1d522bb17d235a6514fc19577db1dc1f06209874223c435bca65be75a26a9e98

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 07:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Size 926KB
Sample260701-h45bhsay8x
SHA256 1d522bb17d235a6514fc19577db1dc1f06209874223c435bca65be75a26a9e98
MD5 e4bd644da9dc790989f4ee0587f2f51e
SHA1 392c1346c0df9289bb7adb28104128ddab2036f2
SHA512 40866a227be64839ab1b992ab6da3d1339e3c843869f9ac3f9e18a207ad7073f3e53688a132625278c4a58bd38ef731695eeda638b7fbc0d65ac7ab1658c81d2
SSDEEP 24576:1sYmkmaMY1Cb8NGYyxknw4FYnshx8OfVe247:+YdmaMMCtx4x8EVep
TLSH
T18015E02173D0D072C2A231724B66E3B166AEBC709E3543877BD43B7DAE705D19A3871A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
1164	elevation_service.exe
4288	elevation_service.exe
5752	maintenanceservice.exe
4000	OSE.EXE
1492	PerceptionSimulationService.exe
2324	perfhost.exe
1512	ReFsDedupSvc.exe
5108	SensorDataService.exe
4252	ssh-agent.exe
3456	AgentService.exe
4084	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1ea6da18c4173e65.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104437\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104437\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd5d701a2a09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f36bddd72909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c6256d82909dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000944b04d92909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d64183d82909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e7319db2909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{3352DDC3-37E2-43DF-81E6-ED7F5027DBA3}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{7802B182-2299-43A6-A810-7000182231DA}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
6024	explorer.exe
6024	explorer.exe
1164	elevation_service.exe
1164	elevation_service.exe
1164	elevation_service.exe
1164	elevation_service.exe
1164	elevation_service.exe
1164	elevation_service.exe
1164	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3456	AgentService.exe
Token: 33	4084	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4084	SearchIndexer.exe
Token: SeDebugPrivilege	5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeDebugPrivilege	1164	elevation_service.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
1784	sihost.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
5552	2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3700	StartMenuExperienceHost.exe
2708	SearchHost.exe
6024	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 5664	4084	SearchIndexer.exe	99
PID 4084 wrote to memory of 2748	4084	SearchIndexer.exe	100
PID 4084 wrote to memory of 1256	4084	SearchIndexer.exe	101
PID 4084 wrote to memory of 1848	4084	SearchIndexer.exe	102
PID 1784 wrote to memory of 6024	1784	sihost.exe	109
PID 4084 wrote to memory of 4248	4084	SearchIndexer.exe	117
PID 4084 wrote to memory of 5408	4084	SearchIndexer.exe	118
PID 4084 wrote to memory of 5828	4084	SearchIndexer.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_e4bd644da9dc790989f4ee0587f2f51e_amadey_darkgate_elex_remcos_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4288

