d8733a6af8b4fe2ee1623eb5055818387f464032191faa0987962d6e0a1da84a

Analysis

max time kernel
149s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.8MB
Sample260714-d1cd4sdt6j
SHA256 d8733a6af8b4fe2ee1623eb5055818387f464032191faa0987962d6e0a1da84a
MD5 97c55d54f70ae9fdfc2c0921947fe8ba
SHA1 b05c37a0df4dd195210d2f2170f11852bf722dfc
SHA512 bb6d257fef29d1a7ba128abe79d733da1724eeef0ff02d2141c9fc2b376437e1d398a91953535467479fdafe124a3458d88de152fba7e87f8c67ac8be429ecf3
SSDEEP 49152:JNZCWOLT4NJGTTmrK2MtEN1V38BXTSl4Z:XwnLT0GTNkONT
TLSH
T1F8856B0667F94129F1F37B71EEB992645A77BC71AE3AC50E6280125E0DB0E50DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
932	alg.exe
4748	GameInputSvc.exe
6016	GameInputSvc.exe
4500	elevation_service.exe
2368	elevation_service.exe
5256	maintenanceservice.exe
2140	msdtc.exe
4992	OSE.EXE
3420	PerceptionSimulationService.exe
3552	perfhost.exe
5480	ReFsDedupSvc.exe
6116	locator.exe
4652	SensorDataService.exe
2176	snmptrap.exe
5284	ssh-agent.exe
500	TieringEngineService.exe
464	AgentService.exe
5900	vds.exe
3816	vssvc.exe
4304	wbengine.exe
3752	WmiApSrv.exe
752	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\420097ac83806d8d.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040b628de4013dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007fefbedf4013dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bf4badf4013dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001513861d4113dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012ea10e14013dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a139dfdc4013dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2b1541d4113dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
6016	GameInputSvc.exe
6016	GameInputSvc.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeTcbPrivilege	4748	GameInputSvc.exe
Token: SeBackupPrivilege	5480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	500	TieringEngineService.exe
Token: SeManageVolumePrivilege	500	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	464	AgentService.exe
Token: SeBackupPrivilege	3816	vssvc.exe
Token: SeRestorePrivilege	3816	vssvc.exe
Token: SeAuditPrivilege	3816	vssvc.exe
Token: SeBackupPrivilege	4304	wbengine.exe
Token: SeRestorePrivilege	4304	wbengine.exe
Token: SeSecurityPrivilege	4304	wbengine.exe
Token: 33	752	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	752	SearchIndexer.exe
Token: SeDebugPrivilege	4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	932	alg.exe
Token: SeDebugPrivilege	932	alg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 6016	4748	GameInputSvc.exe	88
PID 752 wrote to memory of 3332	752	SearchIndexer.exe	112
PID 752 wrote to memory of 5040	752	SearchIndexer.exe	113
PID 752 wrote to memory of 2360	752	SearchIndexer.exe	115
PID 752 wrote to memory of 2196	752	SearchIndexer.exe	116
PID 4188 wrote to memory of 1948	4188	2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	119
PID 752 wrote to memory of 5204	752	SearchIndexer.exe	120
PID 752 wrote to memory of 5116	752	SearchIndexer.exe	121
PID 752 wrote to memory of 4092	752	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_97c55d54f70ae9fdfc2c0921947fe8ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  PID:1948

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:6016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2368

