9180f129bd690efd79093ffd01b7978d747307620538161b12d4747510e1cb91

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.8MB
Sample260522-daaslafx91
SHA256 9180f129bd690efd79093ffd01b7978d747307620538161b12d4747510e1cb91
MD5 16c045f522b89eadb35a8424ec1ec529
SHA1 b04e70398e5ec880ca794695f419c257011d666a
SHA512 1f20028e361718e3daa549a65554c18c9a286aaf2be9d00acd8a444d2ce06302624696c06200e85e170154336af0e15072a5dc13925d0948ac8311f4afd5c3d8
SSDEEP 49152:nNZCWOLT4J2GMkmgK2MtENZAg+jtlKkVP:NwnLTbGMPKAzbKkp
TLSH
T175855B1667F95128F1F33B71EEB992645A77BC71AE3AC50E6280025E0DB4E50DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4212	alg.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
2560	fxssvc.exe
5932	elevation_service.exe
6128	elevation_service.exe
6064	maintenanceservice.exe
1500	msdtc.exe
4788	OSE.EXE
5480	PerceptionSimulationService.exe
2024	perfhost.exe
4276	locator.exe
2484	SensorDataService.exe
5436	snmptrap.exe
3100	spectrum.exe
132	ssh-agent.exe
1028	TieringEngineService.exe
1416	AgentService.exe
3808	vds.exe
876	vssvc.exe
5512	wbengine.exe
3096	WmiApSrv.exe
4612	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f6612c56ee2c9d24.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a03ee07795e9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a4bc97695e9dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c3fc17795e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001837d57695e9dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006623e17695e9dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044acea7695e9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f51f37795e9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	2560	fxssvc.exe
Token: SeRestorePrivilege	1028	TieringEngineService.exe
Token: SeManageVolumePrivilege	1028	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1416	AgentService.exe
Token: SeBackupPrivilege	876	vssvc.exe
Token: SeRestorePrivilege	876	vssvc.exe
Token: SeAuditPrivilege	876	vssvc.exe
Token: SeBackupPrivilege	5512	wbengine.exe
Token: SeRestorePrivilege	5512	wbengine.exe
Token: SeSecurityPrivilege	5512	wbengine.exe
Token: 33	4612	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4612	SearchIndexer.exe
Token: SeDebugPrivilege	3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3408	2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 4292	4612	SearchIndexer.exe	106
PID 4612 wrote to memory of 4800	4612	SearchIndexer.exe	107
PID 4612 wrote to memory of 2508	4612	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_16c045f522b89eadb35a8424ec1ec529_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3408