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5752

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4000

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1492

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5108

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4252

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5828

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6024

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2708

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 278f5748f4b28b23f4e9ca3a83dfef8dd6593263576f5dfc724b9a07a59ffa88
MD5 913298ab8f1a156aa776f0b5e61215de
SHA1 20147d6127cb0fd2f9c100dfb2177070a96e7dbb
SHA512 6a4811a4e50f69aac0b42663f5f0c9d503a636e2e0299c6d112035a4fa29513531e6f8dfa7f6688931e8ea1e023ef6ba776cebe7254d6619a2477e3ff889199f
SSDEEP 49152:Wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn7x4x8EVep:I3q6HjBEix8EVy
TLSH
T10AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 851663c2db9ab6e02afac3726ecedad855151f86c9b3001ab45a0c0280ac0c21
MD5 2c0ae701a529d65485bef01cac7e7cb8
SHA1 c362899705bff44d64f2f0224ad75b28b1689d2c
SHA512 8d6ea8e0501064c5bb68a6bb9ca9aa2688f161afa4e41c1152a1ca6bf7332a3a05c009cd1afe5baa1846aa4ed3b5f6d98894ca9d4a73fa588ff8f6b117ec746d
SSDEEP 12288:m1XLsswWkxy2lRq2czA9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:EXYfDtczA9yxknw4FYnshx8OfVe247
TLSH
T12805F12877D508F9EC6B8139CDB28512E633B8954770E38B03E4952A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 34bdb1345c7762f7c614392f952a6debe8a5a5ede5da16630e7e4d3769763bae
MD5 a362d12db2e05e4b7cda2db29b2d60da
SHA1 434b5fb8dec55b9e452fc10cf1d12736c5631d57
SHA512 df4819ca02879a49c30964edd592254a7b00fb04331324be95c28cd58f76777276b370283fb62af3ea8e5b27adc54083c58c25fb48b160758fcdb17283be4829
SSDEEP 24576:Y0Le5ji0hmxirMgyxknw4FYnshx8OfVe247:YPji0Ac2x4x8EVep
TLSH
T10D35AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 00e0aa0cd0b64762285a4e827fa819d21f0add67f0ab35ce360c4f818e9b27ce
MD5 b864c0a7cea54fe91d5e120d08db9b5f
SHA1 2e2b36c0b2be5b7b158ea22bbe02738ee350964f
SHA512 52dadf7b98d1ebc0e0a8ddab54723a00f36a286e49a65bb0d3e1872e36c0aeb5508f8e4a39426ea4c2e4017248c5678ce0f53756d2cc38e6ea1fa6105143116f
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWE6q8wyuSyxknw4FYnshx8OfVe247:z/ezSC6vUzPvxHjyax4x8EVep
TLSH
T1EE756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 275758453f7da4e1c504fefbf1adb7bcb720ed248596b0878aa8849e5fb7c5c4
MD5 fb4a25d08250747f63557708a4fa4c48
SHA1 dff5e185220a6b2f3cc80b773f55c2f6bc9aecbd
SHA512 af90d9206e45718cfbb0329138f7858e4b58995818bdffadfc4fd9e1b354a3a2424e64716d37f4a4accf8af289b83e7ff0bdecb867e66b3856694522705942b7
SSDEEP 24576:1VbqPb88hv/l+6xyxknw4FYnshx8OfVe247:1VO88hXl+nx4x8EVep
TLSH
T10E559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 5659fa3bcb74ebd555b6f22374a8ef5e7b632c8818732d44ddfb6ff8e96fa6a4
MD5 11c4e5d2ce7bd4cda338985a9ec5031c
SHA1 e9565953dfa89f84856d10fab2d50bbf73847222
SHA512 6adbbce2671b67413a60090252b469231db07db1ac0c802531b16485bab7011517d1521ba4811e47ced4ae6236ed7c2ef20f4519aee9c53bdfce84959539f8c1
SSDEEP 12288:WRk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WRkyxknw4FYnshx8OfVe247
TLSH
T12FC4237CA7DDA4E1FA5E14331B7572623616B9A4DA74C11BC778B14EE4F0CA0E06E223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 d705c29360cc1bfdce57648e447887bec584b4282166f80ae4c8d08ef82c6ce9
MD5 6c6753376d9b77280481b6a457b8ec06
SHA1 f3d8d5c92dbe814cd0cbc2bc2e5516005239604c
SHA512 c5bd039e9328584b11848e08cba9657b0cc1bf710ee1f90e3f19cbd1a037a0c8fbf6a5c5a9229d43550e968266ef585fe6a406c3feb3597c071ad8babf7bb59b
SSDEEP 12288:ceBNUbTVO86UZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cJIUZyxknw4FYnshx8OfVe247
TLSH
T10405CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 357f2d691b8927ddb7a7059a291423d590c117aec86b285e91b62db5bec86b71
MD5 f3383570f0afa655439de804c4eeaf38
SHA1 762f275a36f61d80af3a1c99bac48cc3810fe26e
SHA512 12a897c802fa968b5d1eaa02f695db3a27c4cb45dacfb173ef80180340c0fb9134230bad5f19d0ba8c152b441335971a14c2bd43981fb8ca25760b59e97d70a9
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH6:HQvGAdlCEL8c/yRNw5C9ix8EVy
TLSH
T151267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 a7678c0943651d4633ac16ee96955df1353f5224bde78108f11929e4498ec2ee
MD5 c53df611e43b633ec30316d01612d500
SHA1 f665bfb4e6eef223a137ec878e326b0cbf5c7e55
SHA512 eaa8187f420935082a58bb6545fcdd5950029bac91c00369956310cc5e5fdd7fed66f57559a4f04420531b1e69941be01aea9048c17d7c70be8f01c64e9b7aed
SSDEEP 12288:AAwSfxL/2Dc34DLLmt0LDQewsAjj+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:VdewsAjjyxknw4FYnshx8OfVe247
TLSH
T19915E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 908725e2e4f1c654fcac3b4fbe533c4e80388a81ad2427b666ad1cfa39345360
MD5 052ccb88f79d6d31e6fa893303148cb1
SHA1 ca1c5c0c3c1683a0183fdefd892c1ca0134848de