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5256

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2140

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3420

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3552

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6116

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4652

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2176

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5284

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:500

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3928

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2912 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2776 1904 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2196
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2912 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2776 1904 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7d56ea5436bb50f40aa8bdcf2cfabb78be80ad7fdcab8f129a9e1622657cfa49
MD5 a730e801bb02abcddd2b63a5dce9ce1f
SHA1 492bbf19ae9016d440d7900892c35ace92cf84e3
SHA512 e4531b5cd16ae2be5cd8149c8fe01dd4f9034b71cb0f07912d84907f7deb4d7364de10c732706de01b779bcd3345e98eb866a4f36d5566187ee6cfac812cfd27
SSDEEP 49152:yb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnsV38BXTSl4Z:U3q6gjBZONT
TLSH
T102D59D03F2D900E9E06AD178D74A9133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 5124a70c43b41c664d020d77bf24a8324be685c5f18700f63343d72e2a61289b
MD5 faefc2db16bc8cf0c0ec54ae8029acbf
SHA1 b30b77b98854588c5285f6ea22b013316cf42171
SHA512 c4a7a80627dd0f3fb4a5d3bb651912429f3adc1d5df464ef77da9b3c48190d8f9f5424a3939db2d31a05577e82b673129289afa742fcbe0ad254c466eefe7abe
SSDEEP 24576:xXYSFtczABS0rA1V389Xuls1XTSv58s4Zwcu:Btc7V38BXTSl4Z
TLSH
T12005012977E408FAED67C27CC8A68502E633B85143B0F74B03A499251F237D96E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0998d2b7f8dac77eaed3b16eb1c7bab785e05464ea90e704d0253fa1370080d1
MD5 fb710edfca37ff4ca8ac07f11fb0330f
SHA1 db87bb54fac6bce9bff3cf1ae8cbacc02d5e601e
SHA512 f4506f297156c6b88eb7fb73cb3374943b95322610986c1e674743a60ff8d9cee0b9de1c3650980874bfcfda48fcbf9a71e6240d77b78a3c5765b9916609dcb2
SSDEEP 24576:E03elSI0y3xOrM5S0rA1V389Xuls1XTSv58s4Zwcu:ELSI0goPV38BXTSl4Z
TLSH
T1B645AE56F6788335D073C0B9C5D2A68AE971308257308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 44bee2a09e9ab13fbb821b904dab8216d59e0c9c5aac5e88f8f0347c7b3c20e3
MD5 ac408a59e394933491ba4aa10858c85b
SHA1 5c4250dd1165fd43689d96e79070edfe98f306eb
SHA512 55c0bf252ea8e0c2c9465658b05c55f29ef505ad25d17c82464d142db660674b41afb75b3bacbc526b6381e9e4448a57c79baabd1ea690076e4bfab78fefc0f5
SSDEEP 24576:xAZ/ezSC6vUyD/aqgrvW/6q8wyueS0rA1V389Xuls1XTSv58s4Zwcu:I/ezSC6vUzPvuHjyaV38BXTSl4Z
TLSH
T147756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 0c1af8b563c9c8713a758bc0889bd1629988e81ebae2170db6f78c7fdd91ce75
MD5 d1c85d7d703f510eae86a96104bb4533
SHA1 3485b8483d2f604beeb83008537cbe47f5f4bdd5
SHA512 c3634ebcb060c0d369b23ddba53d3dd7d671d6f282b39d3d0a76d67448983135d655f8ad5ad3ba24c8e63a7e0cc12388c2e56c30256f44410db069e266244792
SSDEEP 24576:tabiPFFytv/l+dVS0rA1V389Xuls1XTSv58s4Zwcu:taYFytXl+iV38BXTSl4Z
TLSH
T1D0559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 a5bc3eac186979120a4434e7eb19bfc98c4224802263ff59e919022c8e3d5209
MD5 179daab59adf06c7d5590dca71a66537
SHA1 4fef5ffcb931ae51c5c97949645169c74a1a8f4c
SHA512 901f641f28e2e10552f2694411839d2b517ad3e80d3aabd6a72b81c8c61b8b1116967c5b84ddfcd09e4d619672a01352e3fb1ebbb52e72fa0abc35be7b72375c
SSDEEP 12288:AifcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:AiUS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T188D423C36EAD04F7E36BFBB9C46E0593A0717C0273B5F80A5115B9589F42997A28331E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 07ce5e2efbcdb53630746cd02469d1b5df26034ad8e4cdfffac6607075d0c5b7
MD5 9d57409c7202ca36c91d6f10f3f0165e
SHA1 24bf553ea99f539d6eda9d99f22080490289500b
SHA512 0d4ef469ecae98fa95823593e81144e91a3b248f0449f25e467c2e3e2545e617b7a0e0a60299a2c69612f277a50a1cd41160e3e3b855132e89f153b683e004f1
SSDEEP 12288:geBNUbTVO86UMcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:gJIUDS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1AF15D07BEE28FCE2C27E9DB85A518600D77278304B62A3CBD165C20EDE135E15E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 40df452a22d6b3ce51f3ca9e4b9762848fd79a4e2d9db83f35bd00c13096c454
MD5 87910386289c683aa915ef705a75eeaa
SHA1 64cdb310aed5fca881723e28b9961687284a8e57
SHA512 d963bee973ecd5f49270733048e0b30a44dafb25cb53178c5ad757eb576cfc80518275698265a4f7119a11560f5ae2efc4399a2bfd79d97670c96c57d55f1fec
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJJ9DN5JONRV3THq:nQvGAdlCEL8c/JRNa5CMONT
TLSH
T16F367C656BF880F5E0A7E178C97A85B2F7B678021D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 ec1d0bc2f452f5ad48e2cfe413a69ff488c3985127cbc59fece8dca24a81d747
MD5 29b5954bd533f19a84a967818b044b8e
SHA1 488fde4a021a5646a6a337de89b80edbc0a7338c
SHA512 7a77d6a49ec12c5f1e8515808d7423d608d30ec84226e4354963bb2d25ab78a2fd7b5a4eb22c39337d7a23ccca178144ac28c7df59c7bd285a9d5d7fcb4ff301
SSDEEP 24576:hmewsAjSS0rA1V389Xuls1XTSv58s4Zwcu:EljPV38BXTSl4Z
TLSH
T1CB15E032FE74D036C37B0DB65B3AC716547D79204B6129C3E3A89E9D5A202D22376B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f8c59b4338645e37ce4029bbc63fd9883d1211fef3279e272bdbdcb0af207378
MD5 db7c845648f4b9f32a1585b7a43b70ad
SHA1 0bb1a1089483f1a5f92eea8e25c6691d8e0ec0ad
SHA512 01fcd43b4793955a2b94ed28a35619308e063fcb4114343b34d6e7d439be0e80b6c49265cf8695c0876414877411a99a454fd79a34bf59c3db7a0c352e9f1c7b
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJH7NT:lUEtQevvqc2W1cpV2XF327
TLSH
T183474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a6a3bc009f7d7be5138540d4c995ec5b895cde809072ecd3614954f987d923ff
MD5 694d1ab30adeadf46be558c9c0345550
SHA1 a532bfa1b9a4ac220676c3265d71e91f2b47eaa9
SHA512 52916a24502be4501a3877689e461512ae88f021d4ee256e3be996a9428ecaacf6ca936cb5b39a0d7b5e3f503f43080df8327de05785b300d53a3b17de7e6ae2
SSDEEP 49152:OXbRquA/m2yL5zMfFiV+XenmE3/zVV38BXTSl4Z:8oq1VjnmoONT
TLSH
T159D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7fe202b5f025a9f1aa4dd3a053f7da9511a92ff0d289d791dfa766e5bc7e510b
