aa0fe4fe63e6ef964c76dddc7fdc30614d66ba5ad8604496d7afd3ac0a641327

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 05:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.5MB
Sample260709-fwfbbacy3q
SHA256 aa0fe4fe63e6ef964c76dddc7fdc30614d66ba5ad8604496d7afd3ac0a641327
MD5 45797dc73c04b72ebe03df6197039a4d
SHA1 1240527964c72af35da5810220fd038fcf8baa8a
SHA512 8339b4b6bb6b8c51a9addc531733d265e27d490f12fda61b868fa565d682d60932bc9020ceea1bb24ff20812cefc6b6c47af84ee2c15e1035e4ceb5a96bcd96e
SSDEEP 24576:Qr0URPEJ0sg+9QqVkpSHeJFf9n1i99k32tY5cz84:QrxRP9sg+OqVks+JFln1i99ZG5v4
TLSH
T138756B0277F99169F1F37BB1EEB883645A77BC71AD39C50E6280215E09B4A40DA72733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3612	elevation_service.exe
5864	elevation_service.exe
1476	maintenanceservice.exe
5344	OSE.EXE
1712	PerceptionSimulationService.exe
476	perfhost.exe
4512	ReFsDedupSvc.exe
1300	SensorDataService.exe
2868	ssh-agent.exe
240	AgentService.exe
3784	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8c46ec31635dbbe1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113609\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a5e51ed610fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000861e2fed610fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a08585ac610fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d81ed0ac610fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdae6eac610fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d68baab610fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3612	elevation_service.exe
3612	elevation_service.exe
3612	elevation_service.exe
3612	elevation_service.exe
3612	elevation_service.exe
3612	elevation_service.exe
3612	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe
5864	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4948	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	240	AgentService.exe
Token: 33	3784	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeDebugPrivilege	3612	elevation_service.exe
Token: SeDebugPrivilege	5864	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4948	2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 5784	3784	SearchIndexer.exe	101
PID 3784 wrote to memory of 3060	3784	SearchIndexer.exe	102
PID 3784 wrote to memory of 5164	3784	SearchIndexer.exe	103
PID 3784 wrote to memory of 5856	3784	SearchIndexer.exe	104
PID 3784 wrote to memory of 4248	3784	SearchIndexer.exe	106
PID 3784 wrote to memory of 3388	3784	SearchIndexer.exe	107
PID 3784 wrote to memory of 5996	3784	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_45797dc73c04b72ebe03df6197039a4d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5864