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4212

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2772

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6128

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6064

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1500

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4788

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5480

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2024

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2484

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5436

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:132

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:876

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5512

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3096

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4292
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2896 2900 932 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4800
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2920 2868 932 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4301eeae02a757d3f19f56c01a3fb7053c6bde7eabea776f9e1b9fb55adf3f15
MD5 a99ac06abb2fce3d7c2ec97ec96f9712
SHA1 c4ffd60c326f5a259d0c19000ac9d0d50b0a983e
SHA512 9a96b7b0810c31ab3994b7042d1a23df54b9278c64c3da0d9f3ac03acd5745e4f8a96778f2445a8c66e99bbdf7b038c4300ebe98af07831b1cabb7b319127fc6
SSDEEP 49152:DI2632BuPkFKRrdE6oh7stBhuXjfS4LWxn4Ag+jtlKkVP:G3q6gjBHAzbKkp
TLSH
T1ABD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 1ab926fb50924a193975d396359d3759d84b22b57329663e8f23f3e6e23892d6
MD5 6fe497e5debf46e07527d754f8996b0b
SHA1 944d7700584813fb0f47eb4ea59c9e36096397dd
SHA512 52046fe18b06e2bae049cf88a8830eb0ea79f0b3772b44aebb5bfd3054d5178033c7e60477a52e4cfc9af2fb6c49bb33f3ba8162f1253e79db7741d5576500ce
SSDEEP 12288:O1XLsLuYkxw2lRq2czAzvFxYgTwo01IzrMZrLBTz5+mFFp/AilYYYLNgo6V/3:8XYqJjczADAgT16nXTt+m9oY66VP
TLSH
T1A4050128B3E508F9DD2B827CCDA2C515E67378114364EA9B03E489791F633D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 b03d6fbb5a5b4653f26bea0752213b5d2a6a02e7fef57b6ac416faea0e4006df
MD5 0b9ba47c09c62fc5d3e2d5a7a846d29b
SHA1 d9183d9af7e5f824d70e82351867e37b9be2d731
SHA512 0e8210dd9336634068038112b864b31dbb62c834d4f17b7035b3a9cb09f09b43c3e902f408e8f7007849baecae3e05069f929f13b6986be1d8cbb73e10704611
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+CdvFxYgTwo01IzrMZrLBTz5+mFFp/AilYYYLNgo6V/:UwusOWmAgT16nXTt+m9oY66V
TLSH
T10805F10673A91CF9E56B82388A97C135F7F2B8112625CB1F1360C65B5F77361BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 62c8fa003b174dbb258871b7bceecd92d2580b06b3e2d7c3e91f42d455def8af
MD5 caeef8c808f3186f0aa8e0959691537a
SHA1 c7f417aa2a03317c845766b03143b6ac0774cece
SHA512 98677b18ab83d3f3304d86f27795f69e21fbfd813b4df100a450f2a4f79334a16d9ad5fc00456b680cbacf88c63956d060a808806b58fdc9d76683f962e3fcf7
SSDEEP 49152:oy+taZ3usBWOBr4tEGp0bqx0z+n217aau1glxAg+jtlKkVP:1u6JmTxd2dxAzbKkp
TLSH
