bbe15fa111a4d992376c7416e83f537dcf1ff02e2af8f435b10119f30b5a23fa

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.5MB
Sample260628-2c4epafv3v
SHA256 bbe15fa111a4d992376c7416e83f537dcf1ff02e2af8f435b10119f30b5a23fa
MD5 59a38099c0145c05d23d5a6133444326
SHA1 1f61817d85bc13c825f31c1913cbe8b4bc935935
SHA512 f825bc683f70b78bbb12057d920edea5a5207626eac15f574c3a517fa76c814e1deec31923e0ceb67a70943cb692ec2b1d068e88d0df258076aebcd5e8b7383f
SSDEEP 49152:VrxRP9sg+OqVks+J/6ZU6CENlc7dpJLrQWd:V3MnVkB69CEN6rV
TLSH
T1A0756C1267F95129F1F37BB1EEB883645A77BC71AE39C50E2281215E0DB4A40DA72733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6096	elevation_service.exe
4936	elevation_service.exe
2900	maintenanceservice.exe
3828	OSE.EXE
988	PerceptionSimulationService.exe
3796	perfhost.exe
1800	ReFsDedupSvc.exe
5676	SensorDataService.exe
4360	ssh-agent.exe
5700	AgentService.exe
3500	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1120394081289776.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102906\java.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003cfd9a4c4d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021e1cd4e4d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af4e224f4d07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006088e44c4d07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005aad004e4d07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bee26a4d4d07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f495d84c4d07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000529cd1904d07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2504	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	1800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1800	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5700	AgentService.exe
Token: 33	3500	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3500	SearchIndexer.exe
Token: SeDebugPrivilege	6096	elevation_service.exe
Token: SeDebugPrivilege	4936	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2504	2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 3124	3500	SearchIndexer.exe	102
PID 3500 wrote to memory of 4208	3500	SearchIndexer.exe	103
PID 3500 wrote to memory of 712	3500	SearchIndexer.exe	104
PID 3500 wrote to memory of 2932	3500	SearchIndexer.exe	105
PID 3500 wrote to memory of 1944	3500	SearchIndexer.exe	111
PID 3500 wrote to memory of 1104	3500	SearchIndexer.exe	112
PID 3500 wrote to memory of 6012	3500	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_59a38099c0145c05d23d5a6133444326_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3828