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1476

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5344

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1712

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:476

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1300

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2868

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2699128254-3633964024-152949075-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2699128254-3633964024-152949075-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2772 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2772 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 02b69ecfba8fd8088c111b04571bb0f5dd02955f0e2a65416277e6ce90d1ad59
MD5 4ff1fe9cfd59db2c9d963bd000a33e62
SHA1 1b297045dcccd8a9663f083cbb340e34fe947e8c
SHA512 2e20ef3f0625648d4ecb136fc5f6e5d4523b75d70a621cf415bc415c7c42d8f04cf70f82272f572d605554fdec6687171667b96c4772206e6ee0f3379a59a222
SSDEEP 49152:Bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnvln1i99ZG5v4:H3q6sjBIEHGt4
TLSH
T183D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9f2d8671e4125baa405a8deea6cc5b93d5c3e533a6f69f187366112b553cf01f
MD5 67ef5bdda3eb3ab8b857e9d8dab9fd23
SHA1 95e65ad80d6da3844eef4633f206e9601d10c12b
SHA512 2cf472fa9c3174c0f899ba8debd34c3516149f85399a4e00f7cda2bb4e0d1146274882938962f78ec64986ab902975099d3e1d479061717cdf16d28ed475e397
SSDEEP 12288:Q1XLsswWkxy2lRq2czA2LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:GXYfDtczAWf9n1i99k32tY5cz84
TLSH
T102650129B3D408F9FD27827DCCA2C911EA32784547A0E78B03A499662F377D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 fcaa0e6e5f430b318dba31ac2eac2f86f55dddf6a1722bfffaac203e39d29802
MD5 1f71ef6c9f35a05cc804afaa6540c956
SHA1 69b0ee24591923f1a687cdc0d450852568cf6429
SHA512 f6ffc7dd684454f30b21a6c4056c1c650d6216c96a4b135889fe6e01914aa5253b9ca1c268a2e83e4d781d9bc121c101520c13d05bfe34063ccbde7c6f858497
SSDEEP 24576:80Le5ji0hmxxrMHf9n1i99k32tY5cz84:8Pji0AjYln1i99ZG5v4
TLSH
T134859E16F6748335D073C0B9C5D2A69EED7130865B308ACB4286D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c7ea502aedefbf98ce45386fe0973a4e6880ea736ab8df207192665187b67300
MD5 485e607f23ec35229fe1a7378080ed93
SHA1 6e30dae674a02c6b909f7b111fe599229cae12ca
SHA512 abce448088bd0a83af5f53b652b2bb7bc2925837b3bc9533e8e321afb25a388a31a7a4e0b6773ae9a293e135ac9cfc8841bd1835407741602279ad8f7b891556
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWn6q8wyu9f9n1i99k32tY5cz84:i/ezSC6vUzPveHjycln1i99ZG5v4
TLSH
T18B756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5f959b83dafcef307e6693e8f2a71405214e470165632ad28453adb90165a24c
MD5 475c939cf1b30d1a7442bff0ddaa9494
SHA1 617f4e363ca42079c753773092ab5b36db1afc25
SHA512 7c79f0111e17d03f268523e93ecadda1e4bda4a73c5efec2c1468d062cb62e8c6fc1181917a2456be7e1f43878b333776ae53dd33794fd32bcf55ca414e2580a
SSDEEP 24576:eVbqPb88hv/l+Yyf9n1i99k32tY5cz84:eVO88hXl+lln1i99ZG5v4
TLSH
T168559E66F5748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 925a9b4cf9dc8f3ac1d51ffe4e0b2db35be71507324115ff8a888e8120a72f3b
MD5 44cb104a6a0730b46b1e2cd1b49c0d52
SHA1 b02c642683a250aac486bee5f7f6e6dc748b45df
SHA512 778c7d36be18fe034d493afc33686d9bd7d63bff323619d377c4f83753c5e6be5b7b440d8f602b54c7a7262c8d1d51ccc020d7774e95b4fa7cb5324966d98481
SSDEEP 12288:oLvLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:oLDf9n1i99k32tY5cz84
TLSH
T15A452353F64891D9F72722BA9CD5DDF4AA7C5F0CACE8A812D3213A9738FCD78A050512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 77c16288c53f98a66bafc5b02f3edc5a86dc49ab2b259ff842d308767911da1b
MD5 313337d5a16d18cf3022252ebc5b0378
SHA1 1af5747ec9728ee8ecd0422311beadabfda1932b
SHA512 e546c0621d10d5582c1d1ce0e8afa7c48f2d4920c27556d9fba32d046b5e68cc1ca4456d4502eac2b5829d879aa16afb5e47f94e4565ed1d56abfd8306d55bd7
SSDEEP 12288:3eBNUbTVO86UyLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:3JIUqf9n1i99k32tY5cz84
TLSH
T1F365CF3BEE28FCD2C23A9DB95A91C640E77278304F61A3CBD165830E9E275E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ed9626d8983523e8006ffb85b45fe0db892f85cea76301459dc1651ef8827976
MD5 a7496ff16f0301c0a224dd0cda4f6894
SHA1 ac80e438609601576d79df7cdb0aca21febaf778
SHA512 6227cd7e8f05c737b0c03c029395be75494f1106aba428075071fba7aa277dc9c7441bd717d089be0be5eebf7aac6ffb8a9e31d057812d2ca3b6cf7b0f392bc7
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH/:XQvGAdlCEL8c/DRNw5CbEHGt4
TLSH
T155267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c4560b6df55708bd23c9b041de404314a07d0df9b8c1698627239343b54a88a6
MD5 dd9c918120787b846acf52cc533280ae
SHA1 a6a61988edc554042949994a31a4c23f44a9bdd8
SHA512 3f43b22f5236f166a8d85369f737dd6b6912cf0dba228867d94ed6769c237c4b2b717f49f370517a713a61ddcb00aad2bab7e9b174106ed521d83296e4d131ec
SSDEEP 12288:tAwSfxL/2Dc3RDLLmt0LDQewsAjMLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5/:e0ewsAjof9n1i99k32tY5cz84
