24576:QwuuOWCgULhNSzd1RI9VZ8TFcJ+W0JmEo4G9:QwVO3hUyaTFxmE
TLSH
T14005014A72E41CF9E5A352398587853AF7F2BC112A31DB1F0760C2576F37361AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 813e79dce518b5df94b3d19c6ea25969b9d25c3ae6572a5486bafcc163b168c1
MD5 f96f12b96e2a0662fc20262cb9db4216
SHA1 38077b61f4778d85f347f6baa3fada338167134d
SHA512 b7cb53859e8421d740a8dff5b98f2ffb5da1c4b14aae84505b6618d4613a0968c8b384be463aa218e71a4c543d1380ce1ab00f48d9ed2020844d64dd3235dd6d
SSDEEP 49152:L0+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl2hUyaTFxmE:cu6JmTxd2dlxmE
TLSH
T142D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 454f3cc7b14c84e724e187183c097b38a364196af7d1ebecc8179b60d74f62f6
MD5 5aeb1c41ee029d44b268d9f4beec26a9
SHA1 6f14ab49a25676b965e6d2f652fc7ab42f038f18
SHA512 c4f0cd418155a59135411885ee71d0076bcdbcc144a943e09608030e3ab9ce3ee98967a1d659a33281dace5455ab6fab29d8ccec10b88c10d9420b17fe905787
SSDEEP 12288:5fV/fwpxULlVBNqZzZ15vdRI0cysfZWLTFcJGcKWNOdAAfuEeRQi74:5lgULhNSzd1RI9VZ8TFcJ+W0JmEo4
TLSH
T1F1D4238BE6C8EFC4C1F122F038944E3D69E87AB44B61C9D70A9E01512975FE2D522D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a7a28c79d0a8630a5c38ff2108ed26953e6d58886a763c9f01c3a3b62a75eef6
MD5 6d6287c51f2f6464282288d7115ec46a
SHA1 cf9ad1c451d566551efea07a8672ad1613c3a029
SHA512 518e8b7adc22f1cefba0fd89f3160bb9873a66047ce306a678b2b924253d6fe1b64b06cd32cf058bf56ec7ca5584199cf3738186c9ddf412b3f3d489dbfbc7e5
SSDEEP 24576:kcaMyNoSFw1d+rC4vrmRcGPiQEaTPnMRTCbgULhNSzd1RI9VZ8TFcJ+W0JmEo4:daZwQCyiHiQEaTPnM4hUyaTFxmE
TLSH
T14085B01E62DC46A5E0BAD2B8CDA74407E6B27816473197CF0191C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 704KB
SHA256 809ad257f9c7633dcbb81f0b9e0fc239775eb1cf4e7a3799296de27cf0b37c8b
MD5 a2e871979eb602f04e5bb23d2d1f448c
SHA1 d2da35f0fe17749247e6cea451eae0a9f50356f6
SHA512 846bb1ac332279d8962bd47838136db3b80a404d39288bb5a1151e593112c4869b8f1b8f50cf3ad167271ff12e843f4b8ea8e82bf65dc6ba22a7f6cdc25f4178
SSDEEP 12288:k4xA1U7KNV/fwpxULlVBNqZzZ15vdRI0cysfZWLTFcJGcKWNOdAAfuEeRQi74:k4xA1UGLgULhNSzd1RI9VZ8TFcJ+W0JN
TLSH
T17AE4125EA2DC2DE4E1B2A17998C1450AD7717826133197EF05D6827A0F37FE19C32F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 81beb0a7d39e56bc2a09c4bbd7b85819d25e0f51bcff084d77f0828503588599
MD5 6bcdd397d8253c82d066d3aeaa938562
SHA1 eb86149e2da4b3c4697ded934639fe9592d938ca
SHA512 fc630c1ea5dcabe7281a4dad7d43d6adf770969306b4027e3c60eee7d3574bf12e4b2502e514dbb4fbb1e83b12236cb8bdb2115dde278364a2b3bfaf6996e618
