e306d5ec554bf64f57e6b90a6a7dfa5b6c9f0c7ab455ff36343fc0c81ae8bbec

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.5MB
Sample260709-fpaggscx2q
SHA256 e306d5ec554bf64f57e6b90a6a7dfa5b6c9f0c7ab455ff36343fc0c81ae8bbec
MD5 dc0ca4f9afeda82f7297a4cc33dbdeaa
SHA1 efcec85246589557817863058c9d1f44b5681e37
SHA512 e14cb27de6581faa8cd6c2b300cc8368cba759b786439ec788e1cacb8540503273e4dd07229929db2ad8df0fe37f0f5bd616dc8c9603c7ea3004ce4f521a7518
SSDEEP 24576:Or0URPEJ0sg+9QqVkpSHeJFf9n1i99k32tY5cz84:OrxRP9sg+OqVks+JFln1i99ZG5v4
TLSH
T10A756B0277F99169F1F37BB1EEB883645A77BC71AD39C50E6280215E09B4A40DA72733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5868	elevation_service.exe
2504	elevation_service.exe
1540	maintenanceservice.exe
5796	OSE.EXE
5484	PerceptionSimulationService.exe
2456	perfhost.exe
2232	ReFsDedupSvc.exe
2356	SensorDataService.exe
6024	ssh-agent.exe
1884	AgentService.exe
4576	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d26f39942468fd14.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007873926d600fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009189ba6d600fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000007d7782c600fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	580	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	2232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2232	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1884	AgentService.exe
Token: 33	4576	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4576	SearchIndexer.exe
Token: SeDebugPrivilege	5868	elevation_service.exe
Token: SeDebugPrivilege	2504	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
580	2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 3780	4576	SearchIndexer.exe	101
PID 4576 wrote to memory of 2680	4576	SearchIndexer.exe	102
PID 4576 wrote to memory of 3432	4576	SearchIndexer.exe	103
PID 4576 wrote to memory of 2748	4576	SearchIndexer.exe	104
PID 4576 wrote to memory of 2428	4576	SearchIndexer.exe	106
PID 4576 wrote to memory of 4680	4576	SearchIndexer.exe	107
PID 4576 wrote to memory of 968	4576	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_dc0ca4f9afeda82f7297a4cc33dbdeaa_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1540

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5484

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2456

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2356

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6024

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3780
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2588 2580 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2588 2580 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2fbd8ae422b02987b36519234773b93679333854ab8197257c318e6332f287ff
MD5 b2ddda0a52d31db85a6eea58708e1e00
SHA1 172ece933697a218775607409fb8a323cddb2da0
SHA512 406132208c96ac0ebd6f4bb8f43310ed32e14eb6e24f338a00fdd3f54b4206ff973e0ab8d7ea6f99370bf6687a879eb64c9054aa9883b89b75615ec5fba2f860
SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnyln1i99ZG5v4:43q6sjBdEHGt4
TLSH
T16AD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8204d45ebc312e129ef7f609882705faebe10267c616b2f2cccd69cf4a7f3711
MD5 3f7733f308801558c39dcf038a4c6c30
SHA1 585d93855a9ce9332f0d0d77953cc63405864868
SHA512 d3c1f2928b104b7500a93b2b252c38f51804cdccb02f87790b5053a334ebf724e18941bee427ac0880a354f5ea50ea981dd2e2f9c3dad34f86b5a037189a0c9b
SSDEEP 12288:L1XLsswWkxy2lRq2czAXLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:xXYfDtczAbf9n1i99k32tY5cz84
TLSH
T1A7650129B3D408F9FD27827DCCA2C911EA32784547A0E78B03A499662F377D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 00587df6e40275c1e5b9762f3b6fc41e312f2e9adedbb0c89fbd318aee5e445a
MD5 3d6cedda875ee41fab23820625582f8b
SHA1 16cef09f84ba009d91ba39cd25b5843f753c0386
SHA512 194f3c978d1dbc9ebc904f2a4d1092aef7a42596cdada22c519d69428cf02bbad7d2f6e38b136e429e1c37207b5a3944559face8c12d295e9132f1efd6ec052a
SSDEEP 24576:x0Le5ji0hmxxrMKf9n1i99k32tY5cz84:xPji0AjRln1i99ZG5v4
TLSH
T136859E16F6748335D073C0B9C5D2A69EED7130865B308ACB4286D77C3E6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e82ba39e40840980d1117e200c09d7cb8bd5b9610649b208e7b8b7bd90e05122
MD5 c17dc5d8cd4ba4c49e47933f5cdcf61d
SHA1 0d9391ebe64218b6a15d457c0a21b5ae375c5445
SHA512 189e9da807334464e045ed62d5774e884ebfe519adf58bc685c722165d37fb4bd032b9709a9c5e2c2a596207ce97d341eb43222a4d04b5320507ee93ff3e514c
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWn6q8wyu8f9n1i99k32tY5cz84:e/ezSC6vUzPveHjyVln1i99ZG5v4