SHA512 f7b3c88abb08f114d4810341cf6b35b26420dfd5034f1b24b0a56fd858efd6a51b08059c307ebc9547e244589a29a098b475ba85ae31faa0c1fba9cada7479b9
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHL:DUEtQevvqc2W1cpV2EI32
TLSH
T144474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 596734656f230a3a3d9a5083d8a365006b96f15af63d461b1f7aff14c546a467
MD5 a717806e27ef0260c321e9bc253ab291
SHA1 6248bd243a5446f1393ed7f8c4e197c43d2ad8e0
SHA512 7f52fc4c225372e9780327376b06dbce52bf85ea9778235fed615d856ff7ce56b42685b56679dfb0a1238544a692e623d08d4ff2ef38a2ba73318669990ab022
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/zGx4x8EVep:toqtVjnmhix8EVy
TLSH
T1E3D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e6934966b481e6bceb610ec7192c16bddb7ac4b9a7338679bbcb0140f9da546f
MD5 157edcbcde2432e0da89607812468985
SHA1 cc5e18beeda52651a645e3b438941f0ed8aee7cb
SHA512 5689d29d25acf8eb320022eb5a95c2b98600a75bc4003ac7af0a4a6e24a044ba77c75957e9562789a5f25f42da771cc7a6c41f885813614b3c8b47edcab8150d
SSDEEP 24576:fAhGLJIFoiwtA5l7S53Oyxknw4FYnshx8OfVe247:fAMyFoiq5Rx4x8EVep
TLSH
T19A35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b159768ebf289b8ad9c13cd01d12f9261a9cb133b7ccf8de87a6e2f35363cc99
MD5 944c9585486d68a1f8dd3011a40d904f
SHA1 6cf5cc5464e0f6083e7b6d5cdb0088682843a816
SHA512 9be1d203900426e2457d92879349515802d229d559e913c1c89c432d53aacb8e23b9ed2ee77092c8853df8a4f5fb5462ebe868eb98dffb8e50ea3903394fb138
SSDEEP 12288:Cmw5HEjsChNVBFgl0WDm+Cy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:bwuoOWPyxknw4FYnshx8OfVe247
TLSH
T1DB05F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 534e5a1ffdfdbfc15506cf43a5ef1aac27923fe8d630f3dfb38df0b00bca47c7
MD5 41146780142ed895cfdaf937f7b49876
SHA1 7642e02af3af6ddc2267a638eba1ae2309d8416f
SHA512 ed89560322fde366797dd549ecc350620cff3e9239faabe6e3194d0656cf959b5d80de9d6be789311f82f0c59964d4f62512e47c160231c3e3cb85a87d01f9d7
SSDEEP 12288:PBZ1IyT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZZuIyxknw4FYnshx8OfVe247
TLSH
T1A5E412AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c496474956abd453ae14d491cf72b3fcbc283b77d16c3f68b474a007be475f16
MD5 89fae7ac4b1c2446cc93695cbcbcba16
SHA1 7d97adaec6fbf9ade448a48f0724a3c237a4faae
SHA512 83093dcfce934238247d435a07797d0f117ac6a37aae08935c60e70f37a348966fab0aca88ca97b90318bc2b3a41212b83f080eaf6a6646573d4ce4ca89b9b8d
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:FQRQyi36YOcPQLvw2gAf+PN3wix8EVy
TLSH
T128667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9727f0c9a453519bc784a2f5769f2aa59d6bc12f159139346e29a975ed5e3ffb
MD5 fdd6414ae954b0a082a5cfe5a2f41062
SHA1 777ed4eb5c511dbdd66f6c208fa6fc5f85fdf80e
SHA512 4537bfa8733999adee4f9a05ac78dc17640156149fc81277bf41dc09bd5f1b27798ec49e603e0b8fd5b9429aec1848c584a4568c116bcb5523b89d8611841875
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:CQRQyi36YOcPQLvw2gAf+PN3wix8EVy
TLSH
T1F5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3ed97959200e190c4caac05aff3189c0067a7a7b3767dd9827a58adcded93407
MD5 6e036f6083d8586b07327659f3e806b9
SHA1 a25d611137010ca740a1827f900ea209e5ac4c59
SHA512 d8025ed046880a928880f3e26c6249fb929ff076a7fc3e9043aad0ccf35e341e004f9d5dc309ddd3784da3abefbad20577b557f2f59d1aafe875ebd11a2d2b9c
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Yyxknw4FYnshx8Z:l68Qg55nhheWu7PNU3/2x4x8EVep
TLSH
T1BEB55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1e7a79c3e88c1c486e33bb78bc2f12a2b754f70ed165fa48bb74a3536d778bf5
MD5 57fa2d0322413eb591928ee9374102f7
SHA1 cef37e721054eccdfb8be0b43e08ed40efaced5e
SHA512 6566d82fca42d79554c3611861fe8136e39a36910b37e5cab6c57ca19cba96ee80f077f64db7df88cc29462ec19dffb55b17043b28ebc12738f41206171ef658
SSDEEP 49152:m3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99M:3y5112gYy5azzVvL69nLKnhZ/ix8EVy
TLSH
T1FB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 277727a57df166a90d382c3869b1df2452f673f0dae0d4b857e83fd1b6b73aef
MD5 ad2e6a87e2d4e9657c5d64682456c35e
SHA1 9b49228b6121a58b6f7a0acaab93fb672ffec65a
SHA512 c1a782e2e60bc18a5a0ffa08ef8bcae7c2b9fc595e069fe81a1c55a54b9c2fd0513f1c98bcba66155c6d75d82b9ad14fa28ce16646ec1987f45f5825cc9dc600
SSDEEP 49152:JB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl4x4x8EVep:fu6JmVxd2d4ix8EVy
TLSH
T16AD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 54043e0faa2cb1bf8607ae5a11d0bb2e4e88d5cf32e6248d08647534b1af5afc
MD5 158f196a7731b8860a1cf3427f388a08
SHA1 f078c273ce54fe2c86eaf6b2c19a965a6c7e0814
SHA512 66b4caa7f34731baabae38c8a8bb4d264a816653296bd94d37256731ac53ce5875ede5dd9f70deab71f2bacd58ad6f2e2554801f83f23df1ef2b976644d7df20
SSDEEP 49152:21hpsNoJpF1A6UU44CwH7R4x8x4x8EVep:2mifPbRhix8EVy
TLSH
T1D7B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6b88909b11e184c18181338c20abaf90b097cb74f6b23cb62613cd017577340a
MD5 cd3cb894ce17731a1b7a664f7240538d
SHA1 13bdd04bf851cd928394e86e2b1dd25179cadab5