TLSH
T1B775E031FE74E036D37B0DB61B66C716583C7A204FA129C3E3A84E9E19746D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 606b07d64cc43eb4ddd14b3368dc0b5c5652d8b5df05481d3244370843b52920
MD5 bc1f709a4d6b6f8a9b3afb8cd9aa31aa
SHA1 59edb6f56498e8ba7ed65dfb277416e38064b874
SHA512 76c13208eeaff9125868b869060f8e4609f49711b74aa9a4d3c0ca0e24a2b3ac46b9960f606e31693a65b10470a6c3be1fe7d01f65446817ac46ec398a4ab5c2
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHW0N:XUEtQevvqc2W1cpV2tI32
TLSH
T151474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f336c82a17f140dff7d859ccb52e619a6499221b565b947000ba28c3b426ecac
MD5 7f4142be9623be2eb4285f825d404efb
SHA1 6abff82f30386d436d35352d8cc9f8277d1e67d4
SHA512 80d6c9139e3d842abe8c7356a800b5227678a817f24d63dacf2827077a44b995f5d72f360cb94d1340503e5222a909f4cd46ceec8629da92d3ba281dec7cac02
SSDEEP 49152:DCbRquA/m2yL5zifFiV+XenmE3/zIln1i99ZG5v4:8oqHVjnmHEHGt4
TLSH
T1E6D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ae599105aac105c8275de1e73399b1ccbf8e3e9718f9e52dc94c99a44e3980fe
MD5 42eccb3f568dad6384364ddbf9bf3642
SHA1 c490108d70179ab1843543829b25aff7224cf61e
SHA512 7cd802c791218a315822ba25d64639ce4f16a7aceb681ac3f10a3c43c69d81993780a3392487c3fef3846ce1035603662d0b28bb3303b75e8b81c44cc3c4ab54
SSDEEP 24576:gAhGL3IFoiwtA5l7S53Rf9n1i99k32tY5cz84:gAMUFoiq5Bln1i99ZG5v4
TLSH
T1DB359D81E7F945D4F5B3AAB899B68570EA76BCA95E30C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 9e646eb02711e4cd6c43e47d46845673f6ac3fe47f6046519fdc56446cb1a83e
MD5 7f0d33c0d5accd615251504bb52af0a5
SHA1 1b28efdfa0cedfe82798d028b5298759fe8891c5
SHA512 b7dafa8ee957b8af25eec7b296fc8586908c215b16e0c08b67a8192abcc53b3056c468b261f421d6961f8e85c5e98fb13d27eb6688f03d06c0ad9ef611243fff
SSDEEP 12288:Kmw5HEjsChNVBFgl0WDm+CVLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcL2:Dwu4OW8f9n1i99k32tY5cz84
TLSH
T12065F14676A80CF9F9675239C997C536F7B2BC052A64DB1F4360C65B2F37320AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e852bed5e70438b50b8db98c22915a98370ed14906576d15aca164a24641c9a7
MD5 27c29ff32db37c2f7dfa053fa12a1588
SHA1 5105d0682d492ca0bb96af879e49cdff109a6b03
SHA512 2cff11a9bfea930faac43b73bd65810ebdd4efc60a46f12a01fa753af29f69d2c6071ff7979adaa3a9e5c2fc8e4f707d2e8d57a6e495d75aa6358929c2d4af74
SSDEEP 12288:OeZ1Iy8LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:TZu/f9n1i99k32tY5cz84
TLSH
T166551257339860F9F223527DCCE18A54E775781967B493CF5320469A2FBAEE42C38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 99504a427073c86264ed4dc8fc7229241ca14a6cb9235705d077fe58b8cabeab
MD5 2eb276a9743467d817369a026105e64d
SHA1 83b4fac0560a24bb07054560b7a60d9595b611d1
SHA512 ab0a2de1485015e8af0b79cee8ce222c6d46f09560b9ab31885c7915666b3b4c385786f81ee88af9dfc425c8d79092ebcdba369340c0c88c308fdfa9fe926e9e
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ub:ZQRQyi36YOcPbLvw2gAf+PN3cEHGt4
TLSH
T10F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 aa4b23f228a61caddc86a7a61ab4c9b339a14d2ef6848ed61ff09f9c12c61a43
MD5 cbe646afa85dd6fd4e6bbde14a7da5ba
SHA1 d1191945ebc593b20dceac487192af87c808f0de
SHA512 3fac65729b0677b275a7c187dc6753249a47d51021899efa80162a56c8e8efcf4fda161f80d134724835469128e0f8ea2c505735206b34d8e3aaa8267d0b8247
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ub:bQRQyi36YOcPbLvw2gAf+PN3cEHGt4
TLSH
T114667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 571356857b6e2c55dee55dc23e092c345e10c1728f13d189afe62fdc00f3f34f
MD5 55a188f7c9b87f9d140137578d4f2e9d
SHA1 50a909e5964e14ebd65d4a32d87fe649bd8d7336
SHA512 9ab8de884b7c14f55de0c4df252ff8f8507ea64728f2e09695fdbae1cc21f1660f9f64a6303c60971b82c561a982794e1f155c7a972388b642a1e8cbd2b18b66
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0vf9n1i99k32tY5:N68Qg55nhceWu7PNU3/Yln1i99ZG5v4
TLSH
T120B54933B2F600A9D44DE1769F4A873196E17C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 968619387d54246a3553fe7497bcb5a9ef868e56ab563ecaf4d8f2e7cc8d93b7
MD5 1fc5a415337db24810dbf04192ff7e09
SHA1 682f616434e69d16ad5e1fcc55bb8da7c882261d
SHA512 dcb7cfcbe4949b1ba0631d0312f683fffbda94d029cf8c93bd2e681f2a4f669f238d6c2faac9d3db1e19d5919f623e145813755a2f89b68d84c375522cd8f77e
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99V:jy5112gYy5azzVvt69nLKnhZxEHGt4
TLSH
T123167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7e7ca12f23ff86af161b7c3ea62bd76c9b2707a026f899ec2a1d4f6c62a83876
MD5 013e69b009ec860373dfd9df6b4aedc2
SHA1 7c6958ac6c69d5dcd8e771b9ea41b0478386aa55
SHA512 7667bade81bd93973e36cdd9aed49ed94a3e83d41efc6aa33b6560c383e8ef4c177b57a6063b85bfd15ddf19dcade234f1499d0d6f4c3beb05a32509bc983305
SSDEEP 49152:2B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glGln1i99ZG5v4:Eu6Jmdxd2dUEHGt4
TLSH
T148D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4f01eeb1d1eb1be34de21464e3a8e24759a2a2d8d528f485c866db1b62bb2119
MD5 2cb9fc9b0d9ef7f99dec8ee868c46f97