MD5 3cc77611ea71816caa787579d264c637
SHA1 119c68baf6cf0fca457d58b9768a52a066da97a8
SHA512 b7a2ec3781a0377d734a27ac999c52128ec3893434f18cc896615eed59790cbf3a6c45566429540fbfe704b27c74f6a602b79f63c83871267423310668500683
SSDEEP 24576:RAhGLv8FoiwtA5l7S53jS0rA1V389Xuls1XTSv58s4Zwcu:RAMYFoiq5aV38BXTSl4Z
TLSH
T11945AE81EBF945D4F5B3AAB899BA8171E976BCA65E31D20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 b12b10954716440d98955ea1706db724b475ae1d4c40c3b6151d1e6820c50797
MD5 8e59caa35ee8fa013aa4006ab33079c5
SHA1 9667534a7fab2ab155a396fed9db170ee3d13425
SHA512 7ebd2356e7c52440e2cd0754ff0b05474b59382a0489b136efe89eb9e6e98b207f2094388d196e84c87d213e1661e4e19c6e388d0ebcc126b3f453852109b306
SSDEEP 24576:uwuuOW2S0rA1V389Xuls1XTSv58s4Zwcu:uwVOGV38BXTSl4Z
TLSH
T10505F14676A90CF9E6679639C55B8132F7F2BC023731DB1F1360C65B5F232626D2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 e4b0afc1924d3c61e82c3cbdfe2b281ce9bdd62bc46a53f6fa22d8a8d3ca92e4
MD5 3d34bf81865b826734752f9491268893
SHA1 2b208da30b1fc9b3b8fa0f03e37b61933ea7716d
SHA512 222b7af5522be63230a36fe0569a9ce101964245dbfb2d48bbbed1e5580df4cb30e2e15fa98546d095db6a0e6a9c9d21481950f609d93c441298e93f0fb9bd6e
SSDEEP 12288:lVJ1IWNUcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:bJuILS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1F3E4128736E810FAE367A67CC8ED0642D37278123376A3CF112552695F13AC36E36726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3c04de10ae02365db103e85acd8ea518d7b7880e49abaa8ed590dd98d8737da0
MD5 49aefd96cde2f6347e7823df883735fb
SHA1 b65c328021cad89f3c2f7a5f43961d6fca2b79f5
SHA512 ea41952af0de39fa7b6c31ea1d8be37e236984a86ee19632868837cf7630f2c12716bdb14151729ff33dddc1799565f132be386b62b4e2bf844ecce5f05683e8
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U7:rQRQyi36YOcP8Lvw2gAf+PN3YONT
TLSH
T128667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 43a18945828bb8f7f12ba6df8e96542998f3814d296e51611c243c6ac8451545
MD5 28cc0acd66662fb738c715bbba0bddd1
SHA1 cf7f355334e8c95ed5e00e41c9c317729537e42b
SHA512 a3860a1663254983d99af84dfc2dc85aefe27ae05cf5c4225ba1c8d9f5b0a9f336ff741cd196ceb233c9fb3fc0c13a037363961022b46fbebbbbd8ef50829f36
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ua:rQRQyi36YOcP8Lvw2gAf+PN3bONT
TLSH
T13D667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b0f9e5fd69da96014c273c477e3aedf27c1e029ac5e0842b130391b496fb34e6
MD5 8772e340098d6b4951dfafdbafa79479
SHA1 20d5a75ec1b7d4bf2ce780b0219d4f24e6c21bc2
SHA512 c18ddf4206a0c50f1fe85b107aa37fb05e19698e1b27a8d759ce171cdae26e1c415766bbfd07df1bb9985fb6137a42644148465b9b59f82bc2202beb268b1219
SSDEEP 24576:ewvD8f6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0YS0rA1V389Xulsk:868Qg55nhMeWu7PNU3/uV38BXTSl4Z
TLSH
T118B55A33B2F600A9C44DE1769F4A872196E17C718FE1E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4f8e48e804d2c2a1daa639056435ea677fb8d87c3c04be9ce95128b2b70d7dff
MD5 7773d4b7ab10c2a60f8f9b695ad0e1b8
SHA1 8623aa18d49c5c7614b8fa7afec873360e454d47
SHA512 7a89285d82277f62edad87b8d1f5198bdeb4efcdeb8b0715b8768a8d3924b3fbb4d45b4a4a03d4480450a4e1ee06b16e13e4e3f72feeae46abe908216f20a064
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99+:vy5112gYy5azzVv569nLKnhZAONT
TLSH
T18F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 852742f29e79fc8b2f507f888fc7a4e0be58da91a08d20f883c299750d509157
MD5 69a1c258a5784eafc992733894e33f20
SHA1 4ef61cbec6f9ede2d7f4eb2c6b7f896bcd396b76
SHA512 601d01da7d1e57c705aec7e2372110615504be1343f4239d79d684ee44d2ff9e39bca9ee55b31feeb37e62588c6ac4ad4c1368af53b7b33f043839f92611021c
SSDEEP 49152:fB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glyV38BXTSl4Z:hu6JmTxd2dyONT
TLSH
T1BAD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 837932a03049e5b480c535783ad77dd2da153499c80e67da14c948b03033562c
MD5 106c2c1e511f051901f19bbca73a72d3
SHA1 3b7c6ddcfeb6c919f4c36c924e59ab974162c413
SHA512 0c757c8237c66ff76f0868315df01c11e84252afd31263b863990b0617a1d983cf09b3d3015cad6b296b7ca3be329ccb141f5c55d9633fffe07ebb17770ce73b
SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xXV38BXTSl4Z:SmifPbRQONT
TLSH
T129B5AE13F2D900E8D05ED178875A9232EA72BC460B35B6DF0A90B7961F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fdd0a2413c1923aba55d08e43b398f49866b2fbe34b8f9302945c9e0e8dc46f7
MD5 b5c63ab879c9d7dfd96ef549187d9b02
SHA1 c7cf5f1b8b234716dbde82aee07c2191d1078cb9
SHA512 7da654a1b523f243a536a233b5cde65d8368f6e1fffb8a19e37f2196273f9bf3442cf64fdbee2e9a364a02d8cd4731c3cd8552a7377ed2abcf17a8c2d4de4f2e
SSDEEP 49152:ySuZQIY0Be2K6RVtOnks6NMHqkBV38BXTSl4Z:s5dKoi61kBONT
TLSH
T114C5AE03F2E940E8E0BEE67487669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 381583530801efb03bbfa3ded96058dcfc087af3e1812a8f282f0cd4eac2dbb6
MD5 410d0e20adedfd058485e4339e8c90e9
SHA1 c18ea101b5c2f5499dd065bd282d41c62daf08a8
SHA512 f233dff8cf8cf565c51f9447dcbb537c5e45458bf100c35b7441723eed79b7bf06505106901a0df21fdeaded0d64446f8018410f26ddd21488b4e6032673ebfa
SSDEEP 49152:oJXSn8EApI0figTgiDn0AP5wqV38BXTSl4Z:TX2iyphdONT
TLSH
T15BA5BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 e6a40713851660cd5e22421bde773af6ab3d9a46d0905365918ad819ef531c15
MD5 177d687253a18cb6e04f786bbdd046ac
SHA1 921d5753e39d4ce4fd4d2d01b750803667dacf43
SHA512 8891482cc3da83a91b4dc1293d1fe14c48a9329e0dd24ac491efb22ac62936ba65c5ff8897a300ea2097dad04ed0971506cf0f9f866c0f06266916bcede2d266
SSDEEP 12288:qOscS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:qOjS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T101D423C37DAE04EBE317FBB9C56E058390757D0373B6B40A621AB414AF42997228375D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 c1a26cedf2cfa1928cbb7bac2bde52a079e1df5afe1e5a3d579d12b23523461c
MD5 17ede12f05043dbb13b62ce3d506bf70
SHA1 d620c1a17e76d96f8da959272a5fd0280e56336b
SHA512 b8be1390caa8d7a2ab5f2bbcefe9214027cf04cad629ab31347208c4ed3fb37daae079dad09b2af8d85511415f2f9934e326d05809c608bba1e34cd7ac300019
SSDEEP 12288:ovRcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:o+S0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T19BD423837DAE04EBE317FBB9C96E058390757D0373B6B40A624AB414AF42D97228375D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 f38e17665cb24717e46436b54a2f14de9ab2e8637e56ef6d77a0866322dbd067