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:988

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3796

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5676

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4360

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3226024100-3888324339-2736661264-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3226024100-3888324339-2736661264-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2836 2820 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2880 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2880 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2836 2820 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e57a1eb11716df3086879927da8dfdfa4a22249cdb143e7222b89d960292cf28
MD5 f33985f48be55df587421da4b3f12bd5
SHA1 692402ea3943d1b1adef26011196cc052b0e1e6e
SHA512 860c21626121be1b9af3b65cb3dc236e80736fceea8dcd54dedf30c39b4ab402c18ad049c5221c0cb81712b0f0bd7ea1557fe647c99791de1485a10690106893
SSDEEP 49152:Rb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnJ6ZU6CENlc7dpJLrQWd:X3q6sjBy69CEN6rV
TLSH
T1BCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 062716c17eab67490a39f83efa2723f7eea8b5ce0e172617c0a46ac40eebbac9
MD5 89d50b8ae02fc0e4c4caa0627472787f
SHA1 47e3edc06732c02641083b964440bbf927061eb2
SHA512 c5c4640e81dbe08ad6ee2deb6c26df566e6c3d6a3ba0a190532b1aec2d520bad360692920f85bce2995b96884991523b555dc5734923b5228310ffe718049667
SSDEEP 24576:4XYfDtczAZ+L6VMRCPU6CENltmVVdpx7fLrQWd:vtcv6ZU6CENlc7dpJLrQWd
TLSH
T1E065F12867E409F5EDA7427CC8A2C511EA33BC954760EB9F03B4992A0F336D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a126026c8045979e0d96bdf720cdceeb8d87b431aa58d5c0b486d9edb27eaa2e
MD5 f71a15d02c0bf32fb3de6b2b01a0ac79
SHA1 533b05610098a0f312252767546520e3e0876037
SHA512 6ae9eca4d2f75d3848ce9ccb235223cd92e65a079a21ad8dab54404ea369412103169cdde10ffd8ac8f8a9a9438080e39aef2c70a599862b128fa249d526fd1b
SSDEEP 24576:v0Le5ji0hmxxrMK+L6VMRCPU6CENltmVVdpx7fLrQWd:vPji0Ajo6ZU6CENlc7dpJLrQWd
TLSH
T17685AE26F6744731D073C0B9C5D2A69EED7230861B308ACB4296D77C2F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 06758399f05ab4b28aebec5ebe253b1c0cfdeef04a1758387f2d2fef4cd922c9
MD5 70fd50c5daf87e31d115902dc24221b5
SHA1 515783e3e68dd9b1238388c0c4f2a25cbf11e6f9
SHA512 6feeec012748ccc03774aaaab906ed79020e28586b2ada55af78f9a3c85c0d34633ee70a445da16d2b1029c62549327a253a19af44f67c3b73d526a96d1a166d
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWn6q8wyuA+L6VMRCPU6CENltmVVdpx7fLrQWd:k/ezSC6vUzPveHjyk6ZU6CENlc7dpJLL
TLSH
T1C3755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2e29bee62fe8b7f308a47235198eb92e124c02c465ef647ebec6b18b39186659
MD5 c1b551aa42189ac5626cf8b938d1699b
SHA1 a57a8844e29bc6605e21757a5c1e1dafd6d0af0f
SHA512 006c7cad4376a2c9d9706215cd1edcb6bc7043839b40c541f0e7a4e6b00f0352b48d34a3de2600166e4ac5b99ac6e3f81a60c52452586c2342b4d98b49b221db
SSDEEP 24576:mVbqPb88hv/l+YF+L6VMRCPU6CENltmVVdpx7fLrQWd:mVO88hXl+X6ZU6CENlc7dpJLrQWd
TLSH
T15B55AF65F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 09452f3d54f88830d2b85c0a8489890d84ea7df12dc3a51a629347317b3f456e
MD5 8e240e86cff899ac119479731b375381
SHA1 175f1784c8838316c018ad14765a6a291d2aa2c0
SHA512 9e0f27c0f4076eda71f51c301aac3b7a967e036bb1454bf5c14d27066ef0867c2db05261a41a6825f35d400c3672c10cbde45b078189c6d1473eb5f2a6f88426
SSDEEP 12288:6Lt8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:6Lm+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1D345233487682D62D7F40238E1E795F1A92ABCD55B00AE1FA276790F0D398B8DC5F21D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6833cddb37061153ae6bbd6027ba9c14b950b2b30774473412d6e39211999ef2
MD5 94d77ca2cf8524677038f1676a48e01c
SHA1 afefac9bf979053a7809a55fbf474d238e451083
SHA512 5f77f0236bcbb7c6b09820ade258c3ab8dee9ad014fe222c0761ce483832f0bebd26ef7c691d58a1b542d357f9e0c4d4746027ca541ebf3861010e1ebdc45704
SSDEEP 24576:jJIU9+L6VMRCPU6CENltmVVdpx7fLrQWd:jJIUK6ZU6CENlc7dpJLrQWd
TLSH
T1BE65CF3BEE28FCE2C27A4DB85A91C640E77278704F51A7CBD175820E8E235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 976e87c97a7afcd69db7fd40cb7523214390ef28c44b87ae7032b8d037d72c9c
MD5 7d3a549d2de384715c46c5caa6c3d5c8
SHA1 8452cb585ffdeda11b94d9d8e94e6e609ff98e61
SHA512 a3eca3ec76296c437fc06f7aec23d67cc9c59feede5308cc5d66e03e64e022d27102984b6734f02a49c9e86f917731475021ba907cbdd0f93722e7ac92681eaa
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH8:7QvGAdlCEL8c/DRNw5CP69CEN6rV
TLSH
T1BE266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 9b24c13c4b4cee88e311330f1a01dd3cfcf17419453dd85816a5176d32245c82
MD5 b68cdb9a8882c061eee9409143ca2677
SHA1 83bed5c15512182997c0d4f7d40d5f833abab827
SHA512 e2cd27242016ffa7e7482d235e69044aaeb66668f7f926104aba93eca4b65f2ee6abb3ee87969cab86253fed8b50eb4c6cc1bdd5db38a41cf8377aafd1072597
SSDEEP 24576:G0ewsAjL+L6VMRCPU6CENltmVVdpx7fLrQWd:XljY6ZU6CENlc7dpJLrQWd
TLSH