SHA1 a3f19a10ada50ae65c97c1eced949dceac7d8968
SHA512 7eafe20fd6be49fb6cc453fbf1120067e7960cb7c76cc289c9566c1ad98cf5b6f80d6d0c98602e920ac9f09d83206a5aea5fbfc54c5f2189220bf3192c3e9a26
SSDEEP 49152:K1hpsNoJpF1A63U44CwH7R4xKln1i99ZG5v4:KmifPWRHEHGt4
TLSH
T111B5BE13F29801E8D05ED17887569632EA72BC450B34B6DF0A90B7962F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 31157ac5eae7aa9dc24ef903575a7be28f7938ab848966af1f077b8de8f99921
MD5 354ed5fba303ba1c5b52ba282e9045fa
SHA1 19f309177074fa5864546bb211d76df6ce91cd8d
SHA512 4df105b1b75326b9401077dc2d76dc4af10f0b05ea8b9a29b42ce6d01c00a522d577a667c43002cd4e58dd7b145af354c1809b6a565f4f0d93ffd3c7234571af
SSDEEP 49152:HSuZQIY0Be2KcRVtOnks6NMHq/ln1i99ZG5v4:d5dKii61lEHGt4
TLSH
T12BC5BF03F2E940E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9b73b48fb25fea1798054aa6943b49d1b907fae4f58153300e4f1d8efd9d80c4
MD5 339813ae9fa7c7ff8d74bfe85234ad8e
SHA1 93646985976051db8a8a2438c31d56a85082cb70
SHA512 0493cbfd6a5b8d6c8d9648fd8381318b3e1ec03412102229372f737ac8183344a1af98d87bdc72c079b5c7128dc9c400c5aa4023d8a0c5cb42d9fce512bd0a4d
SSDEEP 49152:XhtSn8EApI0fig3giDn0AP5wWln1i99ZG5v4:GX2imphDEHGt4
TLSH
T19C95BE13F2D901E8D05ED178C7468632EA62BC150B38BAEF0A90B7561E7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4a25efcd05b1ef36a6a3b0f129286ab92179a1edaf42619c261c3e36b647a4eb
MD5 b775a97640acf5ac5c643966f08caa4e
SHA1 69200563301db78285dfe39523b2d1a63ac250c1
SHA512 8940f2fa21f4d9ef1316f02faada0ece677fba7e98279a7d8936f5e4ed50853d1951baa4420518a5f92cb20e71da057b3b7fe0b999b3b39b8365c0405cd29459
SSDEEP 12288:MXLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Mbf9n1i99k32tY5cz84
TLSH
T1E0452353F94886DAF21722BACCD5CDE8E97C5F0CF9E86452E329265339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 745264abf7561c833c5f4bc08f42b4ae9b97eb18e22d3517f416e1d91303335a
MD5 fdd560f6812552a1ef4f36276b8497c1
SHA1 d875ba0fe33918e4d590463040a3a9cbcf6d1ddf
SHA512 9beac27a7602aad9e59659d08cc2e6b415215f1ab2c65a0ed0634bdb98a90a4155cc766f34c05e11bf91618dbc312740814279f40caf66d15f5c1876de85ce60
SSDEEP 12288:NwLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:NEf9n1i99k32tY5cz84
TLSH
T18C452353F94886DAF21722BA8CD5CDE8E97C5F0DFDE8A452E329254339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 367fe78b39120802a31e4fe39eca26368efafbdb73728bf072055b994e3893ac
MD5 a3c1b0720ae90876fb24119e394bacb5
SHA1 5e723aec15229f51ddc592d2d3589564441464c2
SHA512 1af3541c7df811a53a837bef7db7e54e6a68468d3a9cffccb787849ba9c4cf0fd73252b61b8afc8454fa21f004ef21c798d9b4eca6449650fccfdb16ae5ff886
SSDEEP 12288:6aLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:6if9n1i99k32tY5cz84
TLSH
T1EC452353F94886DAF21722BA8CD6CDE4E97C5F0DFDE8A452E329254339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 7e387802514d0905f864cf0bf9c901ee98391c32319584f47108cb9f39098cd5
MD5 8a2cbf42a1c44460567eda46fcb2ad88
SHA1 ad7bfa547065ddef29e52444d5055a2868d9d1ee
SHA512 0f3eb1c8e47465257b727d80b918d11fe6ca358843ae4606dd5fb77a886f6109d93b92db033c239abd547dc58a4160bb47f01c7dbefc8789c7ec6f756a04e7d9
SSDEEP 12288:iVhLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:sf9n1i99k32tY5cz84
TLSH
T1E9452353B65841D9F523A2B9CCE2C9A4E6787E4CEAB4A59BD31015473DFCFB82430B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 56c84e7813b8d0b3acd2ca7e4bbf1afba378f97a9a7d1795c61c4bb889e955ed
MD5 dcd02c81161c43de81e18646e48e59c5
SHA1 feaf160f340a572533dc5d663daf3401db2be6bf
SHA512 e7e5b072cf277bc5a61e62af024923f0b40f40a833867000fb8744443ad874a734c5fd1ed712b7d590da42980f0c02a21c4e89783867abd3d3f674660e95526f
SSDEEP 12288:N5LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:N5f9n1i99k32tY5cz84
TLSH
T18A452353F94882DAF21722BACCD6CDE4E97C5F0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 68d7300fb33e4f518eff40efe780648f60fe84c7ae0d38a2508bf0e45bd6fa96
MD5 bef9b5b7af0452c21217decddb9ae15a
SHA1 04a34f8ddecbf234a89977157afb55f7f7bf2ef5
SHA512 874ae027b0ce4becfbc50d795953b78363b07c430fb7a7be5a74486a7e45863bd6bf0c1842d1fae12f4251bfdcbd793d76468e508d309cb279663d14ad634c78
SSDEEP 12288:5ULfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:5gf9n1i99k32tY5cz84
TLSH
T1B1452353F94886DAF21722BA8CD5CDE8E97C5F0DFDE8A452E329254339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 31c5d5c777b0ed53cf747c6937bf337168b429bb94d9cdb5ceb0a172b3336f52
MD5 66efcd53552c7ce151157e474a41db42
SHA1 168f22373ffccef2d0789e304954639eb3469bb6
SHA512 2eb73a608a9943f1a865d273c74d4b484c43c17cd2ddfb4113e93e73f2961b3861cf64ea422523022e5c52055364b47684fb3c45c741db18dd43af33c3eeef3a
SSDEEP 12288:GILfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Gsf9n1i99k32tY5cz84
TLSH
T10D452353F94886DAF21722BA8CD5CDF8E97C5F0CF9E8A452E329654339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 95b4fdd230e4724124204ae5dcc2db4670820e9ff4632daddeac7b56df8f4836
MD5 e85ea369dced53acabb102d37391372a
SHA1 749df7811299af4f2f6731ea827f930d75898e2d