T190D59D13F2DA01E8D05ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 026bd360655a09e45c86a37ef595140ddb583aadb7641b490f712c9209aa96a8
MD5 b44a43021cf98c6f4170d6522346c213
SHA1 eed1541cbdc4c544d89450d9fc405e6419fc48fc
SHA512 809f539eea58cdacc7fdb6c57d26d610de002f983dbe4890b54201151cc2e3ecca16d5b1bae76a0a9335fd105408376512cebd661ea1e5e360b80bbdbf4dd70c
SSDEEP 12288:7FvFxYgTwo01IzrMZrLBTz5+mFFp/AilYYYLNgo6V/3:7pAgT16nXTt+m9oY66VP
TLSH
T119D42311E32DEC09C22F86B41E99D27830A57B34972984DBB34A016C57F87E5EE32B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 943a23710efd7c490d88982a91c45f4217c660a0750e8dcc61ae68c2d4bc6f88
MD5 4096f25481a410abd6a4f2e6a0b84314
SHA1 fa15782548f36dd4af3a76443d6947fad68b0619
SHA512 66254bd9f76ce258bc18aacf8c7b62d2747d7b3f4256ce3c7f4a03a7f1ab84339f58926c18314b45a9d23c13ba3b11961ed50e201b74150a163f7b264fd73d38
SSDEEP 24576:TgRMyNoSFw1d+rC4vrmRcGPiQEaTPnMRTC5AgT16nXTt+m9oY66VP:8RZwQCyiHiQEaTPnMkAg+jtlKkVP
TLSH
T1AF85B01E63DC46A4E0BAD278CDA74407E6B27816473197CF1291C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 700KB
SHA256 cc7bff30a964722c15dbb6b66a4054316f1d38c23e60acac485dcb3f14443eb1
MD5 4bfee0df2bc4a27c88ef47f915034920
SHA1 3bae1b48c773a8317576966d6e665c746a65c320
SHA512 fe6ec4d9a4b6510818987a42aefae4f11a40f7c4d6c6fce927a1f15375206dcb589764f47ed30d298f17a023f6b0b05cacdac066143584e601ce0fc18816475b
SSDEEP 12288:ORxA1U7KnvFxYgTwo01IzrMZrLBTz5+mFFp/AilYYYLNgo6V/3:ORxA1UGvAgT16nXTt+m9oY66VP
TLSH
T180E4122E63AC28A4E13AD27D8DD18205D3717925133597EF22C5827D0F6AFE4AD32F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 405479eb7c8210b4300adc7dd305a40b031905bbffb1c284da37c28cc375d75f
MD5 ac01fd059906e65389586723f04beb7c
SHA1 b6348c74a8ff3c541756c266c1648da60c1f3dcb
SHA512 de9cda89fb71b8ed9025295d40b9bb07500cc244a1dfac767e2f8a77130c866e1cff5f239fdc013613bbace73b831b0d06b99dd5f9da77f2666f3d1d6387ba4f
SSDEEP 24576:8GsmP0yHaqrVqHra44KDzM+rn2AgT16nXTt+m9oY66VP:8GRP0yHfVqzlA+rn2Ag+jtlKkVP
TLSH
T1A955BF2EF2B910B9D4AAC176454107B5BB71782D1F209ACB0170C634AF0AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 5da25c20fff8218d44d2150dc17c48f175f1826bcb4e60c202d59f6967b410f2
MD5 a6792c90991333ca7b16570f312787b4
SHA1 774812f257024d5f78d6c5667750bf3931f4ce26
SHA512 cd418fce5ba084d383afacbcdde34c366a434cb2829aa93a9fd657b2ebc937604b0c007bee3f9d15e82d38c4682a9813916c7a56302fc5932f6acc4ca57cd5cc
SSDEEP 12288:E34vFxYgTwo01IzrMZrLBTz5+mFFp/AilYYYLNgo6V/3:EYAgT16nXTt+m9oY66VP
TLSH
T171D42315A32EEC19C21F86F91E94979830E13B34933E44AA734A017C57DD7E6A633B98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 962KB
SHA256 0306e077873ab6ce0c8cef1fa8ada8ad0c134e4cb38271cd7d764caf268834c5
MD5 60d30c8f383dcedb3140322e26e352e9
SHA1 1e75dfc506018590d5020f2b0ed312b799cc27a3
SHA512 411e570a35e94b187831ee83fe2722755681a62c58dadca724643b0e773c42712df44d8d155c7857aea789eb659dc9e4fcdf9d3ba1f6deded7d0472695df3576
SSDEEP 12288:ZObzA4LWO+vAYFTzvFxYgTwo01IzrMZrLBTz5+mFFp/AilYYYLNgo6V/3:OHLBUTDAgT16nXTt+m9oY66VP
TLSH
T1CA250215F7A544F9D92BC13CC9A28A16E2B2785D0364E7DF03A84B691F537E24E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 5d314c3ca10357e33c4d2ed031137b199a8d2c55524288bc60ba5b1858173a96