T11775E031EF74E432C3BB0DB61B36C716583DB9604B511AC3E3A89D9E49342D1277AA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2bc135d75c9bfe2cf94fee501938ddf750e00fcd203f3da305f018d9d731de32
MD5 4dd70a17ad6aef699a2cf35fa59af667
SHA1 8061c5f79b451abef58c0a41189db9124b897ad3
SHA512 c734c9bee8dc59f4bf4821b5bd50863cd7ab330cb9687e4a0d3d947984c3724f37f3dc53d963f77b129d78d79d0cc50d4287e3c209dfcdffb5e685b789548a5e
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHwIm:5UEtQevvqc2W1cpV2tI32/
TLSH
T14E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2846b864b01f8df30c75c05349c28229c28b556d18e0e76b5afd8e959ce5b30b
MD5 3aa9e2c8833f2d17c89746dcd9801e70
SHA1 6d6a1345d602bc8b48eed48e09872661db270715
SHA512 09b86926f8c5a734728f34bef5421bfc6d26eb15010e662b87e6e9840bf94a4dbbe2f6b48911cedbab61253de4de2efff820ff1cdd033b9e5107ad6593b608f5
SSDEEP 49152:QCbRquA/m2yL5zTfFiV+XenmE3/z46ZU6CENlc7dpJLrQWd:5oquVjnmb69CEN6rV
TLSH
T1B1D58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4266461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a8af802d2577623ff1b9138c41268ad378e6b68083e7cd1030fd5f2563d7d659
MD5 c178d8642fa2cb4e0e6d67e6ce56b3c9
SHA1 c568816db488044208daf7459f31c57f145174d1
SHA512 48c489ad8c878d502d4ffba1497147a6c9703cf8d126327f17bf5150223ef26b6f8ee64f861e4179bf064ff8588e0de84d098abd667a44cc092b634804d4bd27
SSDEEP 24576:8AhGL3IFoiwtA5l7S53E+L6VMRCPU6CENltmVVdpx7fLrQWd:8AMUFoiq5L6ZU6CENlc7dpJLrQWd
TLSH
T16B359D81E7F915D4F5B3AA7899B69171EA76BCAA5E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1508ff45cb613ca80d9889eb81af80074ae7dd62de3e94321e04ca76241369c6
MD5 fc13753ead632b5f22bd9e4593d71bc2
SHA1 03003329ea8423d4e1941f2dbd19271b0a9285ea
SHA512 1e0fa4d186dba2bebdce354c70c9f160e9def295655f50e151c28ba164e26dd6c63124a09d8fcfce3caa8a85870b9925420c247adbb549715691d199a5548e98
SSDEEP 24576:Kwu4OW/+L6VMRCPU6CENltmVVdpx7fLrQWd:KwvOn6ZU6CENlc7dpJLrQWd
TLSH
T15C65F15567A41CF9EAA64238C597C136F7F2BC422A21DB1F5370C61B5F37260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0fe7504f3bbeafabdc24e059c82d74aba9bb0cf51e4c3496e849eefb8964a4e0
MD5 4ef7f9fc800313a4fd90f608b5365905
SHA1 269362d25c92142a47a89c1bebd41d7be2cf76a2
SHA512 bff7c441a700278303e164dfda6b03a75bc977518751389362e7845593f53692c2180b93191fee0735c07632f42c25f17a8f60121ca841da544bede8c4d64e45
SSDEEP 24576:XZuC+L6VMRCPU6CENltmVVdpx7fLrQWd:o6ZU6CENlc7dpJLrQWd
TLSH
T14C55126913E424F2E2E2023CD9E28655EB72BC96273147CF5235566E0F37AE45C3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 013e357488726d5990c40cddf97f30b6780b80c6d05726494974bff721e0860a
MD5 ab52ad3a3244e85356b02c9de6622b88
SHA1 574ab6c850375848956be41045d63a8feca94611
SHA512 a0de380aaac8e8ed4f08ccd9757133a90a0e093bcc2e3762f3b76c10e2776f14797405997cfad487173ad99d02b45809451b06478329576f1fffb1673ff87eb6
SSDEEP 98304:LQRQyi36YOcPbLvw2gAf+PN3m69CEN6rV:6QyiKa/X+PN2Im
TLSH
T133667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9d1ce0862a9f638a98afff6137563f2f48692503886650b0f4bebda7210d61e6
MD5 208737bb31f0960d72c5062cdda524cf
SHA1 85a9b0d82090f249440189e04f2d5b43506a03a2
SHA512 56bfba09b422eb694a5c3470a433e62143d7d0e6358b7196b149ad24fac7234f1b3cd8cf9cb8f07f026d0937344d89c686bfb32b855c2d7cbe1ea403e7529156
SSDEEP 98304:pQRQyi36YOcPbLvw2gAf+PN3m69CEN6rV:AQyiKa/X+PN2Im
TLSH
T12A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 230065e12ffbb830742b169d913a5090b92e7bf3ae9f38073c8e3dc4d1ee6ed5
MD5 c0e353263598748d89d7f432766bb187
SHA1 75840012305aea8878296f4af31093a6a40de0a6
SHA512 fce6bcfc1d37354d4f613e3a671a2687bd037a34e4103c38747850cfec9b60ce45af40bd50080630099aa174293a3321cfe0f0662a8ffceeec477c8d3a748ccc
SSDEEP 49152:068Qg55nhceWu7PNU3/o6ZU6CENlc7dpJLrQWd:ethLRc/o69CEN6rV
TLSH
T1CFB54933B2F600A9C44DE1769F4A872196D17C758FE0E7DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a82178bf33e5a4b58db365c3f4f1e4379ca4960baba3dbcbc1a19f3d8d1917e0
MD5 d4f642d141ef97a796d4e3c80c86565d
SHA1 7c13e7172e9dd9323318d118c1e57ffa0f9a68e0
SHA512 2b188ed3669dfb9619385bf7bcb88391b431de3287f0fb63ce6c5cc880878b6849cd0498172f29fe5a52ad802db9f552e40ce0c4e9afde8631e6b8ccb9fe0f05
SSDEEP 98304:dy5112gYy5azzVvt69nLKnhZV69CEN6rV:ALIHEWhzIm
TLSH
T1DB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6e054b79a28fbee6156d8db642d3c6ad48de6d4f2031436e7078d496c8d97928
MD5 bf35a045bfd622e5bd9edf069b53a37e
SHA1 f3250cea633a5d1bfe27a58ea96a6f4b64549500
SHA512 dd32b9174b27e17c1508eaba9beac6d54562eb7a918b1be297250be36b09b566cadb858d7b9cb711215aaf6bf2eb498908c479f0b879ce3d2440c03f8f45d33c
SSDEEP 49152:cB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glO6ZU6CENlc7dpJLrQWd:2u6Jmdxd2dO69CEN6rV
TLSH
T132D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2af3f2e6ac70fc37d53f42d8eb088b2012b700b058e937e3d68170959c13e6db
MD5 cc3ac9c0405b84eb73d238128ea85692
SHA1 f37408b819e9bb6dff5f5183d6a7f7346d4d48a4
SHA512 d0c682cbe353dc9f4484a4ef506efd2d204ae1b29b4da4796121b0831c67f33a803c26bfb22d8420b5dfe89614ed605fe54acb212ffab37dae5ff779e68ff5e8