SHA512 be3ce19f0b14cb60d841597325f7f348154e5747c8bac133304db8b6af6d56cef1c3468fcca13df5e0a8d7d6b63cbcdb8a6a571d7847ef6829c8e8510d184db5
SSDEEP 12288:UiZwbVzzFEoS2cPvyQLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:3ZMRzFVSOkf9n1i99k32tY5cz84
TLSH
T1A9650196B39018F8EC27823ECC658D56D6B27C194BB0C61F03A436672F777A01C2DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c863c7150193cd0c6e18ee680e911e31db9fade158a25367080b1b47e8bff231
MD5 4a06f766e096e052d38243e7be4642ae
SHA1 fcfd9651edb97ba158233326e935db6a1c844336
SHA512 b68dd9c2ef8edb16b4ff21d7adae2650ce3b2e519c9c8c3c49558b3cd1dd5ba2c457b7b1963c8b0edeaca85e98f40fe9a0bcab7b4f73b7d33edf1e165ad4823d
SSDEEP 12288:nTLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:nPf9n1i99k32tY5cz84
TLSH
T193452353F94882D9F21722BACCD5CDE8E97C5F0DF9E8A452E329264739FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fc8364bd0592c1501e2c7719a22087f9c754b70fb9f7f8493516a774e47d13cb
MD5 e9a654d449eb54a5a9650aad185eae7d
SHA1 ad30e916c822a70ca3f6bf04980dc583cecebb2d
SHA512 1a57e6aca9658068ddf790ef304f418412ef84772b79873d692cc813c1971a1eae0ad52b8144edb77b37a30a379a0eb2704c4550fac8ffbe3addb02627ff5072
SSDEEP 12288:HfLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:HTf9n1i99k32tY5cz84
TLSH
T197452353F94886D9F21722BA8CD5CDF8E97C5F0DF9E8A452E329264339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 8b47d2637f1e9d35c0661634f8b4b037ba701965becf15f475fb1c147268b6f0
MD5 d044a09addd6e48418ff5f62bc08674a
SHA1 6c45bd0ffc9a563ce82b621baab0fadffdeb5765
SHA512 c45dfdf19d23dc521eff334b29ecf48ad736344fa15a2b1b7dec5acb819a4ddcc31533da4e63379af04ec460fcc6ea29a86e7de8a79729457ee86b5bf6e4398e
SSDEEP 12288:SyPz5L88LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Pzy4f9n1i99k32tY5cz84
TLSH
T193551207B3A430F9E1279239CCA24E51F77578355B609AAF536007773E7BAA06D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9ba89e636cee3c5696ea8d1b809547efcd1ee89d3ce6a69d4d5b743add854ade
MD5 d0783595a7d930778fabe552de5bb06e
SHA1 65e7d066746c38c9e00a4d93a9b6bfd3336f251d
SHA512 946f8f223978204575db2e3e82d4170e2fba15c4f1d78a18e3dfb8e2b8e4ef134ae2554f4ac32e93a1761c4053c57ffb0f25d7c65eddd1118240ddee0f457d55
SSDEEP 12288:QTLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:QPf9n1i99k32tY5cz84
TLSH
T18A452353F94882D9F21722BACCD5CDF8E97C5F0DF9E8A452E329264639FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 62059da265c9b2b313023f927ec56246b593184725b9f44db9032329e5815e93
MD5 8c18263c856d463cbf7b413914a84efd
SHA1 8c5d77e047cdbb3ba2159de36e27b54f966dc6ba
SHA512 628093251bc19c451a40d022d324dba9663a41d4010dc19c47cddc9368a30a06bc77466bfef960b70f8aee8a7a595a2896259e8746a3854fa013fb64b6bcb10a
SSDEEP 12288:8TLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:8Pf9n1i99k32tY5cz84
TLSH
T1C6452353F94882D9F21722BA8CD5CDF8E97C5F0DF9E8A452E329264739FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4d860770cd66e60151783d5ad213b93ee5241770b9bb1119f0c3d4ed5fc2a2e1
MD5 b3c5a28d4bbaf99c3940f86f04b7be0b
SHA1 601dd170d95f4261d115b930cd7d5fc9c2044e14
SHA512 502268caca8e8747a7c61fb8af26e381f116c7f56a6b5cf45c9f8bce413ffba9d776b13225b08b92419bfae195c0e5047c99b09b3359abb25bcfc79100ba6189
SSDEEP 12288:WyPz5L88LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:rzy4f9n1i99k32tY5cz84
TLSH
T1E9551207B3A430F9E1279239CCA24E51F77578355B609AAF536007773E7BAA06D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 53df5b88dc8de87812e395d378c316df40dc51ccdf318da6015d1f60506aa501
MD5 763f38130ece92db985c21634ed3bea4
SHA1 1316ddec3103413e3990fb38d4f9a66ff7861b2f
SHA512 dbac87ace889328f5c403992e72e80012c37f84f53b71ea18f3ae9ea19e6cab74f23b2b09e1b01ca0b39e0377951e4fa42366cae4ff5b3a573b41ce28003ca58
SSDEEP 12288:LCd9CWYoaLHF3z0z04PDvhqLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcL2:mTDaLl3z0zDSf9n1i99k32tY5cz84
TLSH
T1E46501A5B35018F8EC27827ECC658956D6B27C1A4BB0C61F03A436672F777A01C3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 60f4568df6234b24bf97847ea8e543cd3df0d965e0a89ec3be622517dee01909
MD5 e88bbd2240864ac5187836d1c081b93f
SHA1 7493fdefef0080f84b3ca18e7e874cdd4ea979a6
SHA512 6ff9181b3a4068fec540810f186d725eb3a838215d5a58a03d29fe44be53c8f3d307cdb71aad809b0149ff5dc402f3ffcc5bc58d12a8d1ea1ee34814bd0505d5
SSDEEP 12288:9i4e7KRdTfgwCHKy7GLbbdIvtLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKJ:93vd9CHKy7GZOf9n1i99k32tY5cz84
TLSH
T1BF75CF91F3E410E8F1779A35CC768511DAB67C595B70DA8F03A4265A1F33AE18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7fac4705f940f4bf972c9d266f8438cffd9b5336e11f74d8df09735db630a4c0
MD5 9ae53acfcd4ab1ccd4144b7b35b1c361
SHA1 01c1c82d0ba961f7fb0a64edecc7d67022715f0f
SHA512 966fa841534e693676235506ed9da3d856a24dfe3c99e21b9bfaa637a8842a29a5c5a1d946bd4b00db524c911b8f01435ad2a0dd5fd9028e46496cbe4446401f
SSDEEP 12288:k6LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:kCf9n1i99k32tY5cz84
TLSH