TLSH
T124756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b7e0121291e36082fd9a65a81cf32a6a7e177419b04b0ee2049d8a167af1324e
MD5 c7cd44cf0214d186b4b16437308f309c
SHA1 6cb9c84b38ab001dbd6a8d56812da066aafca50f
SHA512 87cbfba1ef1eb7ab7e84f15bf66d897945ceeda4cbc09a625a3105e0c8e2f0c450476d26573023efc532b300c23a7c0b110fbe15ebda26e3970f14c2751e9af8
SSDEEP 24576:/VbqPb88hv/l+YHf9n1i99k32tY5cz84:/VO88hXl+kln1i99ZG5v4
TLSH
T1E6559E66F5748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f131824c6705fd24ec41a95302c462142ff461a7c423618a1f98d479acbbfc00
MD5 406bbbeba8af6773c5d6887276ff3e4d
SHA1 171881a355e984616416ebfdc27785e888b510a2
SHA512 7c275c9bb8fc6720d7e6f564798a445d42b4e0f76c26fdc8540b3ad2a429a6261a5791845af86e6047a5032baf721b266df804f58b1bfcc4bdab6bfb90f04a66
SSDEEP 12288:pLmLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:pLmf9n1i99k32tY5cz84
TLSH
T187452353F64891D9F71722BA9CE5CDF4A97C5F0CACE8A812D3217A9738FCD78A050512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 40a71a3e95ce5b19719b00201f1987f1f7b9d3a2e71f3482db6077ae3ebe5dc5
MD5 8ab9ef77bfbc70f19291ed1a4a14cb7a
SHA1 7c43e0942c49a80360feeac113d32b1f979f2dbf
SHA512 f65045b4ca5ede26015064d6afb26f07e6d270b5242dcd0a6b2725b313cafbc24e073f043fb5fa40367b1f4e60db3087f1f0177551ebf61065d53923657db20a
SSDEEP 12288:veBNUbTVO86UjLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:vJIU/f9n1i99k32tY5cz84
TLSH
T13965CF3BEE28FCD2C23A5DB95A91C640E77278304F61A3CBD165830E9E279E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 18dc65da9e773454cc021f4c398e575770f6ab67cf0f123b919706870159d4b7
MD5 2a942d6eee5f0b21c06fe63016891697
SHA1 1a59e54f1bcb48cd89c210b3ab86fedd46a904ed
SHA512 d749e0b5cd44e8397a3ccc9018afe037da3e24d115cb544fc476f0445fddcea184dc0f5ec1f45d0a1c22e75b42e357323cc462d3f4272fdbb90374814a0af1e7
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THo:6QvGAdlCEL8c/DRNw5CKEHGt4
TLSH
T1EE267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 acbcd1bb13454c26cb6ae2de684bdf599787a9f752e102c5d11b4240f2623c15
MD5 099e993869d385ae0d04aac1030dc6d5
SHA1 44d8c3b721563ba039b30add274695a99104a517
SHA512 2e425122f4c08f73f65385522ad20ca3da6d7697b0e025243c04eb473c57326458039cbfd0104cace9b1027c3ab2012d0e9838a7155d33d288469122bb60fea1
SSDEEP 12288:FAwSfxL/2Dc3RDLLmt0LDQewsAjRLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5/:m0ewsAjBf9n1i99k32tY5cz84
TLSH
T1F375E031FE74E036D37B0DB61B66CB16583C7A204FA119C3E3A84E9E19746D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a05f37c5ad9c1c67bee49c9a77d769ce906252ed69f38192527fa2d3b1da20ba
MD5 e86037d3c3a5459e875f3716f6649db3
SHA1 f03670cbb9f0212c23ed39cf01540535940ea7f5
SHA512 67a8d6dcf5b947b6533e032af009b71cba4b77ba1ff282b3193b539c40ee5f6ac4d6acf3444806f03022291bc08bb6faa110cc49e0304432164b10e4de4acdcf
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHf0N:bUEtQevvqc2W1cpV2tI32
TLSH
T155474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 720a23f53b00e9f22f3b8a3491eb76ea4956dfc34ff912486e6729870fb0f61f
MD5 4c3d8415224b5d481cf0a648f4050cbe
SHA1 6c14e5db55b03a950e91519b17ac6549de9e8aaa
SHA512 415755e1a7573476eb92c4512530d356cfa7cecbcb09fe49b67db6c8d1783c336e8f3bfcd512ed9e89057baa44a3960336fab0b3023da8e53ea5eb86f3cf23d6
SSDEEP 49152:YCbRquA/m2yL5zifFiV+XenmE3/zhln1i99ZG5v4:RoqHVjnmWEHGt4
TLSH
T126D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 999bd22050b7defeea2af6b852158bc1c0437b0381e80107825c9edafa6c575b
MD5 2c051ca10138d3e1707971e296444b41
SHA1 1e91dd75caa6759f020bae0c19003671d778b7c5
SHA512 6ab49d5508fa204c403cd3bbaaf7e4c6220964be25df51d224b309d2f3c7d812b9224aac46e81958dd2d9ed971ea749ae14470288cef6d11af3984bae9ca3970
SSDEEP 24576:hAhGL3IFoiwtA5l7S53wf9n1i99k32tY5cz84:hAMUFoiq5Aln1i99ZG5v4
TLSH
T130359D81E7F945D4F5B3AAB899B68570EA76BCA95E30C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f6308a0072fe06f8a0280ed50f9e034b2241604d7b091ae849b8a6c8a0c761d0
MD5 18981228fb89fac0cc72472d593b311a
SHA1 57912c8a5194ea82dff27d2020cb4c461af74a23
SHA512 212736d1ce20cf60955975c3cf1103ba7c40feca93078bc53f966ddc8259aa0a718dba152ddd5693120c4de2db8bdc2cbf837cdda014e00ccaf53747bbf02ce0
SSDEEP 12288:3mw5HEjsChNVBFgl0WDm+CYLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcL2:Wwu4OW1f9n1i99k32tY5cz84
TLSH
T1CC65F14676A80CF9F9675239C997C536F7B2BC052A64DB1F4360C65B2F37320AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 67dcbbeac7bbd0533818b11a7b9ab55fac88761d866d50079cbb02a075d7de12
MD5 854273bd7466752f059d24502b222934