SSDEEP 49152:b1hpsNoJpF1A63U44CwH7R4xq6ZU6CENlc7dpJLrQWd:bmifPWRb69CEN6rV
TLSH
T1E0B5AE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5eb586c358e3806a01540c3608f32af95889079d9b2e82cce9f33881d56d2fea
MD5 2aab3abb32c099cb6578b623bb022862
SHA1 93586cc82968f026dab5738d4d932dec8de8c9fa
SHA512 a9d680d8f3b7bfae1e1fe3f3741697fcf138eea3b2703a63256268152606b98388096d21fa7bf1d4c98d288979c6316ad89bf7d989dea7f68137d59939a8e2c6
SSDEEP 49152:2SuZQIY0Be2KcRVtOnks6NMHq56ZU6CENlc7dpJLrQWd:Y5dKii61569CEN6rV
TLSH
T127C5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fa0c291344cf89d49866d8d3590889aeb6a6855e4bb20d84d2d900ce3f52c219
MD5 80a0afc00765c9e6cde48adc6c119d0e
SHA1 affd38d7d2705cda97b4ae1e7628c11a6ecd97ae
SHA512 0cbb4ea54a5cf00b89b0aa954b1707ec6202e48eda0c578b0b02beffcd8a527b2919b182f63c52fdcbeb02f9892302266fbd3bbd3780fb09e1a64c32e0a89a5c
SSDEEP 49152:AhtSn8EApI0fig3giDn0AP5w+6ZU6CENlc7dpJLrQWd:RX2imphH69CEN6rV
TLSH
T16095BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 affbd998e0dfc36075a02783246b93878c9824a0aad57cfa86e70e3157f366b7
MD5 8926ba5686af126a0045206201d48388
SHA1 f5de6b7875a1692809581199e25d878295456678
SHA512 3ff56a242c27a0ff5954320e8f514d46d99859eb0ec61e1befb437e59034133f95a3b76371e940d75184019881b5beb77449b62ca579a20a8d035119e35d8e9a
SSDEEP 12288:3F8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:3++L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T18645233487AA1D53D7E00278D1A291F5A859BDDB6B006D1FB37B740E0E3A9B81C5F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 99b969b94950e823d26445f87b15bee2200e86a2b23a035f502ce1e4e9ff99c6
MD5 b9a3cbc7fdfb940601af186406f94df1
SHA1 2151e09aefdceb0df0a5be7bd93c38e578ab9754
SHA512 3b082f372c915f70c04fa02ed1caf25942fc22f294ff019bb6dcc7dc97ca8ecc9b90d5da26022e4ed057283b0651e7e477cdeb3c9784c213ba1da0f7f678049a
SSDEEP 12288:yM8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:yH+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1F745233487AA1D53D7E40278D1A291F5A859BDDB6B006D1FB37B780E0E399B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2b8701cc7f3fda57bf92d3f5a1e9737082126ee28afc2c7affbbd6a4b5ae6c41
MD5 041ae5f26e0c9ad9b88196998bbd8096
SHA1 8d0af6ac334e31eb930b276629a125885dbfd2c9
SHA512 279e8aa9f2011e029df6e870280d630f49ba7c0d57064afacfad87de2dc20d3e5d3f9c6c0742c27b4db4de1d72bfa9b8359ead2891dd9c8c28ccd96c55f23271
SSDEEP 12288:nm8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:nV+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T10345233487AA1D53D7E40278D1A291F5A869BDDB6B006D1FB36B740E0E399B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0fbd562e64d1d61dc767f692daebb4afa20c6601af96ba58295539400729bc8a
MD5 948c612e13f41e057dc1b690ee3e8e19
SHA1 47ca27b53ca58cc273fa8bfdacb9ea41d54ab00e
SHA512 fc9d40826887c7512b82f975cdff492675b5e936205e97ea6e24c7f0d6cbc64f7fc3c0984940f342af159cb2132fa6d4e69fe1d652de89b23966aba9a505cd55
SSDEEP 12288:pVv8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:Y+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16B45232547B919D2D6F04278C5A391B1F979BCD66B106F5FA322280F0E356B46C3FB28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e5ef88bb9bbccbb781fb9f9b68b1e411f682f5d47255e5e04ed233853b60ef1f
MD5 7769e335d41c3cfcc2bf4d04449f6804
SHA1 dd3b032c4224e5380285ba33f8506ead894fe933
SHA512 7053b3b9bfa40a16b2678a87c25eb9b9d13c92415885c00b0091e33309f58f53bc22747e34f88161503b9026e03e1e3c18785b4b10cd7f8a5b59b0cdcf89b0a3
SSDEEP 12288:JX8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:JM+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1B845233487AA1D53D7E40278D1A391F5A859BDDB6B006D1FB36B740E0E3A9B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 11f3e4858cac9ef171eba43cd1309f53f5e2032a3edd0db97cc344c39aa40124
MD5 66c105d5cc40c36187709cf082653ae2
SHA1 1a1a7b5a7315395dcfa2cbaef5f2b785a1fc0a20
SHA512 e0503b07a1da48a452135efde4147fd6839cba6c35491b2ed4d5e4fde75e2aecd2fea8d4fc7f798dd49902629d1be6717bfd5717903fa4959052c99ed6eb79b8
SSDEEP 12288:xA8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:xD+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T13A45233487AA1D53D7E40278D1A291F5A859BDDB6B006D1FB36B740F0E399B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 024a50a428b49b40c22f0af5272ad8cbddf38abdbefd25ddfed80e606eae3953
MD5 e4d4cd6640698695155efb34b4a29568
SHA1 268afe655047b210c9a64947ba9832eb87768983
SHA512 ae34cfea4813729b9ff6cec0a10a30b29d734a38a7a6f04a11dcb92b9b1616330326b76abf11f419f6332fe2f4a3f25d79474fd7a3a6a14b8aa5970b84b6bb1d
SSDEEP 12288:F08+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:FP+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12B45233487AA1D53D7E40278D19291F5A859BDDB6B006D1FB37BB80E0E399B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e89804adbb3639389326390a04420417f6a23585489c1b33cfa0298dfe576003
MD5 49767375127d16b4bec33b845b5bbb3f
SHA1 7e6b442c7fcd90f37461587881af94ed256dde27