T147452353F94882DAF21722BACCD6CDE4E97C5E0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 801dd4e14d0b86b4d18c36327c539bbbb359f72af4c57e7aa9db44240b6500b6
MD5 68bf51b83d0198195cd17f14cf8078fa
SHA1 07278da735b5451253042fa986b83e2610995393
SHA512 1b872b60cf21c965652c892f2720e417073e5929932fb3680770f33b616bd9c144c258249caac926cc3e1660d1d3c9f0d979516861d723e8aa7902d703042eda
SSDEEP 12288:OcLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:OYf9n1i99k32tY5cz84
TLSH
T115452353F94882DAF21722FA8CD6CDE4EA7C5F0CF9E8A452E365255339FCD782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 90868f8b43bd1985df19c7956646741080c95eae564923c5fbfe514f6542eb67
MD5 e1a8f2c58b3950d351c4397621412544
SHA1 487bbc7a6c096e39bcd4dbbba4e4643742d20e08
SHA512 ecbb4b2cce3785c8de87f2dce0fdc456e97a8cecfee8da860c17c7f78520f1a8c5cad65bca8689f6e4c0ecbd890ce9377b773a7bed6b6239013cf2308450d5d5
SSDEEP 12288:itLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:iFf9n1i99k32tY5cz84
TLSH
T16A452353F94882D9F21722BACCD5CDF8E97C5F0DF9E8A452E329264639FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fe836e7d6feed93d448c296eabf3e9fa13305dcc53fedd627c8999a3865bff26
MD5 fb05c7e197b8d2789fc86b5e9700ce24
SHA1 f0667e41aeed15c492e04eef47af94bb207e0b32
SHA512 26526ed5c7e3eba0f324926927c8e98f2108a32b84fb5c3ae702dd7a4229b4131297233ee5812bc35ed1a15822d4d1f036dd66c74d151ece514686b79108a616
SSDEEP 12288:RTLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:RPf9n1i99k32tY5cz84
TLSH
T100452353F94882D9F21722BA8CD5CDF8E97C5F0DFDE8A452E329264639FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 57c016901163b90ab1adc4a65d4991a49c5a4d9a78643a1d49a1cbd755934d7c
MD5 513b0c76d14efccffeff4926ed20b7f3
SHA1 5b3a96f3f4a4477dee8f58fe0331b0f39fa74316
SHA512 034cae4c5258563d6d2d5f7f2c0718613b0e96c2b35f0671e449881fab98619bf909d8b06ecd4d2fc17c03458191a6028a34bfe5a7b7732380dd383d38be2da5
SSDEEP 12288:96LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:9Cf9n1i99k32tY5cz84
TLSH
T14B452353F94882DAF21722BA8CD6CDE4E97C5F0DFDE8A452E329255339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e8f1efc853ba65aec6b633279016e29ad1e295d05615e1ccf9275e0e154fef5f
MD5 4ad27f781651caf314e769a2993abde1
SHA1 81efeacc2095c6a114eba044692d4cfadfa51e97
SHA512 e541a2089e6b0d0c0815c5ce7cc6840d682a101469ac4b3cfefec141bab9f2a219037b595089c3910cc6a81724f6bbfabe4b679706053c4979089e2c112d31d5
SSDEEP 12288:gLLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:g3f9n1i99k32tY5cz84
TLSH
T1A1452353F94886D9F21722BA8CD6CDF4E97C5F0CF9E8A452E329264739FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 dd894c4ad82fb53e50036f5b2788dcdc430346e510c1951eee1c0d00140ec520
MD5 97d21ae88b9dd30df2dad31a19d3b3bc
SHA1 15895a9b8c0c9bc98bd1f957d75782f027342e13
SHA512 09cb4a85b2b3387280323ca3affd175dcce13c4de7c97bcd02d09acf94a2bfb1cdf9281223aa2a2233b7f0afa3c281652006ca486b02323bd978d0cc01513cc6
SSDEEP 12288:R5LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:R5f9n1i99k32tY5cz84
TLSH
T1B6452353F94882DAF21722BA8CD6CDE4E97C5F0DFDE8A452E329254239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 b0792e18fac973f8ee2def878ba036a98e5fb16d2d646566d54db7b05d4a24ad
MD5 1549c3df05d157cbd35bd928e68dba9c
SHA1 ad5ddedd2a48c7aff44bef604a7df367e9e6c677
SHA512 5fd68239630096ba0b4b751a51e271b1fb59c1bff54bc34ce0a9d00579343c7ec9997f06d4947cd55f84b4ff9f61608b50a26efb61e38627f152835266d72f22
SSDEEP 12288:ciLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:c6f9n1i99k32tY5cz84
TLSH
T1C6452353F94886D9F21722BA8CD5CDF4E97C5F0CF9E8A452E32A264739FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f9ee2fbf6fa5a63365a9c0601da9378b7fbb75e4e778da9fe799fc2ef95ecc50
MD5 9627934b849c454560841e3d5737e1b0
SHA1 f0600a567abc8dddc03c75a639a5bffb3c2511ca
SHA512 b0fc8115ca8afb4a73d92bf92ede070648d19ac25c326a8a02f8f0562fdd64b37853fee1928e65575b50dea6a0b99c911ebc8932a79d088704d97f44aa92e844
SSDEEP 24576:lfwvUk9RX6wkyAIjf9n1i99k32tY5cz84:XMnYIjln1i99ZG5v4
TLSH
T16B85CF29EBDC44E5E177923C89B7460AF6B178581B31C2CF025A53AE1E37EE46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f6df8a40a615baf9d91666bf1f8b6e0af160637107572342114953d12c7253ab
MD5 24bbb91b6ba5fc923afb6a425d53dcb8
SHA1 99f602bf0581cc8782fee0ab067705474b65684a
SHA512 d6bfc1eb1b273f8f9b55f27657f33560206e1d7af8607094f232552d371ba889d38b16e1a3cb195468aa667505d5ca5dfb9efb62d9d6ddbb5d0a5124d794d2ba
SSDEEP 49152:BYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02ln1i99ZG5v4:MySzP8EHGt4
TLSH
T199066C96A16841D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2278aa50fea8220203965bb9c1aaa178d61625ac0aa17271440df1ea6eca6bad
MD5 8eedc8934142c05b9e7d8f06fe1eefb2
SHA1 fb5aebe802c9ae4150aa56856054792f9d65ebd7
SHA512 0651ddcf05df346555bab62038998d0909bd829967e4bf8e6005896e522a854010ccc51a7a98035ce9a751d4b52aacbdc472178829c76bbfdcecc61c6c390a9c
SSDEEP 24576:e47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY0f9n1i99k32tY5cz84:e47JUQjTirIhCnDHUPfF/Gln1i99ZG5
TLSH