SSDEEP 24576:ZMsmPVpHaqrVqHra44KDzM+rnAgULhNSzd1RI9VZ8TFcJ+W0JmEo4:ZMRPVpHfVqzlA+rnqhUyaTFxmE
TLSH
T10855AF2EF2B910F9D4AAD176454107B5BB71B42D1F209ACB01B0C235AF0AEE49E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 814d3df0a98dd7b1834febdb84eb5f42e83c121ecc3d4992a2c5d8b4c69e652f
MD5 5c95c3ac3b7bd241a66a8314e96a9512
SHA1 e9ee0931fdda0038f2bc7f31f48e62ec50994b0c
SHA512 544ef4540a62f385803fc7e5c89c3eceab9fe135366a8a0bc44f9a238fc1e398e2bc0f4bd71c4db3a2d37a53731b56f9954dbdc14ad9a9e22cbba2296cac0479
SSDEEP 12288:wP4V/fwpxULlVBNqZzZ15vdRI0cysfZWLTFcJGcKWNOdAAfuEeRQi74:wPcgULhNSzd1RI9VZ8TFcJ+W0JmEo4
TLSH
T17ED423CEF5C4AFC4C1E122F17C800E6D69F47AB447729AE409EF01622A95BB391529DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 963KB
SHA256 910b0ea22ce53d85da071edaaf0b8a8399b3dd94f1ea319160eacfe193efbe43
MD5 0427ea613cc2a7929490fe28b5aa8619
SHA1 9a439f22eabee3d576c10c1673d585a016bf19ec
SHA512 2d25557d79f826427390a74a2180569aacabb9e1b8af8bf474ff063da6792b17fd5b55c91b84f22431d86979a1de1fe18ea37a4e821e28755a0316d4ccc767d6
SSDEEP 24576:OHLBUT4HgULhNSzd1RI9VZ8TFcJ+W0JmEo4:OHLBUKhUyaTFxmE
TLSH
T178250145F7D404F8D977917CC8A28A1AE6B2B89D0360E7DF03A84A651F537E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 6fa4821983bdfcff41908abf48a07a68b37ae5a8566a3c379fb269781c65c872
MD5 03be6c36971ea9f83f19537cc76a62d5
SHA1 58e346f0dacf2101f7a8c034aceb585805cb5030
SHA512 6ff454c8b4813619f12508fb7201860a317535a3251fc32125b99c706c31b8071500370cb3980e07d96ae940efe51cc5dec6c0cb696d4c39b4ea047b6a26e309
SSDEEP 24576:dCYNHygULhNSzd1RI9VZ8TFcJ+W0JmEo4:dCYtohUyaTFxmE
TLSH
T17705F11FA2AC1DE4D17BA17989C2860DF2B27866131192CF05F0827A1F17FE5BD3AB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 d762aa33dfc2b84f9faba11a964f82f3bc6beeaeefb66c68bc75d1addab34b6a
MD5 fa415c7e4254271848c1eee03a3f01f9
SHA1 d6ac4307a5afbdb3fb94ea1ffcbd72d931da7038
SHA512 5e957963c88fb8f08f503272d4f5b49357252d488751171e5a909a8e438e8dc44094468e44b8ceb72a1b6927ae74a17df88b85f570c76062698b8f32a5b4c128
SSDEEP 24576:/aXoJjNYH84VVSNAApoEO466aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKr:/aXoJJYH84VVS6AmEFJas+cHBjSSKHPZ
TLSH
T1FC65BF9EA2BC08E8D5BBD17DC5C24506F5B178661331CACF026182BA7F17AF19E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bd60c93e4fcac4c6a227c41b8d652fb4064bb7f860b8aa88798a7844110b6a8d
MD5 6782548382e416ebd43aca61c67db925
SHA1 c0f61d91d220e7d16c1555635fc87d6cb76e3a83