MD5 acdb33602137e171b32779b7cd3873a8
SHA1 0f64f017519a057be8f4d0ba241c31ea020c5382
SHA512 06366cdc3e99ddcbaa1b64c8404135a33f548fa37760fbc1d1368d96514243a2cd1fb860bf447717e820d2955c71840d4fc458781e1af39c74553be664e55488
SSDEEP 12288:+c6cS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:+cRS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1E9D423C37DAE04EBE317FBB9C56E059390757C0373B6B40AA14AB414AF4299B228375D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 e2e0cd3c5fa7f8943703c0af0bb2d29a4b36653e047194be05a4e410b6443d65
MD5 ebbeb2a68236777f7bd6c6524740e08f
SHA1 2c0b3ba17afa62ab1664b2a1f1093efdc9115769
SHA512 603a6a1de0929f25480a29f05f082f779304d24993cd9337a82006cdd7f37a19138b0cb39b0d59cb291b4a12ab293041bbf363f33bb29f2912171da778d73be8
SSDEEP 12288:0lbcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:PS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1C1D423833EAE00E7E367FBB8C96E0153E1B17C12B372B50F920168195F52B976642B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 c3b83af7cc039a223eca1b9bdfacb0c6326e85ca381c1c98a7bd360b0f11c3bc
MD5 c7652cdc31733f8e779e5ffad9fbf4a7
SHA1 f06566e31b9e8cfcf0e45667d5be100f11fb6e5a
SHA512 2f5fd15dab18149b5f16e3f768b1fee7797bac39b0ed599d311497788a2355775e12178ff1ead8fb523e831a83ff40b2c02188c68984bf19bb8bb1b5c49407ed
SSDEEP 12288:dScS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:dpS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T172D423837DAE04FBE317FBB9C56E0193A0753D0373B6B40AA14A7414AF4299B228375D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 39fe9cd83d2fccded69e0e2cede7e8d5d42a6b323ff8aef3bfd4c20d31dc9655
MD5 9bb3ea2b0a8fa3b57b15e55fc11ffe3b
SHA1 fbc4be8bb67abdc49c1cf07e4c453ba838fc4874
SHA512 0a187dc8b58a240bc80fa1193d3ea963768ab6447371990921e4eb896696713c174517e0b4c4e7d07aad346c1d0eb6444bc4a208585e0bed5e09684333e8b6ba
SSDEEP 12288:OjcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:OAS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T176D423C37DAE04EBE31BFBB9C56E058390753D0373B6B40A615A7414AF4299B228375D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 4c57dd2650e4625a6d79618fc17abaea8456ff7598976805327a4e8afade3f4b
MD5 6ac4009b08f3d54eb0f37700d27465bc
SHA1 314becba5d1a4200778b4d3b2e3a37048c63254e
SHA512 43c11af93fcc67eb9edcdd39eda7559f31131a60d32bb41bc57e17c6323e3a9da13f04e017617795b6ee3dc4ee8920a535760610234c438ce11eb74177ae4a3e
SSDEEP 12288:fELcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:fhS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1CBD423C37DAE04EBE317EBB9C56E059390753D0373B6B40AA11AB414AF42D9B228375D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 7cf24f08f02b6b86ff52fb344b578c1f06343781b33b1b7424698d4057e174e7
MD5 ee1b358489aad31f5641fe0b506e2b06
SHA1 dea4a2be081ce57e304ae3e82470013422df996a
SHA512 ce80f20e8630164019500508a71ae7bfa8fcce178348a7c7e15bb092b202a2b2de4e419ce75e16621d0c4ff699187729fd2a89678b21ada711698e66b2cebc40
SSDEEP 24576:RZM7zFsSnbS0rA1V389Xuls1XTSv58s4Zwcu:RZM7zmHV38BXTSl4Z
TLSH
T1BD150296B39408F9ED67C23ECD294906D2B27C161770D60F13A436265F337A21D2EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 434e0fa62abe0f5bc322adff2122f7df0b085fe863eb8d8f99c0cd08d2a6f722
MD5 d8a089158afcfdc2fdfeb4593ae893af
SHA1 4bdbcddd53eeeb540fe468f36df4d359c4ce62b4
SHA512 04bc6af07c10a8015d34198ec26284f3a90a16623ed9db6fe51f75fa3ba2cc7537ac2a392d3c93288c3c97262ec4121839a88c8643e99b7ca7dccb28e757fdfa
SSDEEP 12288:OicS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:O5S0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1F9D423C37DAE04EBE317FBB9C56E058390753D0373B6B40AA15A7414AF4299B228771D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 e55019b03ef56e4de7c238e234965f555951aaac76e187104c8765f195f5819a
MD5 2c3f6a59dcde7a8482a41f41c881b435
SHA1 9a320cdec26d579c7309eda6be5b0241f0225c52
SHA512 6109f79bdf619e99743c45cc5dbe730bcd1de8a8dc4de864fb09d4cda3f4a8c91eb7629499a3141e0a8fc9a5a5d015068cfa61dad97c0d3b155d2f029ded7653
SSDEEP 12288:YvcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:YkS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1F4D423C37DAE04EBE317FBB9C56E058390757D0373B6B40AA11AB414AF4299B228375D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 9a2095937c59d7a300b2fadd48c88e2b35f0ac1bf5bdac73b9bbb665ed6c32bb
MD5 d04c36fce2524137f251005bef3e8bf2
SHA1 fc3855e8b3e64d94152a0c727ca6720b6f09e72c
SHA512 c32adbfbc57e585fdbdc5cbadb11beb2ea19d3dfec7e591f57946845501cc204cd9642aa97600dff9e2979b3b0eb4014fc04c89d73282eb128aabc53354415c3
SSDEEP 12288:waPz5LuVcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:tzUiS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1C8F4124377A520FAD237D278C86A0A03F3717C332770AA1F536456766F136926E6BB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.1MB
SHA256 c3331ddc86a5b47d627380c7107b3be36b7d0948b4831f48978d30801b81f9be
MD5 fd3c6e95cc5470972becf3180d72d299
SHA1 231d8c012b304e2dd8a17fb629da7884f923b47a
SHA512 c754cc0ef74bbb68472f99b29c1f705e6c5a3e8cd3081ff1f9570ea7cc6df4383d097757959c3ffde952270e1d0b0c8b499a99ff271eeb11de5ecd7017342fd0
SSDEEP 24576:pCwvtk9RX6wkyAIkUS0rA1V389Xuls1XTSv58s4Zwcu:xMnYIkZV38BXTSl4Z
TLSH
T16035CF2AEBDC04E5E177923C89B7460AF2B178591B31D6CF125A536D0E33ED46E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.6MB
SHA256 2a6934c79bfad6109686d14d281b462291a78cfe8e26eda6d8389f03808df564
MD5 fd699c64137e64d9ed11a59bbbe9ceba
SHA1 097abb537d667e4a4039deb0312aca76f17bba62
SHA512 ba7a5f5f99b1af1ad0251b70db20ed6f53cd68f509806ba2471f95894b193db35a72d3f2182294f5d89199056dd2683572c562d0b05ab313ebc6baff3fee7bb1
SSDEEP 49152:SYmhNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XV38BXTSl4Z:iySzP/ONT
TLSH
T1FA066C97A1A801D5C1B9C1B98B1BCC17FA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 94be8bc1a986bd9b0cc1d8e0bcad906d52dc7f4089284174a834f24ceb45f704
MD5 23dccff09ccc9a9eb552c1227d4fc45c
SHA1 b1a3b890770806d1b563a90fa20c1930ea6f00ee
SHA512 3ec3bec9f8461b748fb8d8e4c2a6da54d127df2c447ca94ea508e9a26d0298189430a85826cecf7db81719115acbdb6ab8e2f891cb58842dba9422cab90e393f