SHA1 c91a92fb704b324ba24eeda5dc8c6a7a5bce483c
SHA512 b16d76a7b2e5f397e3305088af64570d799d98e8a10e5cc3a48d07b3e5aff48ae61c0d372d3ae8919c7d746c02b00061ba4311405d9abed4e1380d787791ac88
SSDEEP 12288:ieZ1IyhLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:vZuif9n1i99k32tY5cz84
TLSH
T179551257339860F9F223527DCCE18A54E771781967B493CF532446AA2F7AEE42C38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f78d4b0326f550c2b4c2eda173118a333b26dacebabdd1cbf5b5270a01057d95
MD5 517d949796833a15317acd48db7731ca
SHA1 48152e98f393900dd25fdc33f38ed8523610d315
SHA512 d4fe61cbdde7622fe69fe480089b99e31c24e154cbf19306bf203411e967682ec55e3e1730cbed885ae3419ecaa2bbc082ef9bad3635229dfbb91c9df7fd6a73
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:iQRQyi36YOcPbLvw2gAf+PN3hEHGt4
TLSH
T113667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f9be21a878ded40987adca9ff92bd99542a1531262886cbb0f782dda9071f6c9
MD5 21f9a64e64d1711bcabc1904b66f401d
SHA1 64415eab6799816c3b3a1c1374dbd177d96fc1e4
SHA512 ae47728fcb3fc17d3031bbe23a4abef29d38373d3f339fb737ef6ca37c0f1d5202b9ce03bae79f015325ca54901b156e963627f5d4e7c1c129a95017fa354869
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:yQRQyi36YOcPbLvw2gAf+PN3hEHGt4
TLSH
T198667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c3c1e56f7a7c67c225e77e81e257f0a69c400b4a5f338fbe74810d77fd198d29
MD5 98ab088d61829e9e251eec10fe78fe1d
SHA1 33239a29066f9392aba5ce2fa405da5fc6c6cb84
SHA512 d5280302006e583e7594f015534420605da563ad6ce829615908a328cd6e370669e807247806faa68bc83e00c74228e5f0beac60b1b448f86fa75101939d7b90
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0yf9n1i99k32tY5:368Qg55nhceWu7PNU3/Rln1i99ZG5v4
TLSH
T115B54933B2F600A9D44DE1769F4A873196E17C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1c972c78a28c9f0b84d4029999a2d988bd7576cfca19215ee8b3ff3a5d43fde3
MD5 dcb79af4a6c48406a61e993559bc2cd9
SHA1 d34c075f42c00dc524b1ad3681a1091a9155ea0b
SHA512 d71dc5bd648c9f97047973ccab5374235b5954c8291f805dd8aa89a7ac14c8776efea931aab5612356dcefb47f1ae5baf704662bf8a2d55229513920ff08fa74
SSDEEP 49152:l3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99q:Ey5112gYy5azzVvt69nLKnhZ0EHGt4
TLSH
T1E5167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dac7fca46eb0ba623ce9c062f443f8f380c474fe0a4702677d6c827434855826
MD5 08a484bb53958a4e64ec8e467e0e0bec
SHA1 eef94637df6aaedafca59b1384925b6d0e265351
SHA512 8b13735b5afc9ae0809dce32b45efc1dbb578e6c96ae0f9c45a1c31ae77056a7cbd52f3e693840b9b8538664584b8226594ae1ea238d611eb0eb421fc6d07d1f
SSDEEP 49152:FB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glrln1i99ZG5v4:ru6Jmdxd2d5EHGt4
TLSH
T16BD59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 045ca6d0fd5aec3646284955c3b60e3c6d8555975115414e9f8c4198cf26630d
MD5 0af326903720c3ed8c21b9b431543f6c
SHA1 6ea09aeb5b93f2f1ccd4940510edaa15f8780558
SHA512 c1115c4597615bfb628c9928b4486cc5ec9486abc0d709fa999223de119fd82e51d86145c293eabd8313f4749f3d04e05492a76867ff7ce1a357518c8259dc9b
SSDEEP 49152:+1hpsNoJpF1A63U44CwH7R4xfln1i99ZG5v4:+mifPWRWEHGt4
TLSH
T18CB5BE13F29801E8D05ED17887569632EA72BC450B34B6DF0A90B7962F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c86f801eb998873fcda85ed8cce5e23018f1145263f48f03da080bf6a194e3a2
MD5 10ba10d8fa8d5b60dfd219681f45f2f0
SHA1 8505d92900554cb875680ac436cf4877f92f5c7c
SHA512 e9b1a2ed64f418a20d5369f356563310f34cb7e88f51382d66529170f1d33b997d46575729dccc8f0bceccf633d643b8e70fc1e264a574232e709a2c22c6cf36
SSDEEP 49152:rSuZQIY0Be2KcRVtOnks6NMHqiln1i99ZG5v4:55dKii61IEHGt4
TLSH
T1DCC5BF03F2E940E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cdff250ab795692bf3fbabb0cf9cf1015ba7aec21fe014aae0b97f8f483e17ed
MD5 f3e46bd45a3fc6f7383bb992faf7baa7
SHA1 6e9d5cf4c33c7bf30085ff8a6183ae194c3c6f0a
SHA512 a07113788ddd9ca45ef249573b4e93bdd54edd44aff11ab3289223e8d6acd3469c9038f2185bd9376a9cf395965291aa3707a44d6fa175822ef955e011c495a2
SSDEEP 49152:qhtSn8EApI0fig3giDn0AP5wbln1i99ZG5v4:LX2imphSEHGt4
TLSH
T18E95BE13F2D901E8D05ED178C7468632EA62BC150B38BAEF0A90B7561E7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1cb57cfd6c707b152b532a191c747ec0c45a0becc7a16955bb1c2f343e078d40
MD5 75d9b93cb9b529ca5c835ef70f35e900
SHA1 5e7d977bcf47e836bb2b2d37f53620de184b96ce
SHA512 a5e8fbd46d9059e93b45e251c5f2f340e1f9286c3ae0b0e8d1b60106311a54317e2636bc83146e689bf2801cdf35d9f353ca48d3f383758eddbc7b1cd6ab1d17
SSDEEP 12288:VOLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Vef9n1i99k32tY5cz84
TLSH