SHA512 bc492e62ed08d29df6e4e0ba13f3147f8281b6a880a711ffe348485a1378707fe1fbe1b6f0fdf490c029b555022cc7a41834b9cc9ffdc6712cdc6dd89f44faf4
SSDEEP 24576:HZMRzFVSOn+L6VMRCPU6CENltmVVdpx7fLrQWd:HZMRzfQ6ZU6CENlc7dpJLrQWd
TLSH
T101650265B3A01CF5EDA7423DC9658956D6B27C5A0B60CA1F13B4362B0F337A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 71dd779e00617d4d92ffa5adeed9a6103e5c7cef6f6409f17397d46164c198e7
MD5 3b19689c5ab7a60cded85ef76df01f4b
SHA1 22dba32030522380b290990b9e094108e25999d8
SHA512 1bfbff77a0a1be2e39eeb472123728984fc85af6442bf5912a362509ddab9119601186cf52e1e9280b138bb68a2a0a5b0eff02de4107907cd36163544d227272
SSDEEP 12288:gh8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:gy+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1EB45233587AA1D52D7E40278D1A291F5AC59BDDB6B006D1FE37B780E0E398B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 66afdace605be5c859ec9f91f83ee7ea697631ac501311d28d5cd616498965c5
MD5 41f518a921ddb277c8a2fb2ccc4e95e2
SHA1 453f9ac8b95b63944a1461a582439fb14cbfa3e1
SHA512 b41a82685ef733def6b5b7d33085a72c80c9c8ef0cf5a7dd6a1a25fbbcc227c28c3bc1deb168696b2c827fbf58b85f72885057cb40e218c453aa4a81320f8e9d
SSDEEP 12288:x98+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:xW+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1DF45233587AA1D52D7E00278D19291F5A859BDDB6B006D1FB37B780E0E399B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 07c9e96d6065ddd6403da95381f94724644a8027dcd0faa1ba11a0783bdf79d4
MD5 16ba48612c6ecf4e2067029cec215721
SHA1 de10570671af8c21f81dc56a4b2fe46633b33c8d
SHA512 a7855cc866ae4a4c3cda46fd7f38797b8a01fa0e58ddc0ace1415350b0af87fa125fea55bd87759ca727e8db854ed15b7285beb56772bc8271e1406d57b3c081
SSDEEP 24576:kzy7+L6VMRCPU6CENltmVVdpx7fLrQWd:kH6ZU6CENlc7dpJLrQWd
TLSH
T10755021763A530F5D2B64238C8A21A52F776BC760B209EAF5364563A1F376E05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 afae00ae5d386bc71e89099ee40d7191169dc10e69f876aef10b92650f0dbb47
MD5 22e7e6e2f208843dd3a932f7e6015dad
SHA1 8c62359e9d27109ee0cefdab9fb0b5d7a9eecee1
SHA512 f792646dd3efd75cab0b67bdf36dbe35c8846e1130478d98326cc24568a2cd5479a1843f62f51b3cf57d284feb46b8a0e273da0c8ba213d737e886c6ae4b7e71
SSDEEP 12288:ih8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:iy+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16645233587AA1D52D7E40278D19291F5AC59BDDB6B006D1FF36B780E0E398B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 922580f384d1ed8ce983219d8cb0e96d1644cf7f0058a710ad3c111a1a200e06
MD5 a54df2e33f64d0b571c7fbada2f5515c
SHA1 3b3bc193059b79b029a54538b74305c8458423ae
SHA512 6dd64c2f3535f9bde12dbfe035752c0383efa3a315dac71844b5e96fac61c84503539b8270fdbfb2e9e42f5df9cf1f593ad6a3ddaa1ba295d89fdefe9982d5c0
SSDEEP 12288:Uh8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:Uy+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T11C45233487AA1D52D7E40278D19291F5AC59BDDB6B006D1FE37B780E0E398B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 8c4feaf785812ae399be6486a7c14c6fb023cc1ea3684ea131b3673cf2595e8c
MD5 401593e293d9045b2aeee3661c045308
SHA1 364b3b7869f54dc597e28cf9835abdd6a48b4f2e
SHA512 df176a10b35f90a80a3e0f0c1a932c956457d3e97ca125971a1f455e5f498bcb57423c6cfb456e1c9dfff4c69540a80fd8f101099056d1b0c480926fea6bebc4
SSDEEP 24576:5zy7+L6VMRCPU6CENltmVVdpx7fLrQWd:5H6ZU6CENlc7dpJLrQWd
TLSH
T1DF55021763A530F5D2B64238C8A21A52F776BC760B209EAF5364563A1F376E05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 3d844c0b7fdd50b06bfa9f30e69e4aa96e74e9319ad5ce665c83bf0bf87eb57a
MD5 7453179013cabd96f8f771442599a09c
SHA1 aaa1498fc781e6b2957923627b435bdcaf9cbc0f
SHA512 d7fc1e8e19f8bc05583af298d5ec09213613062c069ea368eb7ed912477a5e21ac6d454814b49c35f2b1a542a404d39b4631370cdf1e6a7a164321add4e611c3
SSDEEP 24576:DTDaLl3z0zDl+L6VMRCPU6CENltmVVdpx7fLrQWd:DTuLljf6ZU6CENlc7dpJLrQWd
TLSH
T1A1650264B3A01CF5DDA7423EC9668956D6B27C5A0B60CA1F13B5362B4F333A01C3EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2ff6ae3b04c5ce2c9048876040ba140d85281c297f9e94e92416f2518672aad3
MD5 fd2ff5b2610718d982828c875ba1b5cc
SHA1 097d1712f1b8a4c2503971d66d9859f1a858b535
SHA512 d5b8ce9985e83bfdfa26efd8f5a7e99cb7980c30b1990e2c44298e92f7f033ee5f7164d36eab68ee84f272daabe466e3cee3c0150d8df7dfbf948c1dd8bf3b72
SSDEEP 24576:I3vd9CHKy7GZx+L6VMRCPU6CENltmVVdpx7fLrQWd:Svd9CHKyaQ6ZU6CENlc7dpJLrQWd
TLSH
T1DC75CF90F3E414E4F1B79A35C9768511DAB67C9A1B31DE8F03A4251A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 df9c36a514ec09630d708a89fc6c2caf79c7347872de79825b534eb8c354bb4a
MD5 b9a012627b31220466fd44e9731ee7f7
SHA1 24f12c62bafefbedb72d17b509559222a6c05ae0
SHA512 19871023edc1d9b5fa7018c713665767680b441c54358d1e81abb5e7b443ad7733f1cabf0a29207f8644347590b15424cb698542dadc84e86edef4c4aad1b6e5
SSDEEP 12288:kG8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:k1+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T19145233487AA1D53D7E40278D19291F5A859BDDB6B006D1FA36B740E0E3A8B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 27331a89f9b0b79c13ae24a7356562ec9c4f8420f603c8dcebc929c97a6e7ef1