SSDEEP 24576:2I7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AY6S0rA1V389Xuls1XTSv58s4Zwcu:2I7JUQjXirIhCnDHUPfF/9V38BXTSl4Z
TLSH
T15065AE1EA3EC01E5E1BAD27885154A1AEA71742E2B31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 7a9c17a4e71828d312c8756c29797bc02c34f0b96d85ed17ffd1a3e49ce0baf8
MD5 91f989b3863e84ef6695fcb3534c763e
SHA1 b7ca5830938822a4302124d05403a1c8f22598cc
SHA512 10a1daf30d52c30477e4a0b486ddc633bf251137aa9151dbd1b66be8756d33d8cbf8e30fabc5f5cd927e33406fbf96ac39362c78ba092e1b0ed7bedc0a5400ac
SSDEEP 12288:rKsfccS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:1TS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1BBF40146D29801E9D16EA279C75A0642F3337C22A3F1E38B52C0F53D1F766926EDA707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 102B
SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
MD5 c42592fd019ec4a186471c670ded3b4f
SHA1 2d5a5b980279b0305441b007778a31c18e84cfb7
SHA512 dc22dbfd7fd36284002bcaa73c2224d42afa850123dedac16c37ac48abddebf6d0c7db1d02793dcc9553d226de60a2cad8075a03be7efb4caa29e92157bb36d5
TLSH
T172B0125313D54C10F4101801CDF444337F2270C0680AC00CC0D1111744F0CC0CE622AF
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 1KB
SHA256 c21c9d818e40da3dfbea6620b530aa18b23d39bff93ff8e5379d20e85f3db7f4
MD5 263aaa6fe684482621a3d66b1e856e7c
SHA1 400427ced6003b1039945cfa73f08cdc71d46479
SHA512 ab4e03a634398ba3890c7898dfb4ffc1ffb830bdabe03c6e8b8f7ccf2a8102247b24a0e05f422bba26fea9b258f597020f6e424576e5955f1c17d736a1aa2b7f
TLSH
T12D219D871AE91560F5B35F54EFF994735B323CD21D19C86C80D8120E8DF1A90D5B27A7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp2C41.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp2C41.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp61EA.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp61EA.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp62C5.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp62C5.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp69EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp69EB.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpEA2B.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpEA2B.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 506c156ccb0cc3ddf998c3ea10522244388079d078961d509269f0e388123af2
MD5 d1dcf3a38333be5eed79e9be50f5d238
SHA1 033c6dd331b4c50564f051974b457d355df5e8ca
SHA512 6d6e869817f7181115b0d54134d1cec5fdaae6f8aa2dd2272957920efd0775781aed5a837a28d7e1d6848371bc49d4ee03875701dcf2cfd1726cdb861a67373b
SSDEEP 12288:RR7/cS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:X0S0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1F1D423836AAD08A7F37BFBB8C46E011360397D127771F40BA1057154AF52DD76A8271E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 387d08747980b9a07f81a85040009a5d7b6c7ae42ade05c038f7a7a4823105eb
MD5 c2efb3942cd9acdc52e41d44f9d2b760
SHA1 6870bcfc37b4fefd1a8e30c838ec4a8f0fd604d2
SHA512 0a3f0dd5a8cec30d099ec5e26a2df1dc0bcb552cd77171d19ea34694176a69849574e01806fc819cb41a4bd492f40ec7d1154c1bcf4bf40c9118c2a2100e811a
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYpS0rA1V389Xuls1XTSv58s4Zwcu:Sgb4mBIBhGF5V38BXTSl4Z
TLSH
T1DC65AE1E22EC01F5E1FAE2B8CDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 e00b1e98dc1a9e95f02ff2c722b166de7deac643e9196b734053675d4181d8da
MD5 44cca7a28f8a2923cc2a45f5f3b4780c
SHA1 72ac0a7d57fc8465599646436faffc1ef4eb4684
SHA512 688a9554bb152283d47ed532887c271d1865fa4d4bc143f9d2f5a51b33abaae0de8a74d0140d27b59415b006341158e10a60b18f61885a082c956d51e4a624c2
SSDEEP 12288:KKG+cS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:pGdS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1CFE4129B39FA10EAD63BE7B9C46E0153B4713821733574EF4095A0349F429E2727AE1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 e8b0c8fde6091b75cd646187687a6d2d7660a6986d89d4b355be9454798ac68f
MD5 fad3fb1c7f5e5330cd7ae2ed52715d97
SHA1 fe9960ff0510fb965918bd9bfcbaac0d3d349f24
SHA512 a3c87243633940d4dc1606528b0561180ab1741e46a8131284e405ac629be42834edd05bd5f54b6e62b108b3ee7b017e9d3b565b19eeabe84297f266610a75f7
SSDEEP 12288:i9cS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:iKS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T133D423C369AE04EBE367FBB9C46E05536071791273B6B8C7A04AB0149B42DD722B371D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 c4d2694ac9f79e119115af45a85c39256c71107fdd42862caa752c09c65db939
MD5 1504a3acfd9be1b0cec0d5594808bdaf
SHA1 12e69a3a8c9db1e3c3cd1068e4b291b4a8f89a00
SHA512 e21faefaec25bcd5ed86ec76b9e20c26b40090dafc5168937fb222da1a99eaf7772b46f364c72835f5f85ee8254a47b52a4e3baaa0107840158fb786eb2e5937
SSDEEP 24576:ViC8i8FpJqH18zria7/moS0rA1V389Xuls1XTSv58s4Zwcu:8xFFPqVba7/0V38BXTSl4Z
TLSH
T1A135F16276E501F1D47BE138C9860663F6B2B8211374FBDF06A88A511F13AE50B7FB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 f75485f0036e69c34c24f8fd66a8a599f9890c2ebfaffc0ad833e682636636d5
MD5 f7726bd062271c284e108513f88dcc85
SHA1 449e2f8802c23927196815dc2ab1129d43c81318
SHA512 2f48e25e59ef1c6074eeb51a6aac0ca3f4c63c081b32b7429cd961e1bec51f07fbcee0c7e859abad790daace1b4cd106a14fa2f84f1addb3824f9d9a1333b021
SSDEEP 24576:vPUr+NQYS0rA1V389Xuls1XTSv58s4Zwcu:vJQ1V38BXTSl4Z
TLSH
T11905F15F26ED18E5E676E17CC9864609F37178621312E2CF02A0817E4F53EE9BD3AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 0e59e8b65045fdfd6fdb09fa8d599377e4b0ae01be7fc812316291900c880c91
MD5 a91dc677c031c55b7bc69bf78bc7ef4f
SHA1 2b83c1d45b0d394f539c8b442347350611af8f04
SHA512 403c3be10f61b0fddc70535ee3213071da4dff55feab3b7f2158427db83b1938b08f3b46a7c25a47db4a8cb612dcc7597c626eab952cce2500c2411508142ea1
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2V38BXTSl4Z:/G05lO43btONT
TLSH
T1C6D5C06A62EC01F9D1BBD17CCAC6460BEBB23815033556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 433525754db88d9347dad4dc5640dec959c16c38bf5d0c7b257a35bf501fbf34
MD5 b7590107526a3b5c242e085a6fffb122
SHA1 9bc5a7bc544f3710ad51fe7ad1191b916c778b43
SHA512 ffec66f169491208bce0939f36b3b5fe5d4e96d0a93e610926e1d1645a0322ef96a53d0e8ce1da38aeb12d8d454f638f9247e1579f2721919da646860786fd87
SSDEEP 24576:aKa5POZ3dpbWVM50JicR2hG0lasx2+47eidnVS0rA1V389Xuls1XTSv58s4Zwcu:La5POZ3wJt2pasx2+m+V38BXTSl4Z
TLSH