SHA512 0007b97ed426ae5513a34fce0c02772094c3b21d6b27b91e100d7eadf7043a088b2d2e617bf53d4c036636ddcdc5061b4cfd782b8d6511035b8aa6919f1485c9
SSDEEP 24576:mv7Xbxd9Tuycf8M/TYlSux/r2PCRgULhNSzd1RI9VZ8TFcJ+W0JmEo4:mDLL9TuJ0M/TYn2P6hUyaTFxmE
TLSH
T1CD858D5EA2EC42D8E0BBD6BD85B79147FAB2B855173081CF0291856E1F23BF0593DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 3030df76768f5e69d2423b169782ba4e9f8dcfb944a4f873a67435336a88f7fc
MD5 c23684ea3d6ddce45556fb0d7de9ea25
SHA1 0930591f9617ca8a0541686cad80e3a9e448eb09
SHA512 6e4df7ece18dbd6d382a2fe670cc1b70bb2f018b147ad6eb902469e2beb8cb78eb33cc2e5d9167f30a144eb186e0310f9afc917c2b6f2b5a612c2faa18b8718f
SSDEEP 24576:+egJgpwJOmPOHWAK28ZguIGyPsxr5Vin10wuNgULhNSzd1RI9VZ8TFcJ+W0JmEo4:+ngOJOmPOHFAhUyaTFxmE
TLSH
T1AC55CF2FB7BC19D5D07EC17D89928916F6B0782603355ACF05A0827E5F1BEE46E3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 1800adda4c821473bdf6e21c53abe3b54ca06f277bc29ed387b35cd54ce7e532
MD5 a18a30a7fe356a05b17ee709411bce0e
SHA1 1df1529124b7e7a8c2a64b4dd6dd5df0fc2f2569
SHA512 bf06afe1ee893ef26bba539aeff9a4ec89275b746a96e8e9321efc5ce539c68315c4fc9b81695a5373dc5d1b6a24fff526a4282badb8b6c96b1ad1a7c6356623
SSDEEP 24576:yTJnJiuS3R3wa64JrOtgULhNSzd1RI9VZ8TFcJ+W0JmEo4:yTJnJjyR3K4lkhUyaTFxmE
TLSH
T1A715D02DD2A810E8D0B7C2B4815A1B5AFF71347C2B2169CB19B4D5313F12FE0AA79F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f99a393c9dbc4c7ce372c4f3ab081de159d7c7e8cc1bbf507517ad2d848c8e47
MD5 5f276a751a28138044c13f8b9c469f62
SHA1 7cc794ff3a7d512bd3fd8dfcbb2229581c5872e5
SHA512 df7baf23f064f8dc0556beb9f2c64749e7df1374379fafaee2ff91680112eee868051b043bfa65a9d1352a1079a07ed642f779c6a4c583e5e315f60b6f42f938
SSDEEP 49152:K9EqCzDScAZmlvTcFg8Ph6ZhUyaTFxmE:GJxmE
TLSH
T1D6A55D05F7EB5298E8B3CAF1C96294159B327C509B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 704KB
SHA256 9cf79eab8e85b8cd159075bd579e3275a06097168d61edebf90b2e9bff1477ee
MD5 88d288b1e6e9f6ce411480366c85cc8c
SHA1 f6e6aee9c96a2e62760ff515af7e2c140826632c
SHA512 2c7d63b8262445f18f46fc2036a452f374d8b99f84a91cd6eb3247f3c35be508a08f1a82c73d374102a6b8e178c22cd1238e08b09c55c5e631e9a07cbbe6580e
SSDEEP 12288:alYJeXmaakGYuEAV/fwpxULlVBNqZzZ15vdRI0cysfZWLTFcJGcKWNOdAAfuEeRS:alYJeXmaUYuEkgULhNSzd1RI9VZ8TFcC
TLSH
T17DE4228EB19C7AE4C16A51B9A8910E1CE3B1B0B1131257FF02E4C1764F97FE26E35E85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 8cdc953143bd2167df37d22af12707e608cb4a2e3e7c08687cc00b303c0c3e12