MD5 cd26d4ae8c1efdf33d8feb8541e51ea1
SHA1 dd3f22435d12a3eb332deb9ab73dbffe2cb530bd
SHA512 1364adc263ceb27dd923fd3f337b998672e3de7c9196da74db530975c19ff029b8b36e823253f3e144beb6d4f4264a62ceb01e1b00110bc7b95898ca4a8ef429
SSDEEP 12288:DrVmzIYNvUyBpJvFxYgTwo01IzrMZrLBTz5+mFFp/AilYYYLNgo6V/3:HTYNHrAgT16nXTt+m9oY66VP
TLSH
T13705F12EA26D1CE4D53F917D8EC28209F2727866131192DF11A0827E1F57FE9BD3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 6afca66c4f9c18ba248e41eed49d3d96d4dd9278f73089cd73d37b802ce36960
MD5 13be2b1c7ac1d14392bbf600effd0a0d
SHA1 1506fb0bad6bed05c2a046d09d1e1968e16f6ad6
SHA512 2c6351c8ed966a15a0e6788844217aa8d2a5e00d027c5526320d67a60737c8ebb37a1758ba44da47feed1d810c2e717e773622bd6141e4652ed132843cc2cc15
SSDEEP 24576:LnXoJjNYH84VVSNAApoEO466aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKJ:LnXoJJYH84VVS6AmEFJas+cHBjSSKHPZ
TLSH
T19C65BF6EA2BC04E8D5BBD17DC5C24506F5B178221335CACF026182BA7F17AF5AE35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9bb67cf8093ad80fe37aac7accf3171f378d9f38dba406f411f5512fff2acf5a
MD5 6b0c3e1cabaf27ff3834bb7a71aaede3
SHA1 55124623d9964b4ab1ac79f6f917eeff245d88a3
SHA512 34535147654bbdb09364e41e59d16c9e90076d80002ddd9750a8fdc40489ddd103d438c90f0e711b431aabf061bb6a1d82e14d70dad0229ae4711559d7c79ee3
SSDEEP 24576:4v7Xbxd9Tuycf8M/TYlSux/r2PCvAgT16nXTt+m9oY66VP:4DLL9TuJ0M/TYn2PCAg+jtlKkVP
TLSH
T152858D1EA3EC42D8E07BD6BD85B79146FAB2B855173081CF1291856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 039ed6218be444235161de0ab82c264b0ae3ad86e45f6e0681aa830248104cfc
MD5 4ca69af6d07789058fe98c0e55deb99f
SHA1 baea8b7a714a0bccdacedc31a30efbb368b9d95e
SHA512 dfab15dae9847526f3175f572f6aabb00e448c1c1315915c1bb5e695875513b3b082a7256434705cd6c4ff1d6cd2d22e3b4939cd46ad14157c852062ae2c0a71
SSDEEP 24576:fegJgpwJOmPOHWAK28ZguIGyPsxr5Vin10wCAgT16nXTt+m9oY66VP:fngOJOmPOHFCAg+jtlKkVP
TLSH
T1FC55CF3FA7BC15D5D03EC17D8A968916F6B1782603355ACF01A0827E5F1BEE46E3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 60d9d36f135c8443c2033ba0fb406cd3686b37b259039d68b95b5d54610b9699
MD5 1f4641675a0af94553b46cc0e61081d2
SHA1 9489270257b2a773e24b6b9240dc74604f16e0e9
SHA512 0ae09e381aab4230570e3f3d4e8918efe8fa96762c3a6a271bfe465f18930d9f77c667f489226864c089aeac99790ea411a8d0f34b6c27837f0699ee948186cf
SSDEEP 24576:JGJnJn8k3R3waE4JrOdAgT16nXTt+m9oY66VP:JGJnJ88R304l+Ag+jtlKkVP
TLSH
T1A815E02DD2A810E8D477C2B4865A1796FF71343C2B2569CB69B4C5353F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e12d68ba120500cf866fb6afe96a58ca995c84278ea1e394634ada212b10ccb7
MD5 e4aca7639688fa6807eba22646d6487a
SHA1 8f0fbab993a7bca4b58793c528b72e186cff1d7c
SHA512 b79decbc32b5dee9a98c72e71db86052bb3ef100ea206d0a232e1dffc53fa82d7876778000da1bd2fd43f2ed4c964c326baa300eae5fbb3e3973ffaf2e782107
SSDEEP 49152:+9EqCzDScAZmlvTcFg8Ph6zAg+jtlKkVP:q8AzbKkp
TLSH
T15CA55C05F7EB5298E8B3CAF1C96294159B327C509B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 700KB