T13865AF5EA6FC00D5E579D17DC583461AF5B1342253329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8a069984cdf2e3590afa0a0ad1bea3db09a0121ad49dfbc74546ef49b648fcec
MD5 98439809ad6a0b18f7186650a81debc4
SHA1 989ff7f7c0b1ac60d022a05b93bc44ae098b6475
SHA512 107eda6d69025081c305f75669090d69d41e37292febfcc675c8235e3eae41f43be87105266e9300476894f4a751ea46cd43d4facbb5680b702647c900c7364b
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkqS0rA1V389Xuls1XTSv58s4Zwcu:TNc/zEOVHFyV38BXTSl4Z
TLSH
T186858C5623E901E4F1BBE1BE897B9546FA71786513309ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 04862a1ae902c8105128aae807e6faacdf4ea1c3bceeb8ccc992a27b3a19ca19
MD5 5793637ed882abff2074f47bffc3d9a4
SHA1 4c4c289e5ec20ec41657011f9d2398a3c826094a
SHA512 6e7994bbb2f2a1f1bdf7c34112a7598a5de2267ac1e29e21aff01e896886949bf517e79b627992565aeda42b3cfd4f800b23d66d9a1829710860e2813aabdfc4
SSDEEP 24576:iJnJPbzB4SeS0rA1V389Xuls1XTSv58s4Zwcu:iJnJv6SDV38BXTSl4Z
TLSH
T1DC15E07DD2A810E9E4B7D2B4815A1756FE31387D3B2269C719B4D4343F02EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 21973e928635b8f6b5fef5b6eca4ea2e3a35d025019febfc55dc21918e90a27d
MD5 2954220ba1c2d778ad3c6c639d8b5082
SHA1 9bda6a42ca9c441daae1658f16afb5ef4e590071
SHA512 ec76723926a23a23a9aaae680e22aa750ffdbda56284bd92acbebd782c8e8ad47d37a104b60e1bab28d91fcbd8bd69d05208f4fb19a53c675f2da9b47d9de3e1
SSDEEP 24576:BCLHGL0MoeVtFumTijCmlKQWDktS0rA1V389Xuls1XTSv58s4Zwcu:BCLHGeeV5ijCmlDWDkMV38BXTSl4Z
TLSH
T1A7A56B05A7EB4184F9F3CAF5CA2694169A327C509B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 0756bedc13bc995069b78ad2573f094d2d861262f466212b7a5103800cb4e5d1
MD5 08cf55747334b74e4a57cc6e4525f98c
SHA1 53c9554c06a8d70d65a43c2c3c33eaa543b75e98
SHA512 f40a6e194f017ef4ad9f2fdb8c1722439a305fec106c86a9a0a875b4b59408ef6b507b531fc59c80bf3b36706e5e2e0bc1567e1f7ec74e23f3178221acb050b2
SSDEEP 12288:K1Hck6j5ZI7RcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:26DICS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T15405015E33BA00FAD16BE03DC6870102E1B2B471A36269CF0694D57D9F93ED9B939E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 6526196ca77d23bd6ee80de6b9255faa4e6dd617e5f9117e8213e2821ca0a08a
MD5 89c7b7431f08f77d9e5570350d2f1f2e
SHA1 90ad48c1d60290d87a386d0e6655a4a968c40373
SHA512 0e7390cba3dee1914dbe218b7bf0f351e3c6a8213221e8db47621efdd1c41282e878315600e37df323b472cd20b8e84c701cd91ad39ab05b9d6153b04e29f143
SSDEEP 12288:LG6ky0cS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:qtyrS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1AFF42242639800E6E77A9678C96B019299317C217731B2CF6190F63D6F32BD67932B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 a7b781a76736b67f0b7a0cebbf22f70f0adf1f563a330dfa3237e2269e489aab
MD5 611f9a5f275a12412c9d2896608d8e82
SHA1 4010b4c158f0c7d022d87625d80e7ba1e7cab272
SHA512 82068e9e40da925f8fc7e2d49c24ef45f7f6c65776565e350a9cc891f6e25f965ca048c71b638d3e931fa4bd5fa694e3d2cab92602e65b8673fa2261c467dda8
SSDEEP 12288:RdXcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:fMS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T12FD423876AAD04EBE726FBB8C46E0643907179223372B4DF6095B5349F429D72272F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 8b5f36e7d355693ad87c895d8a0c5ff35af481a9f8739e0eefa12133f79a02e4
MD5 7ef735a5126cf7dd6bd2c003c4399275
SHA1 44fe5ba8dea50e48486e153c4ca030cb7c8bb2c5
SHA512 6875cc57ada946328b9add9c1a1d579675d601f732385e63c9cebd585e12e908fe86098e1e517b01bdaeb4faa12371380e77df4f4fffd58a0b8ff6996479d30e
SSDEEP 24576:P/goLoTfaidZUS0rA1V389Xuls1XTSv58s4Zwcu:HgnTrZZV38BXTSl4Z
TLSH
T11F559C1D67EA05DAE2B2D679D8721493D633B4311372D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 050bb9836ad190f1cccd45472fa15297eae177003d7ae0bf5584d2586f62a4fd
MD5 cdb7c4827bb58dae78e7f3ee30f99fca
SHA1 abdf3c69734f3dc6dc451a14b5cba747a092cf7b
SHA512 af43290864456bce0eddea118b9c0781cf81d3b74cd85dba10c190497f2fbeba39004abb74fcd2ae80774428e0b2abdef80099f681c6e5882ebcf78aa87905de
SSDEEP 24576:crcmRGS0rA1V389Xuls1XTSv58s4Zwcu:2cmRLV38BXTSl4Z
TLSH
T1CB05F14BB6AE00E6E2B7D27CC84A0542E2B37431236267CF42A1C77D4E579EA7D35B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 37328c7a4b38f7b83718e61d5fae2747ba9f157b938e2eeef2b41da82aa0b66e
MD5 c8d56ee515c9dc87604967283f642c85
SHA1 d0236e083548348b67979a7449cd03ab39c133c2
SHA512 cd22ab51935cbdeebe36e11ed8e512675ddae72b9daac9b43551480dc06ba7be13fabb6a48632ed36c20ad96799353cf8387ede4c73fff885e69a6ba72909c60
SSDEEP 49152:NDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3HV38BXTSl4Z:u3Upow8sB8ONT
TLSH
T18EA58D3DA2E800A8D9AAC379C54213A6EA71742E3F3055DB0174C578BF1BDF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a6748644ff8041fb95ff827ba5a25d80ec058bc70caf3e2adddf79a4d82d8560
MD5 18cc75c8b7637f48ed875f4865370027
SHA1 95d11ffdf377729aff6f80ee7d69509930f74dc2
SHA512 6c7be2a07210d758b3d843991222871e424045e0e67f17bb67bd23b35be8d27aad84ad87d3a9f07b05945887340d9fa124ed58707ae3febd8aab6d6c44456b97
SSDEEP 24576:ITkNvNnaFeYhJNtmZBmfS0rA1V389Xuls1XTSv58s4Zwcu:ITMwBtOmeV38BXTSl4Z
TLSH
T17A55BF6EBAF805E4D1FEC6B4CD238512E6727461133293CB5290C13E4E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 992KB
SHA256 460c3ea2ed8ca4be94773dc6948a8973ff65f25ecb529f0b94bffd048b007f39
MD5 1ebe336835080aa2c84e5d355bc99983
SHA1 93291fbb2a6bfd003a3ef1bba58e13fa94aa80b0
SHA512 75a860444867bcbe63e6249e823f5428ba8af8187948d52e80ac96672aa3b56407aee7c2e6f532ed89165c73f1ee1c8c289ace610d1479e9035bdffa4d57f692
SSDEEP 24576:8D3FHshBIYQgA8S0rA1V389Xuls1XTSv58s4Zwcu:8DVHeBIAAhV38BXTSl4Z
TLSH
T16B25E17EEA9C04E5E57BD2BCC6674A07E27138A9033265CB029481B95F57EE43D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 829ea0bf1e1bb7fbcda32d015fa695e1f12d4bb8d5e8e0696b282388273d84ed
MD5 9f44ad8cd0fa4967fa6fb012b78bb3e7
SHA1 248201f3f485af6423b5a3d5f25584de85ae36a9
SHA512 2429a0d713d7da3ee06ca5ef689c90e1ae46ced6b8ba522fff5ebfb8b8a9e5af67d6b3c090028ed1acbe1a95b169e9eeca2812f30d6e9a2718531e436e6bc497
SSDEEP 24576:v6UqjpN/S0rA1V389Xuls1XTSv58s4Zwcu:v6UK+V38BXTSl4Z
TLSH
T1DFF4128B66D814FAE13A9674C96E412280717C323376B5DF71C8A53A8F32EC6913BF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-255-0x000001FEEF0A0000-0x000001FEEF106000-memory.dmp