T1FF452353F94882DAF21722BACCD5CDE4E97C5F0CF9E86462E329265339FCE782054925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d3fb317c23662339f3a419c20579f15e4dc4f215561e8a348bd922aaa916b0a6
MD5 8a39325f0f069d7cc9b9e07ff8afaea4
SHA1 c045f028ded4a97d2105772a53d819ad24b6fc48
SHA512 d7ff1f90deff51b458205207721f7c055e198856cd9c3ce22666267004f809df735b3b25ca130f1a705b9e352595474e87d1f92396fa327ae3dac795db1edbef
SSDEEP 12288:iVLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:idf9n1i99k32tY5cz84
TLSH
T1BB452353F94882DAF21722BA8CD5CDE4E97C5F0DFDE8A462E329654339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d7f318e54fbd7544b9af553b4c545390e6e5c368e7a76a5f49c9fec40b2c9727
MD5 7f10cd1251bb70a99f57bf1b16dec06a
SHA1 2d83cfa58e92aa6b663e7d814014b52cb936177b
SHA512 a013096ba16e926e40a952e97824b3b7747a2d7f90dba7e2139fc40e1c17937b2d4221dc1636c80c89092112e82b503fe9ea612d2d0f8d1610e2241abfbaad0d
SSDEEP 12288:DrLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:DXf9n1i99k32tY5cz84
TLSH
T135452353F94882DAF21722BACCD6CDE4E97C5F0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 92d241d5a05e8e87222be3aaedc7a8032ac8db6b1bf2771b2512faf5ad7344a0
MD5 4cb81aa4ec583d59d1923fd96f0adab4
SHA1 3a72457cfadbef3f3e4c2242a990c7c70bdca54f
SHA512 e0d3a158840ce0acc3cae2fc843ba2d0874efb9e051a5dedfc4612f3340cfaac94310080c375de0de0d4abbcd9d6542d400e724bd58495ebc66fb2e4823d4d85
SSDEEP 12288:JVkLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:0f9n1i99k32tY5cz84
TLSH
T1E1452353B65841D9F523A2B9CCE2CDA4E6787E4CEAB4A59BD31015473DFCFB82420B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ba13a69ba7fd5aa87a987ea8d484ab602956526fd7a1f66cdb396d8e1086e014
MD5 9f04c0d0532b87a7798e673e5fbccdcf
SHA1 6dc763cc194691381d4e60336161bd9d477c0586
SHA512 50e7d0dc08e795eac108f70d85a742d9b48bff7d42613f8618ee68c7647442e38884f524e64607eda47102b08357ae167a4ac2bdff896e3b2ea2c1ff75aaf0bc
SSDEEP 12288:38LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:34f9n1i99k32tY5cz84
TLSH
T1F9452353F94882DAF21722BACCD6CDE4E97C5F0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9170c9f7ecf769af4ae6c8960925b036ea8a979cf40ea59d0a12d554cb034212
MD5 962a2c85756f164d8769106d24efb68a
SHA1 bd5814d11d91bae68af61f04a6b97eab629f7a0d
SHA512 9daad0b88fdbf4417cb8a9f990feef918abf78fca03da717ff0792e6f4e42369f7869f2f8f0850fe228a340cac47b5fd5ac5cb8286c07c7a6b7a51a4d5b54c76
SSDEEP 12288:MZLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:MZf9n1i99k32tY5cz84
TLSH
T1E9452353F94882DAF21722BA8CD5CDE4E97C5F0DFDE8A062E329655339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bc6700a94d94defc875479d16ba71802946ed4738f007a65d0012bccf4a26826
MD5 8410abf3c7671e64c63246e9d4827365
SHA1 20dc2f30de780dc196c4f72d67768cd2b02e77cb
SHA512 4ac0b2402b3a79025733920ecfde7d85489f9f51e652d94a69496fd5f7c1cf04b4cdcfecc8a1802fe672c6d4263a9d45e3a64925cd645d93a194c9ab9e9fa4a6
SSDEEP 12288:qtLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:qFf9n1i99k32tY5cz84
TLSH
T1AB452353F94882DAF21722BA8CD5CDF4E97C5F0DFDE8A052E329659239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d8b63bf0590ed5248eda32d16efb071283cefd9942534f3490bb00e7cd9a0fc1
MD5 7b89f2e0041b8e051410c83ebc5a34cd
SHA1 fcf2dcb53a62524543a03636aa8c46211a7543f0
SHA512 c9fc6d7f8976f42d867e902c7d1797b77329c266dec1ac3366cc20f0c25edb8946b09d1d32ec27b8445ccf39507aa27d726f809966eef7999a52363927c09be8
SSDEEP 12288:tiZwbVzzFEoS2cPvy1LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:wZMRzFVSO9f9n1i99k32tY5cz84
TLSH
T1A0650195B39018F8EC27823ECC658D56E6B27C195BB0C61F03A436672F777A01C2DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2493f028cdc5918340dd6490265f18c1aa0bda73f700073cbb2671533c80a060
MD5 e9eda584b41fe7e3653cfca7d28c7436
SHA1 954b035bd6dd5058e1c2130ffdf337c3b9134e7d
SHA512 46d8588ec0fc03e62db3d7c90ee36c00dab43a3d461889d18e45fd1d0b9c878f2161ef58e4a6866e354fb10adac06fbffba5766b092ee36bd9062377c2e10c68
SSDEEP 12288:TqLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:TSf9n1i99k32tY5cz84
TLSH
T165452353F94882D9F21722BACCD6CDE8E97C5F0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 55f60962b7216d9a13a2f5547938bd71b0610ad7ac32c64efe9bf8b42cb37bbf
MD5 38b8f79a9ccffbc998e64096cf078938
SHA1 e75d967cdd06fca742c1f3553b1c269dde0077e6
SHA512 8141e1602a8cb7dc166b8f94a72338c3e1facb20d89d3b797c95d227ef052ad9158059e1c7f4e0d2ac5cf6999801db1d3ef9ab0d6afbac66f32a067277937e1c
SSDEEP 12288:H2LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:HWf9n1i99k32tY5cz84
TLSH
T149452353F94882D9F21722BA8CD5CDE8E97C5F0DFDE8A052E329665339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b8275778645652da91a83eef45a54f127076d2b6179a98c87aae227a24cc670e