SHA512 53d8a735d88e80f8bdaa9201b2d761b5fd2df82aff6b3febbd5237d1234920fa5b930d221db7ee2ebdf0754952f9f45ef125d9f746440d93be4e5f1d663000da
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqrx4x8EVep:u5dKTi61rix8EVy
TLSH
T1A8C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d4ddd9b92b9b6c79e3fa809aff327610bc94b9ac35f374829d92fe0b9227404e
MD5 9f5b2d689bf128dd1e42e5ce45c9f8e3
SHA1 1a7c11da96af6ab4c262a8a2bc15f007467ca79b
SHA512 13ec718d46ad88adff563fa8302ff62b8b1db2b741f6fa74dd67d74daeab3471d419ed381826cc49e80374b571b14bd1e7a30be25a89138b9b9a70ed8e2e80e4
SSDEEP 49152:4htSn8EApI0figngiDn0AP5wox4x8EVep:pX2iyph1ix8EVy
TLSH
T11495BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 629f79ded9518233bec22413e8529ccd2f16c4a3a156dd93a1e1af82fd58d0be
MD5 a9bbdf43c888f0a31aeca77a27d84914
SHA1 727c0b6eb9346121f07b919e420eef103b025111
SHA512 bde5131e5987d28f2be591a5caf39a11a029b7d187a5533c8b7e6bc0f4e916c46093a321f5bc0a675c3d0286accbd174d0cf4a490d5d9275646a9c2c72858d39
SSDEEP 12288:hM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hMyxknw4FYnshx8OfVe247
TLSH
T1A3C4237CBBDEA5E2F50D11734B7172626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 fd83e8869ce95c444d1f483771dcf4e009c44fa5242024136d3716fb0e07e340
MD5 66e937a2b5e9a6c656fff03e75f8ab3e
SHA1 387a92ec18cf6eb91da817843075f0516b2f8135
SHA512 a036dd1c2670864d07551b2f4ee915e3d36dd1e4b544c81e8ef5d446b7bf278480d4fac395fd9aec713a480b47faae91ec7c891fb500d7cbe8868a8d56160e1d
SSDEEP 12288:nH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nHyxknw4FYnshx8OfVe247
TLSH
T188C4237CBBDE95E2F50D11734B7172626609B5A5EA71811BCB7DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0399b829fb3c262334c756cb89ef62944934d13feb47df5e2e2f1bb8f217969a
MD5 2289643259a4c8c9db8ce79d9d5a2e41
SHA1 5a54951e400bfe5614573773c7f00d65ca980a68
SHA512 813faab05a9e80aac1a803e5074dd5a98f21531f131c20229980c0c3b17eed86466e4a532ab429492f5ce09891d3478c7474b9bc3c4be175a341fe2614657ab0
SSDEEP 12288:xB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xByxknw4FYnshx8OfVe247
TLSH
T1BDC4237CBBDFA4D2F54D11734B7263626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 0e1b9d0de0cea2c8f3fe2acfc7f2239cac2c9532741a5ca1f6814abf086b4c99
MD5 67d0d565703f29d5cc929f63ddb0153c
SHA1 57353f20561683c6ac9cf13c8b2fbf1d594b4b09
SHA512 01c7524f53e47367d0b620439ac54310cb36877506e0d19bf82ae28ba44a7d5a290f18edd6c3fe0396a9162fdb39ac220b52c6e091b5ffbfd27c251d7c4770d1
SSDEEP 12288:FVu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uyxknw4FYnshx8OfVe247
TLSH
T129D4237C77EE50D1E85A51738A726222B365B8E5E731835FCB64700EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 db35af3abaaad9b977bf378a34fb3251847860251977cb83d9f416e06dcbac41
MD5 0adda67ff1183815a66688830bda5e49
SHA1 870780b821380d964d5dbf4d419e2415e3e59e05
SHA512 9090b874ddf3b197cd8174743407d5b59917a101b39268636635d25693735659a8a7f1a79975a19085d7c433b106a696b5fe5ac12e9895d981da03ff444d0687
SSDEEP 12288:mm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mmyxknw4FYnshx8OfVe247
TLSH
T179C4237CBBDE94E2F50D10734B7263627609B5A5EA71811BCB6DB00EF5F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a4f7d76bb194d7d54ce0b48c6d471160a1c595fab7d8e4ecdab422c287b73d9d
MD5 c4924b8d5999025cc4f439c6a66dc2af
SHA1 40f1b945d3f1ef67551bebc3a2c70eec3240bdbe
SHA512 acd6f43aa3ac1ad5d034b81cdece37aba973c90231c2b6060707da2d16bd2e56ff16ad88bd06d9d7715d1e9451b58ee5ffd8948894f03e183f8da99224a8f68c
SSDEEP 12288:/L+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/Lyxknw4FYnshx8OfVe247
TLSH
T177C4237CBBDE95E2F50D11734B7172626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 5c398a454481fdb401220773677be70b16115772823707ba7f8578c67c2c651a
MD5 896739f39f8451355422c9f68be871f1
SHA1 6785ebfc7281dc57c47a694750d9b3477967cd2c
SHA512 fefd1cb0142d2df217ee86446d090b2c0d6a0bab523a80b2da221b9899d251a3e5ae7d00344607019db1c61ed3af6543abdeff8a978184f624561ac69f8e5cbe
SSDEEP 12288:+f+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+fyxknw4FYnshx8OfVe247
TLSH
T11AC4237CBBDE95E2F50D10734B7172626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d684791dfe58c30d193fc3cc66b6085b3b6897f2a8e77884c143dd6624f75308
MD5 ea040eb944fcc71ee65a0bdfa8d68dfe
SHA1 5c21febe4c687c4022e1b4dc47ebc2e10e90da1e
SHA512 1aae61d665880fc60e1360424aa772f805ab80d0bf6dfa0981e6a40d461f72822ba965276ad55229d64f5cd763c4a11367c7b80f1dc6049ce6eefab0a550d558
SSDEEP 12288:LiZwb6zzFEoS2cPvyn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2ZMSzFVSOnyxknw4FYnshx8OfVe247
TLSH
T1B50501A8B39018F4EC67413EC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 26574801e53197937f9ad7b3a5fe020c6fd0322cc7ac68d23647b88bf9cbb6f0
MD5 e501e29036658fea8490495fb40898ee
SHA1 54aeb7e2035cc413974fca50ed042b7cfb707350
SHA512 74308ac84b4bb88c811d12559978b448a14cdc6a591534d5777f57070914005f5b5f53fa5dcb5ef68f0adca9a04432b2df372db86f07b9a0f2e6deed11e8426a