Download

memory/464-263-0x00007FF7B6B50000-0x00007FF7B6E71000-memory.dmp

Download

memory/464-260-0x000001FEEF0A0000-0x000001FEEF106000-memory.dmp

Download

memory/464-256-0x000001FEEF0A0000-0x000001FEEF106000-memory.dmp

Download

memory/464-254-0x00007FF7B6B50000-0x00007FF7B6E71000-memory.dmp

Download

memory/500-247-0x000001EADF3F0000-0x000001EADF456000-memory.dmp

Download

memory/500-319-0x00007FF652080000-0x00007FF652215000-memory.dmp

Download

memory/500-245-0x00007FF652080000-0x00007FF652215000-memory.dmp

Download

memory/500-246-0x000001EADF3F0000-0x000001EADF456000-memory.dmp

Download

memory/752-334-0x00007FF6D8D60000-0x00007FF6D909F000-memory.dmp

Download

memory/752-306-0x000001EF43340000-0x000001EF433A6000-memory.dmp

Download

memory/752-308-0x000001EF43340000-0x000001EF433A6000-memory.dmp

Download

memory/752-307-0x00007FF6D8D60000-0x00007FF6D909F000-memory.dmp

Download

memory/932-16-0x0000020E82C30000-0x0000020E82C96000-memory.dmp

Download

memory/932-177-0x00007FF69B3D0000-0x00007FF69B4F3000-memory.dmp

Download

memory/932-18-0x0000020E82C30000-0x0000020E82C96000-memory.dmp

Download

memory/932-15-0x00007FF69B3D0000-0x00007FF69B4F3000-memory.dmp

Download

memory/932-17-0x0000020E82C30000-0x0000020E82C96000-memory.dmp

Download

memory/2140-253-0x00007FF7EFB40000-0x00007FF7EFC5A000-memory.dmp

Download

memory/2140-157-0x00007FF7EFB40000-0x00007FF7EFC5A000-memory.dmp

Download

memory/2140-159-0x0000017CF5880000-0x0000017CF58E6000-memory.dmp

Download

memory/2140-158-0x0000017CF5880000-0x0000017CF58E6000-memory.dmp

Download

memory/2176-302-0x00007FF710E90000-0x00007FF710F44000-memory.dmp

Download

memory/2176-229-0x000002A033640000-0x000002A0336A6000-memory.dmp

Download

memory/2176-230-0x000002A033640000-0x000002A0336A6000-memory.dmp

Download

memory/2176-228-0x00007FF710E90000-0x00007FF710F44000-memory.dmp

Download

memory/2368-139-0x000002786E930000-0x000002786E996000-memory.dmp

Download

memory/2368-138-0x000002786E930000-0x000002786E996000-memory.dmp

Download

memory/2368-137-0x000002786E690000-0x000002786E80D000-memory.dmp

Download

memory/3420-181-0x0000011C32C30000-0x0000011C32C96000-memory.dmp

Download

memory/3420-178-0x00007FF792DC0000-0x00007FF792F0A000-memory.dmp

Download

memory/3420-180-0x0000011C32C30000-0x0000011C32C96000-memory.dmp

Download

memory/3420-265-0x00007FF792DC0000-0x00007FF792F0A000-memory.dmp

Download

memory/3552-187-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3552-274-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3552-193-0x00000000009E0000-0x0000000000A49000-memory.dmp