MD5 ba926625538eefea2b232caacef01a75
SHA1 59f3da64f3cea15788e3a7a6a6bbfc44c24c7f71
SHA512 7df389344216f932f098bd3c5ba0308e0cb2ecf994848586918935ac401abc7cd861bde2614d5aac19bd349ca11d745b201b45d1e6f788d2be6cb2b24a200390
SSDEEP 12288:848+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:8b+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17645233487651DA3D7E40278D1A391F1A959BDDA6B006D1FB37B780E0E398B45C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 52dd485d03f1f8408f89bfadd586c9a1892b447d05b8e6beba48fb62508228d4
MD5 6d79603f8c803480be859cf0294702dd
SHA1 293c29f4b0fc6b429e76177286602bcbeebcaf6f
SHA512 10c8bd9356a89d3647311214c6abf18ee03eb0e9269eebcbf6a932877ce27b940a1f24a78171b8a9e991dace2cb0b0e49737b9239a7d6e2698bc5b28b1a5a97a
SSDEEP 12288:fb8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:fI+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T15345233587AA1D52D7E40278D19291F5AC69BDDB6B006D1FF36B780E0E398B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7cec4aac12f335cab5fe5c3add0fb67d562435e3a111e0859bc9395070a71552
MD5 3f2e96d4694a0f923c40e68ddb7327c7
SHA1 91048d64e8e3bcb2769bb21ae72a79af95a5aa2d
SHA512 591b5f1796ee62fed0c11e138e00646dd1383dc26e88bbc98ff65b2a2a3bc08b24e0922038ff7330e80484225a2e0ecd73b23703f826b0169a06b9a0792d00f1
SSDEEP 12288:Bh8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:By+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17845233587AA1D52D7E40278D19291F5A869BDDB6B006D1FF37B780E0E398B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 38889c3d28aa391be8b7c947fd10a3ecb79d28cd5cd475f854bcfda35475c2ca
MD5 cdc17e393e8852cdd3cbc22081340c46
SHA1 a866abba4b4a86a554c2ef3588f9eaff5533c927
SHA512 330abead46e24a47005fe3cdbcb2fcad5f7fe2a7fa5cb129e314f0c85cdf112ac0f3abf5a3a409ce727dd92e821ed0bb974d9ec218fe009aa5dd69fe2deb7966
SSDEEP 12288:pG8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:p1+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1B6452334876A1D53D7E40278D1A391F5A869BDDB6B006D1FA36B740E0E3A9B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 23e572268c1b5f3acd2c27bf8cc953054aa6babdfb1e63f3c84febbf75ef5c63
MD5 f1170ecb0c79d5cf763183a105bdb101
SHA1 27432fbdb9ebe4dc6782348adc440f0b4c2d7e91
SHA512 d27236383daf5a2b43404b75c84951abda0bb475ed1d2d51d63a72ddb046307b620fd3f53253deaacc3698fe9e5b9a0adc30b834a256e5d767e4fa249b8458e7
SSDEEP 12288:4J8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:4a+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12E45233487AA1D52D7E40278D19291F1AC59BDDA6B016E1FB37B780E0E399B8181F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3cd5d4d10dd20502b10058213e1f671beb86a67d7f7a3e69678ee8f358771cff
MD5 aecf1e1fe7c21118852a64f83d3bf3b7
SHA1 54d8027272be08c838efb31c65af0fdf855fffcf
SHA512 b7cdeec2c8841b5247ec18147afaa97222fd103c912cdb61b3022b39d33cdb43b04c999fa79dcc615a6ba86ff12dee0f16404dfe4b9b9a12c5932555fb735894
SSDEEP 12288:sX8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:sM+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1A0452334876A1D53D7E40278D19391F5AC69BDDB6B006D1FA36B780E0E3A8B81C5F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 1e32794d97465f5519c2da214334d4e19f9680f6dcc80e39c0413c204ad7d88e
MD5 65c13102e1f35cca05c7774aa37aaab8
SHA1 71752613283050dfad715bf4d8800173dae1b9f6
SHA512 26469407a2953b46dc86cc5f085fe5a0900e1db20e49e50d350fed9fce6c73b957d42c199e9b83af3ffc38e8edc17cdd53e18db12508a16ec45eb9504340eab9
SSDEEP 12288:d+8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:dt+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T158452334876A1D92D7E40278D19291F1AC59BDDA6B016E1FF37B780E0E399B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 2b6263bf9e311f5f4c9c7c6b2103ed5cb9166406e5dfb454a52df7ebf33fc16a
MD5 8de1980087a5518e2d157478f17c688b
SHA1 1618d3a693a07e61d9668b3fbc9050842500eb5d
SHA512 3e3e047b118943e070bd75a61d56526e9ca1a4b7ed1fee64735539244e0f4a31d97e9e6905c738b40dfd48f06075af9c5c8772002a9f18e95bee13d9badf7ab6
SSDEEP 24576:bfwvUk9RX6wkyAIG+L6VMRCPU6CENltmVVdpx7fLrQWd:xMnYI16ZU6CENlc7dpJLrQWd
TLSH
T1A885D029EBDC08E1E1B7923C99B3460AF6B178591B31C6CF125A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ce00dca9013f240f2b42ac79e4801bc899df3a15d9b9915f405a1adf6a30e852
MD5 4c534f97dd05b7b35ef2b6908b031a83
SHA1 1ab67ebb6b9fd790b24ab765b9901f301f9fe282
SHA512 df8a46d5b865c618bc10faadeea5ec9d63f742b5b150176d4a58867284416904574d7191d803cec9c50b57b7557e7faa3e7d70e2a9a1b37de36e7690310e256d
SSDEEP 49152:EYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0e6ZU6CENlc7dT:zySzPG69CEN6rV
TLSH
T121066C56A1A801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 579e4f5f7f4e1f756c58178207644e09052d91d13756f83ea104219e06092c35
MD5 3737edfaf1075153a5433f405247dea3
SHA1 7e882acbd746c2afe4a8cea30038888ed86cb82e