SSDEEP 12288:s4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:s4yxknw4FYnshx8OfVe247
TLSH
T13FC4237CBBDEA4E2F50D10734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6a9f293f9e9b6d4dd84334e866c22eba3cfcdf37474800da9a87806a362f8f02
MD5 7eae43be6ab3d16348ce07d9593e135c
SHA1 9cd95ff28c30647d9f4c892e60823b0dd966699f
SHA512 5e0cd6c1900c60cfe76372519f48d65a77f6fe5a51d49cee2c34928d9ad1073f6055f2fd14a83bc66170e5840de982ab90c26bad6d6e79d9e7ea0d011e9c605e
SSDEEP 12288:1U+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1Uyxknw4FYnshx8OfVe247
TLSH
T114C4237CBBDE95E2F50D10734B7172626609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 f082f368d2a6004bb809a95331497776f2d81da68fdf3a924e669fe72822b7d0
MD5 2e308716260bc51f01a077af262939c6
SHA1 d5afd75347c61edc241f483f8698e6cd9cc1ae73
SHA512 e0626ddd614f58b36d46f44159423c69c182f0bdd9fed778a80721de1e64d78f4f7e5b8c8462be565c6fb68ab6c1fc81d524193a76cec51da9aa6179816c5230
SSDEEP 12288:IyPz5L8T+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JzyTyxknw4FYnshx8OfVe247
TLSH
T1DDF4125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 ff92512d4088f50c8d72898e4d5e0453a970fb0d75e95a51b0ffeb2517224ca3
MD5 751098e2c9b3a22a55944a805dbc701e
SHA1 b550754434d4eae829bf3fca1b53fcedeb74a888
SHA512 5e57c24d6a2ebb9beae20f0481b724e52ba70dc5e7235d34a2378fc654777ca1dbdc4d638c12215e91cf99f9a42dd902b1dae9f59f66566ea3f21e7c11cdd339
SSDEEP 12288:I4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:I4yxknw4FYnshx8OfVe247
TLSH
T17EC4237CBBDEA4E2F50D11734B7163626609B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 4eac3ff6673006d70b9f1377fb3cdfe0c013e21029dd6f0463a00cf4414f7501
MD5 65d9daa146a767c6fcb70ca62bc477e6
SHA1 3081e087897240b9c0b1b2956950b0d54b223a45
SHA512 15cadb8072202f4a5924135ef085fedde1cb94cf990dc343a46688faac90e95dc111269e2d64ba6852391c285adc750bb8a9c57654e3417f72b0b17ad88ea740
SSDEEP 12288:r4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:r4yxknw4FYnshx8OfVe247
TLSH
T11DC4237CBBDEA4E2F50D10734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 5fd6baeb165fd64210a4fecf4ce9e4163ad50d5ff4736cb1fa79372ad5601c4c
MD5 92c23386a2c22f96634b86636664f19d
SHA1 6db9de34da949a4cb726cc5c4693929ab2598de8
SHA512 41bc667d923fd743fda828a3c3ad6802134ef56aee3a3729e9bfc0bfe52658991878856b8145eac63deec59a279e0517fe6b3697e0e4a8434319f05c7e7dc6fc
SSDEEP 12288:2yPz5L8T+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:LzyTyxknw4FYnshx8OfVe247
TLSH
T1F9F4125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3d62d034db47c92ad197799bcf506727a5701cfe08f87e294904004ec13048ae
MD5 5595dbcc2aca958d269ad91610450402
SHA1 38b40f6f5b2cc10fd80d86d26efe3f4b4c57f963
SHA512 728b731518497dea3a9929f0eecb2846fb833070c2d770f6adda0ff79efb45804ae5778ab70c3fa0d6045056bbf0a96680598103dadf32e54f6995c2d3bf7843
SSDEEP 24576:BTHaLl3z0zDRyxknw4FYnshx8OfVe247:BT6LljNx4x8EVep
TLSH
T1E90502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 e7109107acc81acd51c520ef3259591cdde66d501c72955b74489993d7589c16
MD5 e8c9d064ee269dd1b318e1494d33e70c
SHA1 35cb6ababe241257d9a0dc5ccc39492dbd5ccf46
SHA512 354dbfd67a0f1814f4758b85e4edbeee8f47650c4fdc2d4e19fc224bf05885c6577fbfbac5c4aaa916d9732d201756a84df3cb749ba6bdaad67b423c3ac97fca
SSDEEP 24576:X37d9CHKy7GZFyxknw4FYnshx8OfVe247:n7d9CHKyaex4x8EVep
TLSH
T1BA25DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 3a70a6490f869dec87cd5db97b432237ef8af5d211a96dca757a152dd6f48fe4
MD5 69accc8f61a37479d62e2a2c89ca50f3
SHA1 95eb45f8c24c2c2fd0eb90b6293ea9a6c5fcd79e
SHA512 8451a29dd9b62a215b3cd0330eedf8443bbb788b893d820cddca3c0cfd7e6b507c0e67c89f48db27ad258f7f386ebdc77d5649feb4a766b6a8b99c8875a1d8a0
SSDEEP 12288:rh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rhyxknw4FYnshx8OfVe247
TLSH
T1FEC4237CBBDEA4E2F50D10734B7173626609B5A5EA71811BCB6DB00EF5F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 6d19062b8af32316ff5affe7ba9573fe6e706c6ed32d5d37c27f6fb4ea46ffb7
MD5 024fed3056a7775afa816516c4e0cad4
SHA1 afe71fb3f252207b71cee6d04afd7a066ee0c52c
SHA512 40825b5ce8041a6bae1ed25d8cb61ee8311ca67695029b4732fce5a1996298439995149f44eb74a2e74791aabbc472a4f91c9a23db09192b44dcd637b00ba677
SSDEEP 12288:Fz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Fzyxknw4FYnshx8OfVe247
TLSH
T10CC4237CBBDE94E2F50D11734B7163626609B5A5EA71821BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 ffeaef2a4a29c33aea17c768e2ecbb2a57a40ebe769504fc00da22e4a71fab01
MD5 cddbe56255fa4a421cab6daea5d9b4fc
SHA1 a984f06c2ce09f6fe9aa33a89564593cda8ccac7
SHA512 a1015de89591f2c1338f2e424ad1b3ff6823fa05e9cbedc3c9d79324e042d0f39403dbe99a5f578a801ae25950c2cfd135a180436d3332bf3d4cd4f288d10c3a
SSDEEP 12288:fK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fKyxknw4FYnshx8OfVe247
TLSH
T12BC4237CBBDE94E2F54D10734B7173626609B5A5EAB1811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 bd91ee95a8a5aa65d77a812ed49373b333ddd23a6d538b047f9914d3ef61ab53