MD5 2ab6811dae1afb0423a448e9e20a9c61
SHA1 b6cc18f8854f47e37e6309b11db6798ece740194
SHA512 891cb66fdbfde90393c190c7fd680f72d65eec03a0ff2b1d1cc8c0406744b7381cfb8aae3c668ede7d55937803748498d6d9314323268a2b1b6063384ed6ea49
SSDEEP 12288:VyPz5L8hLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:8zyxf9n1i99k32tY5cz84
TLSH
T10C551207B3A430F9E1275239CCA24E51F77578355B609AAF536007773E7BAA06D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1048464fde3381dd0c2c101e382512f614661c6b7413612177cc2f7d05977c34
MD5 ac3b815d380624722f4335b158f42f77
SHA1 676d4c40bc235268989d7affe0e4cfcb35bd2f27
SHA512 cf88d4af10018199a0151548cd4afd1e330fd6c1c2efb8eeff8aabe24080afc9a5dec1827dae11a315e0cb6611a9f91927792179a8ad2242ab73077850141164
SSDEEP 12288:7qLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:7Sf9n1i99k32tY5cz84
TLSH
T106452353F94882D9F21722BACCD5CDE4E97C5F0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 307149a0997764be5c8ec90312c9dbfb3c3db7f4a086a78e0230202dc46d8d1c
MD5 d90c4b97283be1f02a613af8b0be008e
SHA1 8bfb6f338688b7f9dea0dc304092fc4cbe4d6a3c
SHA512 ae1599a74e98d03e429756b03a5e42e57dc3331c7c7f0d7606c12165c39a9df7e6ce6b69249daf00cbe5cf35d54999750bed9b16c576263304b6dfd4e906d1c8
SSDEEP 12288:VqLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:VSf9n1i99k32tY5cz84
TLSH
T188452353F94882D9F21722BACCD5CDE8E97C5F0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7f639ff43a975cf2839f7bbce01c1acb2a30369db15263eebf9f7ca04fc47515
MD5 744a11e65b94c0ad24f3d7a3ae0dea76
SHA1 9f6b243bf6fa2efd931be1ce9dddcd9d3227fdf5
SHA512 7ef265261b2fce3143eabbd233f9e4230483915509c45183966df68eeb0d10a9c9ac3b8664d5b6a1d86146e2b172ed5ac1993c8eece64cfaa9256a673c91c455
SSDEEP 12288:wyPz5L8hLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Bzyxf9n1i99k32tY5cz84
TLSH
T150551207B3A430F9E1275239CCA24E51F77578355B609AAF536007773E7BAA06D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c1e21fc294e25aea943fa61fb5e75bb753a46cd7da9fa4e74cdc461d6fee51ca
MD5 4ee77321925cfb96af21bd4f8e824715
SHA1 083b5a30b943008dc9217054a218e5976160ca08
SHA512 5da87d2d157cbaa530f03e39c71960ae618055ed6383853fe53f755c0ff0a53661010cd59a6adf8c36ac49302fec785566ad0e3dab06fadf684c3963d75f4cb8
SSDEEP 12288:hCd9CWYoaLHF3z0z04PDvhbLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcL2:cTDaLl3z0zDnf9n1i99k32tY5cz84
TLSH
T1FE6501A5B35018F8EC27827ECC658956D6B27C1A4BB0C61F03A436672F777A01C3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1c9353be29b499173f552033f03ded123f191e9c3136770e68e4d1ee456979b5
MD5 e723308e37e3dab50fd2a27ae8ef9c01
SHA1 62fe501cdfff71aa49c834e296cf2efb8704cc4e
SHA512 c99049da6147601486a0239a86e8a9b97ea47636393e2bebe9bbef7f9daa9c5f46170a48f84c3bf0fd23d7ab32d15c098c64c4a0a3a43326bda5d23e93f2d3ab
SSDEEP 12288:li4e7KRdTfgwCHKy7GLbbdIvwLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKJ:l3vd9CHKy7GZTf9n1i99k32tY5cz84
TLSH
T1BB75CF91F3E810E8F1779A35CC768511DAB67C595B70DA8F03A4265A1F33AE18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 eec1ccc8a2e47c4abfd8bc57b41c90c2f023dc909b7e41dc3ed834680d4de736
MD5 234d67c12e050f8e6f5df2ed95d5cba3
SHA1 222479d3d8c69e98249e1b23c808360277266c7b
SHA512 1a2ec3acac68d951d26f2688f0cf2938f33c168769552b480619442e7b2db760f6dbe4b753b4d7ca7009db4191454c549ab5abbc51dd1b3b59fbb00b4672a354
SSDEEP 12288:cLLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:c3f9n1i99k32tY5cz84
TLSH
T19A452353F94882DAF21722BACCD6CDE4E97C5F0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 021540a7ca54ec95c4d917a949088c78ffc0b7add48c8793f7677de678eaac9d
MD5 675406a4353233b13b8f75cd50920b71
SHA1 ea89123183194862b62fdb114c3c83c5d8892022
SHA512 013c0ae7046325557f03dcac6736e3493fa05458d5bc8f91c4f170727b75347a4ac66a9cc87ea7c1aaa5368404dc6480a2811f927a6c6067a57709cd77e3716d
SSDEEP 12288:CBLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:CRf9n1i99k32tY5cz84
TLSH
T177452353F94882DAF21722BA9CD6CDE4E97C5F0CFDE8A452E369255339FCD782010925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a370b9128e62e2328166932796e2a954904b9543d09175db6b9e98d5eca09297
MD5 5e2b10f3d2f2854a04cf6ffde1283029
SHA1 4f40a9f4ce30e1bd2ac7320685352abfe288b8df
SHA512 3aca84c6a6629ddaeebd8ddd8fdd4a1df942cba3c17210cffe50e24529d28e425f07277dd4e738c98c09eee62ee704b3586656186e20d8ed7afd99220836d3cb
SSDEEP 12288:MwLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:MEf9n1i99k32tY5cz84
TLSH