SHA256 4449c8c45bc771e032e7ea74a8f3a8f629060f0e3b59adc9fffbfa2752b37448
MD5 6b0299a9b721f943a3189bc80b253842
SHA1 c6aba2771726cc1a8c69ffb8cd1672ed3e7668e9
SHA512 33ebf6353dc0a8fd236c3089c1098df72a540b21cb3ae259630ba5b5781bab6fc9c3e34fc96a45859f49ed2cb0281817d17c33564e338d0734d321411d610849
SSDEEP 12288:10YJeXmZgk0UuE9vFxYgTwo01IzrMZrLBTz5+mFFp/AilYYYLNgo6V/3:10YJeXmZEUuEBAgT16nXTt+m9oY66VP
TLSH
T1D1E4121D736D70A8D22F81B99E918648E3B1B130132657FF62D0817D4F9ABE62E35F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 7161cdd6500c02d5ba1a38abf8a426367da8455425ed9ae333a9dd5a12a7f7d1
MD5 e2029623d57c86a6435d45f4543be5b1
SHA1 c6b9fc810424cb5359af770a1b362d194264c6a8
SHA512 34860bc26a9ee3fb4c00087d6f8e9ea234915dc5ba1f2f2e4ba717398f32bff9c11f0d1a26bd185df7461474d8a977e1bad0ce29bb28cd67417926c8e152e993
SSDEEP 12288:x0R6ky/vFxYgTwo01IzrMZrLBTz5+mFFp/AilYYYLNgo6V/3:x6tynAgT16nXTt+m9oY66VP
TLSH
T1CCF4230473A8A458D63F46789EA282D49A717E309B2446EF72C1C63E2FB67D0BD31F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 0d8a728e9c3a077b84b8aa9666df65a7dcfdf934441f6cd788e6e2d3772d6e20
MD5 97ffdea1784167e17bcc9fa7fa0503e4
SHA1 2263018465ef3625508a3dc93e3bee8c70e70581
SHA512 c22ee4bf00bf62286ce5e9e82ccd59bf266b62f136646314f5352a680843b7d218a313a491f2523c1aa2134803ede9462afe7783c47d549ba3ef8924466c2098
SSDEEP 12288:LcYvFxYgTwo01IzrMZrLBTz5+mFFp/AilYYYLNgo6V/3:IoAgT16nXTt+m9oY66VP
TLSH
T140D42319633ABC18C60F86F81E55569820F53B30933958BF73CA417C87E97A5A632F9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 bcc157d1dccbc355c24fec4945c5b19c2e20856e82d38154a8c533c1069beadd
MD5 72801187dddccc866e7ded48532b53f0
SHA1 c06d87723dd6c88eea7f1a51b6394a0b3f173380
SHA512 3a58f837e9a66c344dcb2486a9bd0af36a28116861a22d1e9e070c627bcd543324d28d561fa25c3fedbc421a9f6b1dc85806f56872c77a848cca436daba10ff5
SSDEEP 24576:2C+TyQIu93VAumZrHjmlAgT16nXTt+m9oY66VP:2/TfIq+AlAg+jtlKkVP
TLSH
T1FE558D1DA7E91DCAE276C67588A34493E533B872137186CF2044C07D4A9EFE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 be960474a9ee2751673e14ccc4f490bf8487109348f3195d3e5b810771d9c448
MD5 ea0845801b8dd9d10b4d46e9f4483aaa
SHA1 e18b4af276e08794f9aa56a734199e63f87dd56a
SHA512 9219b9f7ff216ee263abc611da59181a6ca808fe4c637b9634f6320faffff039ec4cf2cd1c32c71d7c38d89876a93c1d10493d316027a771da5cf8c49afb3a0d
SSDEEP 12288:tDnWxjstaa3kcs5vFxYgTwo01IzrMZrLBTz5+mFFp/AilYYYLNgo6V/3:OwQikZ1AgT16nXTt+m9oY66VP
TLSH
T18205F10FB36E10A5D16BC27C88854255F6B37430532267EF1291C77D0BAB6EABD38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bce31bc0f7567be5725e940c3978da1d28dd2a21d2e6248033e82a3061dcc4a7
MD5 7f103b7bc51c268629afe05088b2c98e
SHA1 29a2a645fd910f495538dc155b3ea2d6c23eda02
SHA512 5befb2f5deb1ebd98ea9e4ca1f5f20c817154fa4544df68e17d87caf3de2c6abcf45cf99b45078087c3c12c2fb153f6f7c622565261ce02b2b8e8ae2f3603e70
SSDEEP 49152:wrJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LhAPgAg+jtlKkp:HpC7b4+80GTL3AzbKkp
TLSH
T125A57C3DE2B8106DD8AAC376C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/132-239-0x000001A767DA0000-0x000001A767E06000-memory.dmp