SHA512 969f48a64817166c3a71796a4bf8bb9b10aa493ab9e5994e8d20ffa1fdf3e14acf40002161cd19743a9b1d1818312419e5f9485dc8ab493f93d0bb4b44787069
SSDEEP 24576:A47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYX+L6VMRCPU6CENltmVVdpx7fLrQWd:A47JUQjTirIhCnDHUPfF/O6ZU6CENlc5
TLSH
T11665AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6b116943425e0c04f1606bb9d4511cb10484bc548b5e57565fe958282c0ac5ed
MD5 28b29ca12cc11c0f8e617313e101c11f
SHA1 969d0fd3ce6610875f99ae0a425f8fdacf0d3a8f
SHA512 da2f3b31bd15a27676ca5c51f6b67821a798f8b60b4c2281eb7696af5431cf1bc96040e10430d60847dc767f7d80a57d62ef61d0cceb8350eb76cffe25b4fb69
SSDEEP 12288:sbsfR8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:jC+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T14055F019C29802E5C1AE2278C7928651B7377CA597E1D7CB63D0F53E0F3A6A05DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 654d7b13d6f976024eb81676e316e7c31947c8f4e347cf65ae2e33a81f605b1f
MD5 595269fe25558b134ec40587d9f1a528
SHA1 499954c841ec42bcc5292df69fb846a311e606ff
SHA512 6822b9d6d7a20e9328c30cc4a86c6ae542507678d89b6a44d7c3a19a6236c5b7b18ce46d7c2eadc1ab57f04df8cbeb06699496f7976cc64f6e3f557e6cfaee17
SSDEEP 12288:ljOjQU3fjNpF0Db/ouAMG/Xl+56xO1dVsp6lt9iqyk0:ljOkUPjsDZApV+56xkdVsp6X9iqyL
TLSH
T1EC451800B226D78FC6A950725E36D6CCAB707D41FE456F0373C84B3F9476658BAE9282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 d460b101d1bddfd3121c04a39327d81a2d026a2957d409067414d2fa579bb774
MD5 b99a9f7b308b95ec666152774c0004cc
SHA1 9b3c091cb7028239ea2b1edba08fa3ce71dd3d3c
SHA512 6f5b25d1e2cd7dd1eb459fedaa23c321dab8ac48def814a4104467adf4293b2e0e2b3101d317be11dd54f7ac1cec9d7dd87ec4e53218be085b64a8e724534adc
SSDEEP 12288:z5y6PUck+06I/NJZpydaC9lfWjGpEvD4XLNvja699yj7FyRIwfvo3:Az/bHMTLfctYX99Y78GMo3
TLSH
T17A652A00A5B7E34FC97E90774732968DAB746C02BB453F0173448D3898A3A6EB5E67D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cc48e75d02388db498959ed2f434937b65b998358a9ffca982b56d0f83181cd1
MD5 b402498c05174ac1368fd775b7cadebc
SHA1 b7ed7f140cf48312928fe847dbf03584b5533f9d
SHA512 828dc68c59edcc565661bf1094ca0c6e08d40eaf7e82a6706bea5d92e569241009e72516c41022dd5c8b73288f0ebf263eb65d721b7035fea4453f8e52799c96
SSDEEP 12288:S0758+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:Dq+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1F045233087A92D52E7F40278D0AAC170792EBDE95F0099DBF226750E0E399E49C3B71D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0dc19198a6fcac0a104cec007eb8b4795c2284c042310ed66d0b7e75b1229b8a
MD5 33c32fc4b18dc52a07944666e2856a04
SHA1 c31278d1de8533b70eccc92ca5f5acea73d1fc4e
SHA512 03d3c1a47d16b58a0459aa491cb647541064ffc305ed98398b3e587f99d5ac37516cc78b6dc5b17ccfabb4010c2343c3b501967cea7485297581e57256f022e5
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYA+L6VMRCPU6CENltmVVdpx7fLrQWd:Wgb4mBIBhGFM6ZU6CENlc7dpJLrQWd
TLSH
T1EF65AE1E22EC02F5E1F9D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b6ce990bb04bae93439984183efdfb46489d2f4726ac16698851b9411f16c3f9
MD5 d802dadcb5b12f33a1b0d69a8e17a1b2
SHA1 07d33fbaf44ddc2e04390940e5f0834c99f1d889
SHA512 ecbba9ddd57bdd3e487846fcc8d23089ec1afa36a45b55b395b3000b75d2027fecb545ad073e5b255e80b07673d99df78922c98488c122b6a6bd9886f873d94b
SSDEEP 24576:9G88u8FpJqH1bzria7/mn+L6VMRCPU6CENltmVVdpx7fLrQWd:Q7ZFPqVea7/X6ZU6CENlc7dpJLrQWd
TLSH
T1A085F16567E101F1D4B7D138C9824663F6B2B8251360EFDF07A88A561F23AE44B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4904baaddb58a6d7c5034a839cd318cb9908bbfbe1c9ac902b8f1af7b303a072
MD5 97880ada3d3ba0a4ba5664d219fcfeb1
SHA1 4c19f9ec30973aa6d9d17dc76e88561a68fd62bb
SHA512 43e2e8df95ddaea9422de68c31f057b651c904e931365311a939884d6063b4636095784fa0421a21824dd9f69e28922f66e19e55cb6d4f97f651008a47fd76da
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjg6ZU6CENlc7dpJLrf:LG05lO43bt69CEN6rV
TLSH
T1A7D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ea04fcab6c12f4d5b78bb53bfe44258e4d4336f5a13db485c6e2a0c631ea1355
MD5 2365cee037775b60797fe35901a0ac6e
SHA1 5915b4e45dd780e3bd02bdcacfc59cfeb7afd6b5
SHA512 e9ffcad45c65516a633c55df9e603cb6fb5ee61b04aa6b51adaddd206a6850ae266ec52785339e37ccf214381ce9198cd984be0ca41d22cdbacef3eff5847888
SSDEEP 24576:kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn5+L6VMRCPU6CENltmVVdpx7fLrQw:8a5POZ3BJt2pasx2+mo6ZU6CENlc7dp5
TLSH
T13065AE5EA7F801D5D5B9D17CC583861AF5B1346253319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b6a6fdedca617e7ea32b527780a1879a37078f2428e1de1f027e156c80f5e73c
MD5 c4dd3346a5807e9a4f1a7b6a9d28e5dc
SHA1 cda81ce8c166d7bccf021513a6732d0bf4a4ca2c
SHA512 ab0b6f78a786aa34a2bcfb0e19e35dd57db987f1df080e3633b9f8a83fddd635d8df63472c5835ee6c2e9d564a733c3dc1d88ef5ed0a7f8a7c9aa6f29ff1a2e6
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7Fkf+L6VMRCPU6CENltmVVdpx7fLrQWd:GNc/zEOVHF36ZU6CENlc7dpJLrQWd
TLSH
T130857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 200a719387ffff5df8659089508de7583cd43333ff2b098e4da1f566294dc79c
MD5 a904cff3928637a4d0313bd27a4bc24f