T184452353F94882D9F21622BACCD6CDE4E97C5F0DF9E8A453E329264239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ecc046275064c3ec21141a0a4d29390c5b210e384b2fe4c6fd4015be7dd59703
MD5 30e84e438d73a2a60bb9fb146bc4bcbe
SHA1 403f0ff865a75aab683af9cdb24afe0510d03771
SHA512 80e4732b029f5fd5b859666bba23423105735b3623143d4ceb13d7962b32b34a70061613992b5903a5c495fbf2e856d8c4bd1577f35c4b4f1d7e046cc51e8e18
SSDEEP 12288:wqLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:wSf9n1i99k32tY5cz84
TLSH
T1E1452353F94882D9F21722BACCD5CDE8E97C5F0DFDE8A452E329265239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d1a00bb390997e407ccef8e5e9e5802fdeb63d12e11072491a620bee55088259
MD5 3c261c5f88a3680ae4e863d2784770a9
SHA1 ab932e0ed07ec5185aff32b667c463561bbab147
SHA512 523ca9b40db3cfe91f498cd4c5b553d093468dcc998a6a1454a1b445a2ab6b25dbd45bb1c6f3139769f91b171ab023b6a439dfff113a08630f041120a19071ba
SSDEEP 12288:KLLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:K3f9n1i99k32tY5cz84
TLSH
T172452353F94882DAF21722BACCD6CDE4E97C5F0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3f2c837ec4c37b7a2a4b3c3502da4136bfc45d2423c602fe1a635b3152afb2c7
MD5 c35bee807e91c60466c933f437285aee
SHA1 abcc13343c7e45eba6d2f5892d0ca77d93bbcd3f
SHA512 5549c723223a14c8438cff6ed7c32b630985bd03ea8766e197c35e127b9f39c4fffb4b57a7a2629a890b450e4e03a74d1602397238b3c90935c61506465df996
SSDEEP 12288:dCLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:daf9n1i99k32tY5cz84
TLSH
T1AB452353F94882D9F21622BACCD6CDF4E97C5F0CF9E8A452E329664739FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 db9932ce839d26033ca7c602ab1da0bcb9938335d0f9ee3e2dbc9d7edaa48193
MD5 5ff6d06ae26684e47cd1e0992512f535
SHA1 16c9aa9105a2811ff86bc0bff86726f2390992ae
SHA512 6970611f7ff48a7c4e62e2de423b6ea33b88fb422ee93654d4a63a9ed09d80a84c3ab8ef7fc5abcbfc848057dc4ecca7d04b98159089f3cd0407921ff2d31b15
SSDEEP 12288:/8LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:/4f9n1i99k32tY5cz84
TLSH
T104452353F94882DAF21622BACCD6CDF4E97C1F0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 0dd91050a7157b5b30b94c25db19dc55684393825b1d7d62f81cf3276bcf710d
MD5 b8678cd23325bf13e5703c409222f8be
SHA1 78544fc3375c7bf944154a47652b4c68dad55860
SHA512 d6d45651e88bb27be0ce5340093cfd2cc94009aa9acf447524ac95cfc6596b37fcad810c5c066cad9c35d22260a98922d9df4d21c67e603223ac3bf4658032bb
SSDEEP 12288:6zLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:6vf9n1i99k32tY5cz84
TLSH
T14D452353F94882D9F21622BACCD5CDF4E97C5F0CF9E8A462E329664739FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 073e93aebaa77cfcd95d802ca01454e7fd588d9cf4df5f69a340dad7a18ca175
MD5 14c034d3d778eb9ea09c846a4c8b66fc
SHA1 e3fb906108069f78acc22d5ba66bafb9ed2d9547
SHA512 668681d87c7373c534fb65e12f0478572b3d4dd9cd6e46b89bb6e04a3ddea39870ca413e6d8cce1a6e741303bb8d685f4197e6d56801c37ba77df80dd3d87f46
SSDEEP 24576:1fwvUk9RX6wkyAIGf9n1i99k32tY5cz84:HMnYIGln1i99ZG5v4
TLSH
T16485CF29EBDC44E5E177923C89B3460AF6B178581B31C2CF025A53AE1E37EE46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f2e53f1c13f90e009a6f1da8f93307e369ca2998adaf0a15020d50d7f3ab2ae6
MD5 91e102ff4f3a8775ee6e105760b0f347
SHA1 7d89fefa7bf694f8858f4b410c211442bef44269
SHA512 3cbf5d92e831a4a17a3a66618c633028a89a922bee21dd2d1771b25ce9176ad7bfc8ac272affb6627b2993c26425a4ffdd0ccafd6c8b15568d8839036a37860d
SSDEEP 49152:uYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07ln1i99ZG5v4:dySzPBEHGt4
TLSH
T13F066C96A16841D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1c338f4e2a84ada30ca9a4cf4ce741786e3dcb5765cd24e4e59de21466f8c027
MD5 9325022feaed35623a8481d8e189b9f7
SHA1 b6eebaf478e6e8a1522c84fecbe584c804e6d966
SHA512 5b026ebaec7604d55c3018d3fc54f00dee6b72a06d1b8cddd5935555bdcda61fab72563296ee7fa8f393a46987ccaad34cb7473ae7c3ae83c91c9d65eb1a4569
SSDEEP 24576:W47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYtf9n1i99k32tY5cz84:W47JUQjTirIhCnDHUPfF/rln1i99ZG5
TLSH
T1DE65AE1EA3EC01E5E17A927889158A5AEA71782D1F31CACF1270837D2F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 23bfb6c9da6da4035508e2b8241631f23a2661f8e43c5b2a0c1d292f08544d90
MD5 bdafd4c2ba4cece7948d5956748ed41d
SHA1 4d2a01b2152b619052a1f0c70ea0322d452ea98f
SHA512 12cfa250bf0352ebf803bb38d391db5b825cfbfe5657a858bc25d34ebf329b6659f535ba0bb68bcebe3cd654d9ece5a0a8bd6c4ba6c3a39174a183041e903747
SSDEEP 12288:kbsfaLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:bif9n1i99k32tY5cz84
TLSH
T1A655F11AE25802D8D02E6279CB958A40F3373C1997E0D2CB53D0F57E2F79AA45DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7ff19bd95c47cdcbe32443a260e0972ec6a5c1fdf722059b9a274db1f917b6b8