Download

memory/132-342-0x00007FF69C210000-0x00007FF69C3FF000-memory.dmp

Download

memory/132-237-0x00007FF69C210000-0x00007FF69C3FF000-memory.dmp

Download

memory/132-238-0x000001A767DA0000-0x000001A767E06000-memory.dmp

Download

memory/876-353-0x00007FF6FD720000-0x00007FF6FDBEA000-memory.dmp

Download

memory/876-270-0x0000018028D90000-0x0000018028DF6000-memory.dmp

Download

memory/876-271-0x00007FF6FD720000-0x00007FF6FDBEA000-memory.dmp

Download

memory/876-269-0x0000018028D90000-0x0000018028DF6000-memory.dmp

Download

memory/1028-245-0x00007FF7FE000000-0x00007FF7FE191000-memory.dmp

Download

memory/1028-346-0x00007FF7FE000000-0x00007FF7FE191000-memory.dmp

Download

memory/1028-247-0x00000248FF680000-0x00000248FF6E6000-memory.dmp

Download

memory/1028-246-0x00000248FF680000-0x00000248FF6E6000-memory.dmp

Download

memory/1416-259-0x00000248FCAC0000-0x00000248FCB26000-memory.dmp

Download

memory/1416-258-0x00007FF7024E0000-0x00007FF7028CF000-memory.dmp

Download

memory/1416-254-0x00000248FCAC0000-0x00000248FCB26000-memory.dmp

Download

memory/1416-253-0x00000248FCAC0000-0x00000248FCB26000-memory.dmp

Download

memory/1416-261-0x00007FF7024E0000-0x00007FF7028CF000-memory.dmp

Download

memory/1500-161-0x000002AFCF2C0000-0x000002AFCF326000-memory.dmp

Download

memory/1500-160-0x000002AFCF2C0000-0x000002AFCF326000-memory.dmp

Download

memory/1500-159-0x00007FF68E4A0000-0x00007FF68E5B6000-memory.dmp

Download

memory/1500-264-0x00007FF68E4A0000-0x00007FF68E5B6000-memory.dmp

Download

memory/2024-188-0x0000000000880000-0x00000000008E9000-memory.dmp

Download

memory/2024-193-0x0000000000880000-0x00000000008E9000-memory.dmp

Download

memory/2024-276-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2024-194-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2484-214-0x00007FF7DA730000-0x00007FF7DAB5B000-memory.dmp