SHA1 1ac9754e58bfc0b0bebc8dabaa4b6d8dba4be947
SHA512 ebef6ce2ccb4d51e94507b15fd8a57a49593d49cddf6b0fa4599e254d2a7ef53e3b4a33ddf602e92fa1e5dce9d90a299c4f79d706e7d03d5b55f069ca5e0a81e
SSDEEP 24576:nTkNvNnaFeYhJNtmZBmt+L6VMRCPU6CENltmVVdpx7fLrQWd:nTMwBtOm66ZU6CENlc7dpJLrQWd
TLSH
T11055AF2EA7B806E4D1FAC6B5CD238512EA727461173293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 95ae487abeb6331d8b5fe8dba899fdb9d37c9becbb615679a23b2bde3957626f
MD5 7a1087a03a5a18e1c12c8400d920a25f
SHA1 f9c2f3fbfa94ed4fd5a63e6c308adb22b128f26f
SHA512 9235d9e3aca844ac59d9fc9bb703f8120beb3d96a3276008c12a9d447c4e8a1b7a48e2f09c2cbaff1e7ca19f1ad11ab0a937ee7ea512b01275728bf7ae0572e4
SSDEEP 24576:gPUr+NQz+L6VMRCPU6CENltmVVdpx7fLrQWd:gJQQ6ZU6CENlc7dpJLrQWd
TLSH
T18165E12E62AD1CE5E676A17CC5828619F771B862171196CF02E1817E0F37DE8BC3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cb42544bea7cb169b91826c4e516ef7829e462c3d5efbf1572c96ba791ddbc0e
MD5 e8c34b2bb8e26125ce8fd4aef035aff9
SHA1 535801609fa852b293f01ad1f9495eb1812d1e70
SHA512 91dfaac914cc557c9410d8ce5b9f3ab174271b8b8d5f637db23022de64e6ba7a3e1fc66782aa506af157d2200f8ce590ddd967aac3f9d9ecc6897fe3fa04a277
SSDEEP 24576:1D3FHshBIYQgAe+L6VMRCPU6CENltmVVdpx7fLrQWd:1DVHeBIAAd6ZU6CENlc7dpJLrQWd
TLSH
T19B75E13DD79C04E4E57AC1BCD6638606E77138A903216ADB129481BA1F6BEE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-213-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/988-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/988-72-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/988-66-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1800-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1800-273-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1800-468-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1800-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1800-466-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1800-81-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2504-79-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/2504-2-0x0000000002630000-0x0000000002697000-memory.dmp

Download

memory/2504-6-0x0000000002630000-0x0000000002697000-memory.dmp

Download

memory/2504-7-0x0000000002630000-0x0000000002697000-memory.dmp

Download

memory/2504-406-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/2504-0-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/2900-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2900-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2900-49-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2900-39-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2900-45-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2932-485-0x000001F1C4BE0000-0x000001F1C4DAA000-memory.dmp

Download

memory/2932-465-0x000001F1C4BE0000-0x000001F1C4DAA000-memory.dmp

Download

memory/3500-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3500-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3500-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3500-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3796-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3796-248-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3828-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3828-176-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3828-54-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3828-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4360-108-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/4360-114-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/4360-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4360-294-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4936-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4936-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4936-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4936-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4936-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5676-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5676-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5676-303-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5676-286-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5676-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5676-94-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5700-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5700-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5700-126-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5700-129-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/6096-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6096-13-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6096-21-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6096-20-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6096-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download