T1A965AE1EA3EC01E5E17A927889158A5AEA71782D1F31CACF1270837D2F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c101d4accdf6ad2d478818c54ee71d8769f932ddbc98756681bcaf686d678b5f
MD5 2180e93b633623c4a76e772b8fe8e2de
SHA1 7b062776d6e5f7606985a22202144bb28b5b23a6
SHA512 0483d3a0f727da8ee3c061221ef5db81cc58999362f72dbf03f6a723f537627e9b5705af3c92327f946d9751b7258223042874a0f76133bd1f3c0286c3b6d4c0
SSDEEP 12288:RbsfjLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:s/f9n1i99k32tY5cz84
TLSH
T1F355F11AE25802D8D02E6279CB958A40F7377C1897E0D3CB53D0F57E2F79AA45CE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 b896ac1861b78b13f649756a8395063bf2424dde498c984e64838fa69eaa871c
MD5 73118eaa7ac94a13faf97d867b1e9405
SHA1 d18f54904a432d476fc83d2bf2ded50115a30263
SHA512 b695dcc3cd57652b68cac4c426446850c5f24a2ac727450b2050f54898e3bf5dbcbb7a98f50cb09d24e379b52a7fb62cf5eee1b3726f4a7db2f6cedbb92a04d9
SSDEEP 6144:AsBC2nacSC2c61uaqotMxyKmc5yHAZdbDtO2GhbDtd0OIZFnjJhw1RmIXa4hxkbl:RquhfZNrArHp/mcpxSO4knV
TLSH
T17C251611766AC75FC6AD40721E77C1CCAB707D41EE45AB0372C88B3FC576658BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 4c4e42cfe02aab1931bb63065be1eb374fa7d1c3fa73372fde8a99edef719be4
MD5 779b56202ef929931fba8d5674729c60
SHA1 d8cc763d3a55d1b34ccb8815366b2750571ef4a7
SHA512 aaa529064b6426a792891af82308aab56e2bf527d11485cd4630e5af5f24082f4e6b3feae364430505d883889e2e837a7b26216a37a9937f0585aab870558b41
SSDEEP 6144:DwcSCpSC4LCF4oHLCjncq3fm7I4adIH95i7K5hbDtd04p7Zt93IZtMxyKFiqRP61:Mvoqnc6Y95ikZt3iqRPvg2zFzw
TLSH
T11565C7416437A38FD1FB20B1072A5B4DA774EC07B745AF266388053ED82BB56B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d2bfd46a8bf2dcbd15bfbedfa10b0d1e6edaa7645617c120fb02caa24354f0b0
MD5 34091a5c4ce5ac4bd905e033859c2784
SHA1 ba61a03f4a860accca4d20ead47c798a20c047bb
SHA512 ef9bdb7f254968a3169d1a8982b95693ae6ed753e63a5f9b1474af81ef05c0c35f14e156e735e459a02690fa28cc2970e384d58330ac333508e042489fbdcb2a
SSDEEP 12288:gz7bLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:+nf9n1i99k32tY5cz84
TLSH
T172452353F64C8599F13722B58CDACDB4A53C6F1CAF94A4D3E315268638BCDF86830A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 99a673244c70acc9569c01b0705ddf678ed3df82550613ebd9977f5073cea986
MD5 e924b65d0c5c46594e0660f523f47646
SHA1 8d42132fa8c31ca3ee650e56a88fe23e56702ce0
SHA512 c1c23f3c72fb4104843b4817fae17b67ab0902eb3202baca3d629c1037e940eee786e81637df3e5df3ddfefeabe9bcd306cffa227c741afa8a2bd07c407a0516
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bY9f9n1i99k32tY5cz84:tgb4mBIBhGF0ln1i99ZG5v4
TLSH
T13165AE1E22EC02F5E0F6E2B8CDA64417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 af0d29f2ea6e9e1f0a10f7c3acf2c538bb45c5b64f787235858c9765997718b8
MD5 cc598d8c878d59ad9f7c5188ecddd2f6
SHA1 cca801607edb994385225dfbabd377e048ed69b5
SHA512 8120b91fc456de014476cda6564d3b5b7101dd93fe272db8abc2bebdb072150ac8fce4d6508de529c765997209ba1a69007b398755948bc5f6119a7b8f17d870
SSDEEP 24576:8G88u8FpJqH1bzria7/mkf9n1i99k32tY5cz84:/7ZFPqVea7/lln1i99ZG5v4
TLSH
T1F285F165B7E001F5E477D13889864A63F6B1B8151364EBDF07A88B521F33AE40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bfad8c668cdec08ceb9b56a4c326c501c60c2e7a111340a10d250e24606137c7
MD5 ec036966e0bdc470c0b2bbf658158744
SHA1 521b38f55c6fbe65076e522ca336b68c47b124bd
SHA512 285462d1d36264957ff9501ab1abb32492f975f6c197719f2cde865c6589f087c8158592ad3d099ac93de46839bdd31690fa32b37ef121966b2374b771c78c96
SSDEEP 12288:QHvUrBFrEjwaQELfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:QPUr+NQwf9n1i99k32tY5cz84
TLSH
T10565E12F72AC18E5F636A17D89828619F77178661751D2CF02A0817E1E77EE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2817483b33542af2c4d8d5820b9eb580d3940c306ed8451d588151317c8cb8b0
MD5 23394dfe8eefb9f3b770e0b6bacfe7f9
SHA1 4ccdf28e0c9d0e375834a853bb566d733cea4c28
SHA512 8f75c9b2511865c872d3132073ae89b81a28380d22cb6259d46edef9fdce2edd69be5b5b5857861424419fe32a5a042149c95fb7cf2c9849295d3eef3c8d341e
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgln1i99ZG5v4:yG05lO43b5EHGt4
TLSH
T129D5CF6E62EC11F9D1BBD17CD9C68A0BEBB23815033456CB02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 de2919ccbe093da687626ab704634f84289c443ec10f7f175265856e11c92bcc
MD5 0bf4bc8e315c915871671d52477ab734
SHA1 538d3566da1b15f1c1785060d3ff5c819d5fa1ee
SHA512 d0d5b39de7ea3c8e8a0e74d8b83c6737e41078b509728ce25e6acdc1d0d31cdec84e10cec69eb894ccd22d3281077f58cc438c6f9176ab747cfa089b23b0b19d
SSDEEP 24576:Pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn2f9n1i99k32tY5cz84:3a5POZ3BJt2pasx2+mYln1i99ZG5v4
TLSH
T1AB65BF5EA6FC01D5E179D17DC5838A1AF5B1342553319ACB022182BE3F2BEF89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cb6b66df6f0e1c44f2e1c0df1ca4c9e814a4a7ad48aa60e61e57dba7fbc87b6b
MD5 d1e0b3550b0fadc39ad356a4d04acd21
SHA1 77ec747fb901a677d81513c941d6eae866fb77b8
SHA512 5f4e90f5688354756ceab6720a7ffff3b1639b360a0bce9655fa5b74e4e3bf463c0a20607c5b7bfdddb0104e7229175773299be9623533bcbcf45e99839bb774