MD5 e4b48dbb425901d5da68d529842444c3
SHA1 c344bcd0c78c2701908aed39918dc731dcb709ca
SHA512 9b764f3f193f30a273da32671f5aa46de37b6fd3b73b384a04b10a4455e31a3cf315f092fdcce207029ce951871314b9c5a1277136b7390e9c6ceb17a6102b8d
SSDEEP 12288:Bjl6kyVV/fwpxULlVBNqZzZ15vdRI0cysfZWLTFcJGcKWNOdAAfuEeRQi74:BRtyTgULhNSzd1RI9VZ8TFcJ+W0JmEo4
TLSH
T1F7F41249B2D4AAD8D1F512B4AC9206689F74BC304B2187EF05E1D23F2F72BD1A531F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 a23696dfbf8611d6fae741a07df26d223412e0d4a5b1a0a5c96f3fe1ff8f7480
MD5 3d9f369c3fec0dfca7cc57d143eff3df
SHA1 3f900826573f1d7c89782c7af67413a24db95fd6
SHA512 f8adbe229c8c7d8f987f77c27ff2038beeace14c45f6054db762349d42469847d91ac6a97615fffef2c50c13b5cc4aa52113676deedda4869726cfaf8465519d
SSDEEP 12288:Mo4V/fwpxULlVBNqZzZ15vdRI0cysfZWLTFcJGcKWNOdAAfuEeRQi74:PcgULhNSzd1RI9VZ8TFcJ+W0JmEo4
TLSH
T177D4238EF184BFC8C1A112F078500E6D69F47A74577299FF05EE41725FA5BA29122CCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9cd4fa99b7097967e0b5adc0b1ac44ab7532226943aa6a9c786060b35acb9d1f
MD5 dd98613a332999f5e409f070f9503d0a
SHA1 48b390e99e78dea4b78207e425622680f8babad4
SHA512 43ad66fafce06eaf43889642398dd18ca4d6077d287fc7eb70415081387e9dbd4356244de51e80398c3ba6666e2991bb95bfee0f3c0109d4145495b98718e2d9
SSDEEP 24576:dC+TyQIu93VAumZrHjmpgULhNSzd1RI9VZ8TFcJ+W0JmEo4:d/TfIq+AHhUyaTFxmE
TLSH
T1BE558D1DA7E91DCAE276C675C8A34493EA33B472137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 a28a30b256e3a4cfc88936a2b1e5cb1543a0f86be187dbbbf0b48e90ba57131f
MD5 35df43ca089a2e8b264a0e23a5c51b4e
SHA1 c0dad18b07566437d846c285b64f0824d1c31103
SHA512 5d1d38f20782959c84e086040da24815e59fc862be5ced44fd53bbdca00311a398986b8a6cb01d9b5b836f69a6eedfa106eaeef86a65c11ddb6d0e2a57230ac3
SSDEEP 24576:/LEikZXgULhNSzd1RI9VZ8TFcJ+W0JmEo4:zEikPhUyaTFxmE
TLSH
T1EF05F10FB3AA14D5D0A7827C88814516FAB37475472267DF02E1C37A0FA76E6BD34B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c713a9a42bb4f27518b4004063ad4fe12759cb185b7d05f4c8e0577b7c89d36f
MD5 eccb7ad7743a5f2c549da4ed059f4863
SHA1 fa0005888c17a77e6f2f517e5ab24beb1cb23968
SHA512 f1dd86370a270cf6528fb104022f4adf5a8af1622a1431dffbf24dd43bafb6800038bc502d5d49bcc6872d4f0b2d439a589b7c78b157127f1181b5c2541e917f
SSDEEP 49152:YpJyV38pGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LhAPRhUyaTFxmE:CpC7b4+80GTLVxmE
TLSH
T129A57C3DE2F810ADD8AA8375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-278-0x00007FF7E3A70000-0x00007FF7E3B21000-memory.dmp