MD5 0b3a71cf958e74ec13ebc34187720599
SHA1 acf144ab2f603002f9bbafbe69adc5f6786e832d
SHA512 553e61b7603d78f449d956f9b8a79ac57f6a8bccfc26944d53aa7950603fb55996b2b99521ec4f0e136b0dd1f52e43f9d8e0e5be915f16450bd3c7ffa6300bf8
SSDEEP 12288:14+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:14yxknw4FYnshx8OfVe247
TLSH
T158C4237CBBDEA4E2F50D11734B7173626609B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 cd7b24ef4424c406d1357e620476119c500a976295d4dfef43ab56ddc1efc081
MD5 0493cf64292b97235db4752270dca8b0
SHA1 e4d57c1f4666d57f6957bbf41efb5bbccc5921c9
SHA512 3f2ae1e3085f7097d167caa55cfedc708535ef45973479758a824b603a6959c647385efa763afa0dcd4b5df84293dd64f11077e63dcc9d46230b89f76a467884
SSDEEP 12288:5h+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5hyxknw4FYnshx8OfVe247
TLSH
T1B2C4237CBBDEA4E2F50D11734B7163626609B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 7222f4deba870d949cfc84910a66e00fda9bdc8aadb7e78588bd356e767a98e1
MD5 b6873146c1ffc2900d17ff89c449e96e
SHA1 f7fd2c1d84206c8ec28efcb2e742105ebd013dd9
SHA512 3cfda375c3178c9fdd525c78949e2e5844da01e1c8efdc67d133ff7b7f249b24316b072cf944e455f7c24eb2a9ab1160d78e3af640d513171e256c83d8042a68
SSDEEP 12288:ww+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wwyxknw4FYnshx8OfVe247
TLSH
T1C0C4237CBBDE95D2E50D10734B7163626509B5E5EAB2821BCB7DB00EF5F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 ff0ae39701fca4ef3bbe5fbf5ae7bf4534622311341dda198b21c682866bc314
MD5 0dd4e5facb41a6bc2978599bf4b3e3ce
SHA1 18413bb50629c7be3ecaa620bc26b18126e9cf98
SHA512 76cd5a3673f9dd0c60e932da7f3490eb8a5e53bdde401325a991b4b3d2e1d4078ea3a7f8a12a3cfae4c965c1ed6e1b61930d1ee4a4cb43dfa10673d857333b1b
SSDEEP 12288:Om+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Omyxknw4FYnshx8OfVe247
TLSH
T1F6C4237CBBDE94E2F50D10734B7263627609B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 4e75b0d36aab1f7d01a16037dbbf598f5840304da0840704125340948a4ca62e
MD5 757e4206ebf298afe8242412f63cca31
SHA1 8e11a5d1eea194d433939a7057b10602177727b4
SHA512 d8dd8cea6d22ee13ff48cfc7203b3fa210f94ce22f2311c65b73e120738ed459db02950f2ef9a040c1d3dce88b991d696da2e7efa16cd12c38819401cbc38665
SSDEEP 24576:Qfwvok9RX6wkyAIEyxknw4FYnshx8OfVe247:YMnYIfx4x8EVep
TLSH
T17935CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5bfb6e1736fb8127d3f97059c19acd2d39dfd1d188dd6b73fb7fc0165131c2e3
MD5 ea019058254bef649e90fe6153c3abcd
SHA1 f1d399ee2a93479d3063e1eae0310da45b32ad52
SHA512 ebd88161d33d6cb42f208689b4432ba1231033ddc1ecab02ac78adcb5d5af71496580a2665e323ff15f0df7ca83e0b586a3991a335c258bfefa93a40bb3aa45b
SSDEEP 49152:DYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Ix4x8EVep:HySzPQix8EVy
TLSH
T15D066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4de9e70f536659095821d4ff1bde5a7bca51b3505aad93bfe353ffbae5eeb57b
MD5 90e5216ee3cb7e9c673dbfbc55ef47d6
SHA1 81871675263fa4b43acac20b33c0d91cd0114677
SHA512 84414575c4b4e0bc40a35e32ad32c01482e6ca402fd175814ff5e37e9c47de12b823cec82b0fb04c4282cd183e99cb4f95821cf2324ec2381495d5054a3a9f22
SSDEEP 24576:F47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYXyxknw4FYnshx8OfVe247:F47JUQj1irIhCnDHUPfF/4x4x8EVep
TLSH
T1A465AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c69da478729d5dc89b4530aacc01de38651386496c8e470ed3833affd4c509eb
MD5 3eb15ce1d190a3ac1f7f1f5a0510eaae
SHA1 f721a465fdcf19d1c4f94ead775d7602e9b3c428
SHA512 807c580abf71fe59e2f46a51871b9f80da8afb1dc3cfbe14dfcf4a11c086fd1dfbe09d0cb3be22f067d943e21bfb0b31e5f05a25505d687a8c233041ffcb3d39
SSDEEP 12288:oNsfI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JIyxknw4FYnshx8OfVe247
TLSH
T16FE4F028E29802E4D06E2176CB625641B3237C6597F1D3CB97D0F53E1FB1990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 654bf40b94203a30d36d96d5e51edabde10be3cfc85180ac34f4d1a59414b63a
MD5 578981ed39e1c51433d811b00e6b8baf
SHA1 dc61135db870a7f80e4d4764561b8ac5f8768f8b
SHA512 aa1f04771f57fa1d26171d1f9d87e4ad360f95b26b7b0e98161252be4885e4eca568479f96c044db77be0cee5b4ba0058b5a2360569d26603d014af779663414
SSDEEP 12288:EpC0eg/TU3fn+rwxwlAO37OacBrs3xmxphxWVIR1lPnA:ElrUPn+8glOTrsBuphxQIRTn
TLSH
T166352810766AC74FC66D40325E37C2CCAB707D41EE44AB0373C89B3F9576659BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 5dfa0f572fc9a98238dcc57461a79afe253d9d62abc97e4fad2ba803ff0e743e
MD5 96c54a0ffcfec4a0b039a58280865206
SHA1 c3cc2c6b4022bfa4761aa2f3611a836b3f3530fb
SHA512 f21136005fcd3c4e6e94620e495315fd4dcb20c49da63bf474b80ecb6f77773abb20d74a94c1604fb5f4832fe0b06e0d7b82109d08e6bdbed725478e453650b6
SSDEEP 12288:DKdIN621khG6LQ4GMlAQUf5Qc8mPUjJuhdKmhsKMzVz7f8JJIvRPYopTHg:VpkQCrk
TLSH
T19265E9409437A3CFD1BB2032072A9B4CABA4EC17B7056F277788453AD86A755B0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 5e1b59f4c284f7588bbc850f0eb63dfa5a924b924da9d2318bdd36acc228c5c8
MD5 f14c14ec22bd1e94af1bc405aa20ac15
SHA1 c3725caf453e6c2c7aef41406ed71e0a25050198