MD5 ffba8a6fb1618a2f5829d76c267e12cd
SHA1 212fdce757ef58afa7d21a9b500ee9bf5f2c7b53
SHA512 f9af9de7e835b7f5c0a9d5a96206ad86a2b5dd806c6c43fddf56d365fe3cefe9ea78ab4ddadb8afd2e3f35e35d7d34be4439acdf3be3113f6c0be027c3094b71
SSDEEP 6144:vsBC2naW551j4aX5FKfotMxgMy59Pk6fXCQomOkWC+xfSyAQDXI1415riUjg41AG:QRNFJK9STQT1RbdAJpmi5aRwO6K8J
TLSH
T1883517107666CB4FC6AD40725E32D5CCA7707D41EE05AB0772C88B3FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a9477d5381dfbaeee8242295ceb59afe0bc02bc4eef6da29971169fd1a1bb772
MD5 384aaf86785188aff6db0bc540f15c27
SHA1 5c1e80481d61d104b4342cb70cbe95c607a653ba
SHA512 4c8b28dd14968df707be794f0dd68a7058217654ae2ec4c6382e848eaed2a61b00a4f49904a5c755650fc4e4cc96eb2419d372602e4d4e7b7f7d15f550d4e481
SSDEEP 6144:rKtRqW5vO5wOftOf3G95OW2DmWz/VFMI1SxPYKxtMxhG8ROV88ZOKCGjtJnSCh4J:vSdi0G7eyxnfQ
TLSH
T1AF65D7406536A38FD1F760B2072A5F4DAB64EC07B745AF2677CC443AD86AB15A0F83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b686e0cadbe533dc4d5067bba7932158347ce38190f958876cf16028420e4fa0
MD5 da3f89608a5d4327c5338450c647c95b
SHA1 30e423db72e668ca6dfa99c2f0df02fbc25b9785
SHA512 38ab384bd383b85f91624af699a66098a8d5d784b02aad58dcff9783ce09f2f40f2dc33a529074b752444c9ce2f5acbda0f784a9d5e1dcbe39e619fa6ddb6bae
SSDEEP 12288:2z7yLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46z:Uqf9n1i99k32tY5cz84S
TLSH
T17E452353F64C8599F53722B58CDACDB4A53C6F1CAF94A0D3E315268638BCDF86830A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c13ce20e07b4748fb13b5cccaa99ddc9f6c9b12a481df0258102bc76ba4c6da5
MD5 b1582b473ceec655a95474377b5e0a9d
SHA1 9544517c5feab5ad892e68ae38ec89e544376a03
SHA512 9f5498910156629a27a3491b97ca1e184eebdab25dd5d9f4e813454432b62227ba99b3b8aeb5e5146639d16b23006cb8ad076a5d89aac1403bd544c99a2f0c70
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bY8f9n1i99k32tY5cz84:2gb4mBIBhGFtln1i99ZG5v4
TLSH
T18665AE1E22EC02F5E0F6E2B8CDA64417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 48e60bbbc231122144dc3373e47b7c9ee758d3937496936032ac3d500926e622
MD5 983996bbce2932584ddfdd843325590d
SHA1 707c74be9a786ae5d248ddd778293cff3c3cfb9f
SHA512 2d4da4f685de39cf49f36da2311269c555b102922fd946eb5e528201e61b95e264cbb36df584a4708e8de68a7a504635e56ee007c74530d1045b6dd7b1683a97
SSDEEP 24576:pG88u8FpJqH1bzria7/m9f9n1i99k32tY5cz84:87ZFPqVea7/kln1i99ZG5v4
TLSH
T12685F165B7E001F5E477D13889864A63F6B1B8151364EBDF07A88B521F33AE40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e18bbddfaa8b91deae4f44ae06084774440784845b57d00a1118ffe7e9272d26
MD5 0ce1ebe849f6e19e70b0b50f5c75b82f
SHA1 72992961b8b4901869ce442a756eba30d5956030
SHA512 5f86c27d1a4bebcde519d7c600c6b40485278ed260eaa7c8d605c5b679c03debb439793634916648d0c1f094b8410ae756aa8489685ae3707c62289656e80f5b
SSDEEP 12288:fHvUrBFrEjwaQpLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:fPUr+NQJf9n1i99k32tY5cz84
TLSH
T17665E12F72AC18E5F636A17D89828619F77178661751E2CF02E0817E1E77EE87C39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fde5124be65a4ed1095a99a2c3fc6d5c65a7938138d84f8568baa1b1c22dd101
MD5 a24e967ed7cedfeb1c52476332ae7e77
SHA1 b6961ab3be27c864a111f92e150d37eb56170e7e
SHA512 ce543370eb01fec6f8bc32506fde9eda29cc479d8c0cf9205fb285e6ed4e3c442e66f83a0d0b712237ec3f04a5305ccc1a82710d19af93b050139c6d41cc4990
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZln1i99ZG5v4:kG05lO43b8EHGt4
TLSH
T17FD5CF6E62EC11F9D1BBD17CD9C68A0BEBB23815033456CB02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 51b2f9a114ab864b8c9d788ae562452059f5da363a3a5190a51d35dafafca714
MD5 781549d6e3c0efd9514bc395b1c11aa1
SHA1 9cef84acf1bc7b4ee1f0f1ef171a0f3e39bc8ef3
SHA512 dfcabbdff50bf85a62326d0d752edf3eb1ea9ed207e981bc93a9192e0cf01d70b79cea1dc26a31ce59f96f128dd2e06594e97292969cb359654ff0e8e95f987a
SSDEEP 24576:Gfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn7f9n1i99k32tY5cz84:ea5POZ3BJt2pasx2+mRln1i99ZG5v4
TLSH
T12E65BF5EA6FC01D5E179D17DC5838A1AF5B1342553319ACB022182BE3F2BEF89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 01030262ea72e4b3fcc35be85bc13dc7ae7492cc76dd12b747a32272f80f76e0
MD5 329560ff8c7f3bd4f782aa203ac2fa23
SHA1 1a5b279929fcb5daa4153645f94bee0bd1a25566
SHA512 76758a39ff270460574c0b36c69d6a22a2151df444cc9982e55e137386bc49f4fe59624f02099962c6d68e045456293745a2d7ff93e2aba20030ed9479220ae5
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkVf9n1i99k32tY5cz84:0Nc/zEOVHFEln1i99ZG5v4
TLSH
T1F5858C1623E901E4F1BBE1BE89779946FA717869573086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ab8147c499dbe65f96897c333b7c05a2d9766e42a58089336462c2e47ccd3b2f