Download

memory/2484-351-0x00007FF7DA730000-0x00007FF7DAB5B000-memory.dmp

Download

memory/2484-349-0x000001D6D54A0000-0x000001D6D5506000-memory.dmp

Download

memory/2484-209-0x000001D6D54A0000-0x000001D6D5506000-memory.dmp

Download

memory/2484-210-0x000001D6D54A0000-0x000001D6D5506000-memory.dmp

Download

memory/2484-289-0x00007FF7DA730000-0x00007FF7DAB5B000-memory.dmp

Download

memory/2560-128-0x00007FF632B90000-0x00007FF632E1A000-memory.dmp

Download

memory/2560-121-0x000001C841F90000-0x000001C841FF6000-memory.dmp

Download

memory/2560-122-0x000001C841F90000-0x000001C841FF6000-memory.dmp

Download

memory/2560-120-0x00007FF632B90000-0x00007FF632E1A000-memory.dmp

Download

memory/2560-126-0x000001C841F90000-0x000001C841FF6000-memory.dmp

Download

memory/3096-287-0x0000021C4E6A0000-0x0000021C4E706000-memory.dmp

Download

memory/3096-357-0x00007FF79B240000-0x00007FF79B36E000-memory.dmp

Download

memory/3096-290-0x00007FF79B240000-0x00007FF79B36E000-memory.dmp

Download

memory/3096-288-0x0000021C4E6A0000-0x0000021C4E706000-memory.dmp

Download

memory/3100-229-0x00007FF789A70000-0x00007FF789D33000-memory.dmp

Download

memory/3100-228-0x0000024256D40000-0x0000024256DA6000-memory.dmp

Download

memory/3100-227-0x0000024256D40000-0x0000024256DA6000-memory.dmp

Download

memory/3100-300-0x00007FF789A70000-0x00007FF789D33000-memory.dmp

Download

memory/3408-0-0x0000000001B60000-0x0000000001BC9000-memory.dmp

Download

memory/3408-7-0x0000000001B60000-0x0000000001BC9000-memory.dmp

Download

memory/3408-5-0x00000000033B0000-0x0000000003517000-memory.dmp

Download

memory/3808-352-0x00007FF7483A0000-0x00007FF74865D000-memory.dmp

Download

memory/3808-265-0x00007FF7483A0000-0x00007FF74865D000-memory.dmp

Download

memory/4212-179-0x00007FF7E2660000-0x00007FF7E2746000-memory.dmp

Download

memory/4212-15-0x00007FF7E2660000-0x00007FF7E2746000-memory.dmp

Download

memory/4212-16-0x0000020DEA190000-0x0000020DEA1F6000-memory.dmp

Download

memory/4212-18-0x0000020DEA190000-0x0000020DEA1F6000-memory.dmp

Download

memory/4276-278-0x00007FF742000000-0x00007FF7420AA000-memory.dmp

Download

memory/4276-201-0x00000184391D0000-0x0000018439236000-memory.dmp

Download

memory/4276-200-0x00000184391D0000-0x0000018439236000-memory.dmp

Download

memory/4276-206-0x00007FF742000000-0x00007FF7420AA000-memory.dmp

Download

memory/4352-27-0x000002C2F6BC0000-0x000002C2F6C26000-memory.dmp

Download

memory/4352-26-0x00007FF7F5D10000-0x00007FF7F5DF6000-memory.dmp

Download

memory/4352-205-0x00007FF7F5D10000-0x00007FF7F5DF6000-memory.dmp

Download

memory/4352-29-0x000002C2F6BC0000-0x000002C2F6C26000-memory.dmp

Download

memory/4612-358-0x00007FF67B7E0000-0x00007FF67BB1E000-memory.dmp

Download

memory/4612-298-0x0000023DBD1D0000-0x0000023DBD236000-memory.dmp

Download

memory/4612-305-0x0000023DBE140000-0x0000023DBE150000-memory.dmp

Download

memory/4612-299-0x0000023DBD1D0000-0x0000023DBD236000-memory.dmp

Download

memory/4612-337-0x0000023DC6930000-0x0000023DC6938000-memory.dmp

Download

memory/4612-301-0x00007FF67B7E0000-0x00007FF67BB1E000-memory.dmp

Download

memory/4612-321-0x0000023DBE370000-0x0000023DBE380000-memory.dmp

Download

memory/4788-171-0x0000019E699C0000-0x0000019E69B08000-memory.dmp

Download

memory/4788-173-0x0000019E69C30000-0x0000019E69C96000-memory.dmp

Download

memory/4788-172-0x0000019E69C30000-0x0000019E69C96000-memory.dmp

Download

memory/4800-375-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/4800-364-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/4800-365-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/4800-366-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/4800-367-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/4800-368-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/4800-369-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/4800-370-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/4800-372-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/4800-374-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/4800-376-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/4800-373-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/4800-371-0x0000019C6E760000-0x0000019C6E770000-memory.dmp

Download

memory/5436-219-0x00007FF7B05D0000-0x00007FF7B0680000-memory.dmp

Download

memory/5436-221-0x00000221B38B0000-0x00000221B3916000-memory.dmp

Download

memory/5436-220-0x00000221B38B0000-0x00000221B3916000-memory.dmp

Download

memory/5436-295-0x00007FF7B05D0000-0x00007FF7B0680000-memory.dmp

Download

memory/5480-268-0x00007FF72D790000-0x00007FF72D8D6000-memory.dmp

Download

memory/5480-181-0x000001D3AC8A0000-0x000001D3AC906000-memory.dmp

Download

memory/5480-182-0x000001D3AC8A0000-0x000001D3AC906000-memory.dmp

Download

memory/5480-180-0x00007FF72D790000-0x00007FF72D8D6000-memory.dmp

Download

memory/5512-284-0x00007FF77A000000-0x00007FF77A52A000-memory.dmp

Download

memory/5512-279-0x0000015027890000-0x00000150278F6000-memory.dmp

Download

memory/5512-356-0x00007FF77A000000-0x00007FF77A52A000-memory.dmp

Download

memory/5512-280-0x0000015027890000-0x00000150278F6000-memory.dmp

Download

memory/5932-133-0x000002122FB90000-0x000002122FBF6000-memory.dmp

Download

memory/5932-132-0x000002122FB90000-0x000002122FBF6000-memory.dmp

Download

memory/5932-131-0x000002122F970000-0x000002122FAB8000-memory.dmp

Download

memory/6064-148-0x0000027F96070000-0x0000027F960D6000-memory.dmp

Download

memory/6064-147-0x0000027F96070000-0x0000027F960D6000-memory.dmp

Download

memory/6064-152-0x00007FF752F00000-0x00007FF753068000-memory.dmp

Download

memory/6064-154-0x0000027F96070000-0x0000027F960D6000-memory.dmp

Download

memory/6064-156-0x00007FF752F00000-0x00007FF753068000-memory.dmp

Download

memory/6128-139-0x00000198D4E20000-0x00000198D4F68000-memory.dmp

Download

memory/6128-140-0x00000198D5090000-0x00000198D50F6000-memory.dmp

Download

memory/6128-141-0x00000198D5090000-0x00000198D50F6000-memory.dmp

Download