Download

memory/720-221-0x00007FF7E3A70000-0x00007FF7E3B21000-memory.dmp

Download

memory/720-219-0x0000014FFEFC0000-0x0000014FFF026000-memory.dmp

Download

memory/720-220-0x0000014FFEFC0000-0x0000014FFF026000-memory.dmp

Download

memory/772-5-0x0000000003550000-0x000000000365F000-memory.dmp

Download

memory/772-7-0x0000000003790000-0x00000000037F9000-memory.dmp

Download

memory/772-0-0x0000000003790000-0x00000000037F9000-memory.dmp

Download

memory/1188-128-0x00007FF6C5060000-0x00007FF6C52EB000-memory.dmp

Download

memory/1188-121-0x000002841A720000-0x000002841A786000-memory.dmp

Download

memory/1188-122-0x000002841A720000-0x000002841A786000-memory.dmp

Download

memory/1188-120-0x00007FF6C5060000-0x00007FF6C52EB000-memory.dmp

Download

memory/1188-126-0x000002841A720000-0x000002841A786000-memory.dmp

Download

memory/1592-296-0x00007FF6C7220000-0x00007FF6C734F000-memory.dmp

Download

memory/1592-290-0x0000017B2A890000-0x0000017B2A8F6000-memory.dmp

Download

memory/1592-355-0x00007FF6C7220000-0x00007FF6C734F000-memory.dmp

Download

memory/1592-291-0x0000017B2A890000-0x0000017B2A8F6000-memory.dmp

Download

memory/1616-255-0x0000025ABF250000-0x0000025ABF2B6000-memory.dmp

Download

memory/1616-254-0x0000025ABF250000-0x0000025ABF2B6000-memory.dmp

Download

memory/1616-260-0x0000025ABF250000-0x0000025ABF2B6000-memory.dmp

Download

memory/1616-256-0x00007FF643660000-0x00007FF643A50000-memory.dmp

Download

memory/1616-262-0x00007FF643660000-0x00007FF643A50000-memory.dmp

Download

memory/1680-172-0x000001B8A44B0000-0x000001B8A45F8000-memory.dmp

Download

memory/1680-173-0x000001B8A4600000-0x000001B8A4666000-memory.dmp

Download

memory/1680-174-0x000001B8A4600000-0x000001B8A4666000-memory.dmp

Download

memory/1736-301-0x00007FF7F3030000-0x00007FF7F31C2000-memory.dmp

Download

memory/1736-247-0x0000022808C10000-0x0000022808C76000-memory.dmp

Download

memory/1736-246-0x0000022808C10000-0x0000022808C76000-memory.dmp

Download

memory/1736-245-0x00007FF7F3030000-0x00007FF7F31C2000-memory.dmp

Download

memory/1964-160-0x00007FF60CBA0000-0x00007FF60CCB7000-memory.dmp

Download

memory/1964-251-0x00007FF60CBA0000-0x00007FF60CCB7000-memory.dmp

Download

memory/1964-161-0x000001E91C350000-0x000001E91C3B6000-memory.dmp

Download

memory/1964-162-0x000001E91C350000-0x000001E91C3B6000-memory.dmp

Download

memory/2028-203-0x000001243D140000-0x000001243D1A6000-memory.dmp

Download

memory/2028-268-0x00007FF6ABD00000-0x00007FF6ABDAB000-memory.dmp

Download

memory/2028-202-0x000001243D140000-0x000001243D1A6000-memory.dmp

Download

memory/2028-201-0x00007FF6ABD00000-0x00007FF6ABDAB000-memory.dmp

Download

memory/2108-304-0x0000023112E60000-0x0000023112EC6000-memory.dmp

Download

memory/2108-306-0x00007FF630EC0000-0x00007FF6311FF000-memory.dmp

Download

memory/2108-305-0x0000023112E60000-0x0000023112EC6000-memory.dmp

Download

memory/2108-326-0x0000023113EC0000-0x0000023113ED0000-memory.dmp

Download

memory/2108-310-0x0000023113DC0000-0x0000023113DD0000-memory.dmp

Download

memory/2108-342-0x000002311C5B0000-0x000002311C5B8000-memory.dmp

Download

memory/2108-358-0x00007FF630EC0000-0x00007FF6311FF000-memory.dmp

Download

memory/2128-266-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2128-194-0x00000000008D0000-0x0000000000939000-memory.dmp

Download

memory/2128-195-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2128-189-0x00000000008D0000-0x0000000000939000-memory.dmp