SHA512 ae25ef0abc7e8c3ddc9be0417815295e7515e017ef4d84ac73e0d0bd4941197f1e5d161bddddeb4a08133ccda09816d4b22a4ff04f42efd4207b6899d3cd8be8
SSDEEP 12288:2M7A+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zAyxknw4FYnshx8OfVe247
TLSH
T1C3D4237CA7DEA892F86D11730676A231320AB5B49B70C1DBD728B14EE4B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 65f840ee22bf43597b0b6a8907d26776f3aecba82545977fd8c77b6db076bddf
MD5 92087236a7740d1f7875fed72e3231bf
SHA1 d2d389e71a49dc13b5f55e98107410f6524bbb5f
SHA512 bbc871187ab63d7a1bb01c9566d84f9c927c5b9ec8a604870a617ac8dd53ca480166a958b4109efce184ce56af8fff0e6724bee6438def0ae57323c9cef9f5e6
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYSyxknw4FYnshx8OfVe247:7gb4mBIBhGFix4x8EVep
TLSH
T13865AE1E22EC02F5E0F9D2B8DDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 c2ac3e617a85fe6933d0419b31142baf6a897dd0e2f0538530573df22b46f19c
MD5 94befd652d0d0731cdc92cd296007c33
SHA1 1699e831c6372c053fa5e447f44df0c33da64df1
SHA512 2a250a8043fd1567b3c67d8f21689e3b4b1d0813b3787ee9277389c6363afa0a53b21be7374edc7dd8dba2ba3b951464c30a467d368e1d41c7e36756f250d41d
SSDEEP 24576:AG88u8FpJqH1bzria7/mnyxknw4FYnshx8OfVe247:T7ZFPqVea7/Fx4x8EVep
TLSH
T13435F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 2a30117bd9cbfc4cb60b0dce218605550e05873dab315ed09231db22a410a027
MD5 d05a5fb2a9c6a3d15de51923b7998282
SHA1 26fd4a3b47fb60d6ba3114f6a8c47dbd046a77e3
SHA512 aa43deea29cb3c6e61f0ff2f667650ddb57dd2112fff3488e232e533151866caa1a1a05a9825f01787b23414b528a3ade7b97dfc2530426589939dfba2afe420
SSDEEP 12288:eHvUrBFrEjwaQ7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ePUr+NQ7yxknw4FYnshx8OfVe247
TLSH
T14105F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a695c907449a0bee864e777a1a90043d7e2dddbf4bcc62c0ff8e8144f163aeb6
MD5 e54d2398b1307d89b0cf41e9781e55dc
SHA1 841e601af5e56f0ee607bea31b5498338cb3a5b0
SHA512 01a6e743f1142070c58290bb5b8e4026109d3a1c6048de191c9a570b5c81d008d4a0ba97833263fe28ada358d68c16f5011e5cd15960f0f3480c9a3e81dd5fa7
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjux4x8EVep:FG05lO43bXix8EVy
TLSH
T1B3D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2306ce3143379c97389a48815369239859be039b53a5c9403258842463c1e336
MD5 b27e00f902d77dd9a7e565224e3b7d6e
SHA1 4256264c83755a0a3fef1d209898aa5f24c19af2
SHA512 6bdf0cab756ec11b3c4fff56aedc82c91af0a97fe8cbecd5f28c77e9cb1459176f4afdeba5122c9643a86de9a98805c865592da2e437e645d9507db1ec9c372c
SSDEEP 24576:4fa5POZ3dpFWVM50JicR2hG0lasx2+47eidndyxknw4FYnshx8OfVe247:Aa5POZ3+Jt2pasx2+m2x4x8EVep
TLSH
T13C65AF5DA6FC01D5E5B9D17DC583461AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 35cd740e56428c15c7221a45867c0bd701bc1e5d0237fb214e97351efb6adcba
MD5 7ffa05a6102c4bbf36558413e9749377
SHA1 12849e531248be66db95d21e40da31aa42350996
SHA512 9cb7249d3425c6dcbac0908da28282d93d28466d0ec81d95663eb86426b09e8daa45632f5de9e0aa0de5225c90f0c94b98ff5d5c45aed0d73c4df19153fb3495
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7Fkvyxknw4FYnshx8OfVe247:rNc/zEOVHFlx4x8EVep
TLSH
T169857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f2ceea6e35d4b51e52c7249a6859a0854ee765412171b3b99579f010979611f1
MD5 6cbea966432f711bc7d5981c7da9c2d6
SHA1 df6256b9915c70ba9382767ebf5dcf9a6d86b423
SHA512 e221ff2ba54a89f10642f66cdad3766308454ad17595d7b841f161ebff56b57afa51e8134ca9e6673b42248ecd03e5396350e1b69524fc4638452fd4733d49a7
SSDEEP 24576:t8kNvNnaFeYhJNtmZBmJyxknw4FYnshx8OfVe247:t8MwBtOmMx4x8EVep
TLSH
T12A55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 02582f2da28804ceaae652904f1553d11611d43df850ce67d8443d895c31b94b
MD5 025dd74a8df011e1af452e858c3805b0
SHA1 de892303a5abc6e4e7d9f6739b1b768ba168d0c0
SHA512 6953a10e4cbce88005ce54290341e861304489e06d14bd6d42052482215dc497329cacbd7d2498f5ab8aa09c9dba4a2205afd51f5c533e5a5bce86192999727c
SSDEEP 24576:bD3FHshBIYQgAsyxknw4FYnshx8OfVe247:bDVHeBIAAHx4x8EVep
TLSH
T1C825E17DE79C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1164-14-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/1164-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1164-20-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/1164-21-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/1492-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1492-67-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1492-73-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1492-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1512-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1512-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1512-513-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1512-515-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1512-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1512-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1848-327-0x0000016ABC100000-0x0000016ABC2CA000-memory.dmp