MD5 28f04981a4d454a89df68a57a5e846f3
SHA1 efc12b271fbc08096d110d9a3776ffca8f95c587
SHA512 5ed49bc05fad1721860b41678fdfb5c2ea8ca49c5e9d2ab27a141c8804f2f9eee2c0a2ff2b088ca6e8098a3a9775a2707cd490d9ebaf1191feb91f968de7ed50
SSDEEP 24576:jTkNvNnaFeYhJNtmZBmvf9n1i99k32tY5cz84:jTMwBtOmvln1i99ZG5v4
TLSH
T17C55AF2EB6B846E4E1BEC6B4CD238512E6727461173293CB9390C13F1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cb023f68678e47dd12f4d933ea324fc48be5875e71cefa6339e2d215e55a0054
MD5 337e135d8d77d375db83b1c5fb28cf2b
SHA1 174f14f7165d52b4e425da9e9eddaf8cec777516
SHA512 4452b716b34f47de1cd0f43cbaa9a74dd9a784c81462757444853551ccb6a6eb508375bd4baa6944282199755aa1fee5eaf5a0db7db749f79fedbefc57a81f96
SSDEEP 12288:LQcMxWDXN1Dp/fshBItT1IQgAuLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5cz8:rD3FHshBIYQgA+f9n1i99k32tY5cz84
TLSH
T1CA75E17EE65C04E4E57BD1BCDAA38A06E77138AD032165DB029481B61F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/580-0-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/580-413-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/580-7-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/580-6-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/580-1-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/580-86-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/1540-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1540-49-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1540-45-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1540-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1540-39-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1884-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1884-135-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1884-133-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1884-127-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1884-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2232-472-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2232-282-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2232-474-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2232-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2232-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2232-94-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2356-297-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2356-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2356-309-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2356-100-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2356-106-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2356-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2456-82-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/2456-260-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2456-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2456-77-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/2504-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2504-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2504-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2504-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2504-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4576-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4576-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4576-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4576-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5484-66-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5484-224-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5484-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5484-72-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5796-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5796-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5796-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5796-189-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5868-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5868-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5868-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5868-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5868-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6024-120-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/6024-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6024-114-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/6024-303-0x0000000140000000-0x000000014027D000-memory.dmp

Download