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7Fkcf9n1i99k32tY5cz84:+Nc/zEOVHFFln1i99ZG5v4
TLSH
T1CB858C1623E901E4F1BBE1BE89779946FA717869573086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 85a279467214b19fc2b2660e537760fa7a07b65fe11a426ac19fb37af45b5aa7
MD5 0676a0aa766f2f554eba857ffbe0d740
SHA1 c28be52ae99861334fcfa8a2f026a9dec880cc8b
SHA512 b447122f1393e3bddfe5b76ce98491f3000125d30f9c7f01ae9779588bc5e50273975d48d1c1a0c7098ab0eba0be32fd799954b9614f552d42ab19318b700bb3
SSDEEP 24576:sTkNvNnaFeYhJNtmZBm6f9n1i99k32tY5cz84:sTMwBtOm6ln1i99ZG5v4
TLSH
T1DA55AF2EB6B846E4E1BEC6B4CD238512E6727461173293CB9390C13F1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 66c0a983e00a2df9111dff59b9c87e67470085a898cb1504846a82bf89a95f4f
MD5 06eb85ac94b9913be7d1eafd76c9cf5f
SHA1 26b655225c0e56d403c9348cfea261620446a103
SHA512 abcd082e6bd029c4310b25929722806fc7a2451e97930a83e7ed637ddbb60060cf3d090d6264e14ca4c767b881868f34294f1fa7a5d99fcd1562653d1e69cb41
SSDEEP 12288:wQcMxWDXN1Dp/fshBItT1IQgA3LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5cz8:iD3FHshBIYQgA7f9n1i99k32tY5cz84
TLSH
T14175E17EE65C04E4E57BD1BCDAA38A06E77138AD032165DB029481B61F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-125-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/240-131-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/240-133-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/240-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/240-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/476-77-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/476-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/476-82-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/476-287-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1300-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1300-313-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1300-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1300-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1300-100-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1300-106-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1476-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1476-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1476-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1476-59-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1476-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1712-273-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1712-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1712-72-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1712-66-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2868-120-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2868-114-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2868-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2868-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3612-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3612-20-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3612-14-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3612-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3612-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3784-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3784-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3784-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3784-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4512-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4512-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4512-475-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4512-473-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4512-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4512-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4948-7-0x0000000002560000-0x00000000025C7000-memory.dmp

Download

memory/4948-86-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4948-1-0x0000000002560000-0x00000000025C7000-memory.dmp

Download

memory/4948-6-0x0000000002560000-0x00000000025C7000-memory.dmp

Download

memory/4948-0-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4948-413-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/5344-49-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5344-229-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5344-50-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5344-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5856-472-0x000002022B590000-0x000002022B81B000-memory.dmp

Download

memory/5864-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5864-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5864-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5864-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5864-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download