Download

memory/1848-591-0x0000016ABC100000-0x0000016ABC2CA000-memory.dmp

Download

memory/2324-79-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/2324-84-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/2324-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2324-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2708-348-0x0000027808AB0000-0x0000027808BB0000-memory.dmp

Download

memory/2708-380-0x000002780C550000-0x000002780C570000-memory.dmp

Download

memory/2708-394-0x000002781CAD0000-0x000002781CAF0000-memory.dmp

Download

memory/2708-361-0x000002780C200000-0x000002780C220000-memory.dmp

Download

memory/2708-363-0x000002781C750000-0x000002781C850000-memory.dmp

Download

memory/3456-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3456-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3456-134-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3456-128-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3456-136-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4000-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4000-307-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4000-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4000-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4084-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4084-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4084-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4084-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4252-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4252-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4252-122-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4252-116-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4288-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4288-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4288-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4288-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4288-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5108-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5108-102-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5108-313-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5108-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5108-108-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5108-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5552-77-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/5552-0-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/5552-2-0x00000000023C0000-0x0000000002426000-memory.dmp

Download

memory/5552-6-0x00000000023C0000-0x0000000002426000-memory.dmp

Download

memory/5552-7-0x00000000023C0000-0x0000000002426000-memory.dmp

Download

memory/5752-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5752-44-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5752-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5752-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5752-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5752-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6024-517-0x000000000DB00000-0x000000000E37B000-memory.dmp

Download