Download

memory/2392-287-0x00007FF7B7910000-0x00007FF7B7E3B000-memory.dmp

Download

memory/2392-283-0x0000023A4E2D0000-0x0000023A4E336000-memory.dmp

Download

memory/2392-354-0x00007FF7B7910000-0x00007FF7B7E3B000-memory.dmp

Download

memory/2392-282-0x0000023A4E2D0000-0x0000023A4E336000-memory.dmp

Download

memory/2956-156-0x00007FF77D100000-0x00007FF77D268000-memory.dmp

Download

memory/2956-154-0x0000015B32B00000-0x0000015B32B66000-memory.dmp

Download

memory/2956-148-0x0000015B32B00000-0x0000015B32B66000-memory.dmp

Download

memory/2956-149-0x0000015B32B00000-0x0000015B32B66000-memory.dmp

Download

memory/2956-147-0x00007FF77D100000-0x00007FF77D268000-memory.dmp

Download

memory/3024-263-0x00007FF67ED10000-0x00007FF67EE57000-memory.dmp

Download

memory/3024-181-0x0000020382E10000-0x0000020382E76000-memory.dmp

Download

memory/3024-183-0x00007FF67ED10000-0x00007FF67EE57000-memory.dmp

Download

memory/3024-182-0x0000020382E10000-0x0000020382E76000-memory.dmp

Download

memory/3276-180-0x00007FF72E140000-0x00007FF72E227000-memory.dmp

Download

memory/3276-29-0x000002B716D00000-0x000002B716D66000-memory.dmp

Download

memory/3276-27-0x000002B716D00000-0x000002B716D66000-memory.dmp

Download

memory/3276-26-0x00007FF72E140000-0x00007FF72E227000-memory.dmp

Download

memory/3548-295-0x00007FF6BCBC0000-0x00007FF6BCDAF000-memory.dmp

Download

memory/3548-237-0x000001EA069E0000-0x000001EA06A46000-memory.dmp

Download

memory/3548-239-0x00007FF6BCBC0000-0x00007FF6BCDAF000-memory.dmp

Download

memory/3548-238-0x000001EA069E0000-0x000001EA06A46000-memory.dmp

Download

memory/3584-353-0x00007FF76A400000-0x00007FF76A8CB000-memory.dmp

Download

memory/3584-271-0x0000016F6AA40000-0x0000016F6AAA6000-memory.dmp

Download

memory/3584-272-0x0000016F6AA40000-0x0000016F6AAA6000-memory.dmp

Download

memory/3584-277-0x00007FF76A400000-0x00007FF76A8CB000-memory.dmp

Download

memory/4088-281-0x00007FF627070000-0x00007FF627334000-memory.dmp

Download

memory/4088-227-0x0000023DD4EA0000-0x0000023DD4F06000-memory.dmp

Download

memory/4088-228-0x0000023DD4EA0000-0x0000023DD4F06000-memory.dmp

Download

memory/4088-229-0x00007FF627070000-0x00007FF627334000-memory.dmp

Download

memory/4280-141-0x00000254776F0000-0x0000025477756000-memory.dmp

Download

memory/4280-139-0x00000254774D0000-0x0000025477618000-memory.dmp

Download

memory/4280-140-0x00000254776F0000-0x0000025477756000-memory.dmp

Download

memory/4304-350-0x00007FF66CEE0000-0x00007FF66D19E000-memory.dmp

Download

memory/4304-267-0x00007FF66CEE0000-0x00007FF66D19E000-memory.dmp

Download

memory/4460-365-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4460-359-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4460-366-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4460-367-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4460-368-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4460-363-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4460-369-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4460-362-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4460-370-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4460-361-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4460-371-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4460-360-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4460-364-0x000001AE27C70000-0x000001AE27C80000-memory.dmp

Download

memory/4628-15-0x00007FF697310000-0x00007FF6973F7000-memory.dmp

Download

memory/4628-16-0x000001DE9F100000-0x000001DE9F166000-memory.dmp

Download

memory/4628-159-0x00007FF697310000-0x00007FF6973F7000-memory.dmp

Download

memory/4628-18-0x000001DE9F100000-0x000001DE9F166000-memory.dmp

Download

memory/4680-273-0x00007FF6765F0000-0x00007FF676A1C000-memory.dmp

Download

memory/4680-211-0x00007FF6765F0000-0x00007FF676A1C000-memory.dmp

Download

memory/4680-210-0x000001AB6F9B0000-0x000001AB6FA16000-memory.dmp

Download

memory/4680-299-0x00007FF6765F0000-0x00007FF676A1C000-memory.dmp

Download

memory/4680-297-0x000001AB6F9B0000-0x000001AB6FA16000-memory.dmp

Download

memory/4680-209-0x000001AB6F9B0000-0x000001AB6FA16000-memory.dmp

Download

memory/5024-132-0x000002DE8F540000-0x000002DE8F5A6000-memory.dmp

Download

memory/5024-133-0x000002DE8F540000-0x000002DE8F5A6000-memory.dmp

Download

memory/5024-131-0x000002DE8F320000-0x000002DE8F468000-memory.dmp

Download