Download

memory/3552-188-0x00000000009E0000-0x0000000000A49000-memory.dmp

Download

memory/3752-294-0x0000021545FE0000-0x0000021546046000-memory.dmp

Download

memory/3752-295-0x0000021545FE0000-0x0000021546046000-memory.dmp

Download

memory/3752-300-0x00007FF74F620000-0x00007FF74F74F000-memory.dmp

Download

memory/3752-333-0x00007FF74F620000-0x00007FF74F74F000-memory.dmp

Download

memory/3816-329-0x00007FF7E2BF0000-0x00007FF7E30C1000-memory.dmp

Download

memory/3816-275-0x00007FF7E2BF0000-0x00007FF7E30C1000-memory.dmp

Download

memory/3816-277-0x000001D881810000-0x000001D881876000-memory.dmp

Download

memory/3816-276-0x000001D881810000-0x000001D881876000-memory.dmp

Download

memory/4188-0-0x0000000003020000-0x0000000003131000-memory.dmp

Download

memory/4188-1-0x00000000032C0000-0x0000000003329000-memory.dmp

Download

memory/4188-7-0x00000000032C0000-0x0000000003329000-memory.dmp

Download

memory/4304-283-0x00007FF6B4B60000-0x00007FF6B5067000-memory.dmp

Download

memory/4304-330-0x00007FF6B4B60000-0x00007FF6B5067000-memory.dmp

Download

memory/4304-284-0x0000025FA1CE0000-0x0000025FA1D46000-memory.dmp

Download

memory/4304-285-0x0000025FA1CE0000-0x0000025FA1D46000-memory.dmp

Download

memory/4500-130-0x000001D1706D0000-0x000001D170736000-memory.dmp

Download

memory/4500-129-0x000001D170480000-0x000001D1705FD000-memory.dmp

Download

memory/4500-131-0x000001D1706D0000-0x000001D170736000-memory.dmp

Download

memory/4652-219-0x0000019547AE0000-0x0000019547B46000-memory.dmp

Download

memory/4652-218-0x00007FF6C3970000-0x00007FF6C3D87000-memory.dmp

Download

memory/4652-220-0x0000019547AE0000-0x0000019547B46000-memory.dmp

Download

memory/4652-325-0x00007FF6C3970000-0x00007FF6C3D87000-memory.dmp

Download

memory/4652-323-0x0000019547AE0000-0x0000019547B46000-memory.dmp

Download

memory/4652-299-0x00007FF6C3970000-0x00007FF6C3D87000-memory.dmp

Download

memory/4748-29-0x000002E887420000-0x000002E887486000-memory.dmp

Download

memory/4748-197-0x00007FF78B4F0000-0x00007FF78B5B9000-memory.dmp

Download

memory/4748-28-0x000002E887420000-0x000002E887486000-memory.dmp

Download

memory/4748-26-0x00007FF78B4F0000-0x00007FF78B5B9000-memory.dmp

Download

memory/4748-27-0x000002E887420000-0x000002E887486000-memory.dmp

Download

memory/4992-169-0x00000274FD450000-0x00000274FD5CD000-memory.dmp

Download

memory/4992-171-0x00000274FD3C0000-0x00000274FD426000-memory.dmp

Download

memory/4992-170-0x00000274FD3C0000-0x00000274FD426000-memory.dmp

Download

memory/5256-154-0x00007FF726B80000-0x00007FF726CE8000-memory.dmp

Download

memory/5256-152-0x0000015F423A0000-0x0000015F42406000-memory.dmp

Download

memory/5256-145-0x00007FF726B80000-0x00007FF726CE8000-memory.dmp

Download

memory/5256-147-0x0000015F423A0000-0x0000015F42406000-memory.dmp

Download

memory/5256-146-0x0000015F423A0000-0x0000015F42406000-memory.dmp

Download

memory/5284-239-0x000001E94F1E0000-0x000001E94F246000-memory.dmp

Download

memory/5284-305-0x00007FF6B5AD0000-0x00007FF6B5D73000-memory.dmp

Download

memory/5284-237-0x00007FF6B5AD0000-0x00007FF6B5D73000-memory.dmp

Download

memory/5284-238-0x000001E94F1E0000-0x000001E94F246000-memory.dmp

Download

memory/5480-202-0x000001A40DEF0000-0x000001A40DF56000-memory.dmp

Download

memory/5480-289-0x00007FF6D3260000-0x00007FF6D39A4000-memory.dmp

Download

memory/5480-201-0x000001A40DEF0000-0x000001A40DF56000-memory.dmp

Download

memory/5480-365-0x00007FF6D3260000-0x00007FF6D39A4000-memory.dmp

Download

memory/5480-200-0x00007FF6D3260000-0x00007FF6D39A4000-memory.dmp

Download

memory/5480-363-0x000001A40DEF0000-0x000001A40DF56000-memory.dmp

Download

memory/5900-268-0x0000021FB32F0000-0x0000021FB3356000-memory.dmp

Download

memory/5900-326-0x00007FF700EB0000-0x00007FF70113B000-memory.dmp

Download

memory/5900-267-0x0000021FB32F0000-0x0000021FB3356000-memory.dmp

Download

memory/5900-266-0x00007FF700EB0000-0x00007FF70113B000-memory.dmp

Download

memory/6016-35-0x00007FF78B4F0000-0x00007FF78B5B9000-memory.dmp

Download

memory/6016-208-0x00007FF78B4F0000-0x00007FF78B5B9000-memory.dmp

Download

memory/6016-36-0x00000133B77C0000-0x00000133B7826000-memory.dmp

Download

memory/6016-38-0x00000133B77C0000-0x00000133B7826000-memory.dmp

Download

memory/6016-37-0x00000133B77C0000-0x00000133B7826000-memory.dmp

Download

memory/6116-210-0x00007FF753E20000-0x00007FF753ECE000-memory.dmp

Download

memory/6116-292-0x00007FF753E20000-0x00007FF753ECE000-memory.dmp

Download

memory/6116-211-0x0000013EDD900000-0x0000013EDD966000-memory.dmp

Download

memory/6116-209-0x0000013EDD900000-0x0000013EDD966000-memory.dmp

Download