972f2746c862529d5c056bd548c88b0229fd1c9ad95e441aa6a99150c3f4c70b

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Size 2.1MB
Sample260720-teekcaft9l
SHA256 972f2746c862529d5c056bd548c88b0229fd1c9ad95e441aa6a99150c3f4c70b
MD5 5867a15e4dbdb42bf4d4eef9d9fb2c43
SHA1 77cceb51c6bf048cdee1a0c986f14c3934eb44c7
SHA512 b2a27a55920f50bb9444f085ade7703c4950713aa0048fe2107fc1b11f6a00fc4f27bb12dba11a08ee87cb2ee0fb67e803bf12a6aa5a6310ff42005f7bbba3eb
SSDEEP 49152:l0pxcrSD204a1CdmJR9n+/Q8kJh9hNhBX3fx4x8EVep:l0pxfbf+/4h9hNhBX3fix8EVy
TLSH
T1ACA5D0517DA14436E431013488AAC721DA9ABD768371A89F77E8343ECA7F9C3247726F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5544	elevation_service.exe
1828	elevation_service.exe
3692	maintenanceservice.exe
3240	OSE.EXE
3956	PerceptionSimulationService.exe
4532	perfhost.exe
5288	ReFsDedupSvc.exe
4524	SensorDataService.exe
2144	ssh-agent.exe
3144	AgentService.exe
1876	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2eab80a583806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000aaec2d46018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1b3c2936018dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f393dad46018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000485274946018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
5544	elevation_service.exe
5544	elevation_service.exe
5544	elevation_service.exe
5544	elevation_service.exe
5544	elevation_service.exe
5544	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	3144	AgentService.exe
Token: 33	1876	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1876	SearchIndexer.exe
Token: SeBackupPrivilege	5288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5288	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4292	2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	5544	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 3996	1876	SearchIndexer.exe	100
PID 1876 wrote to memory of 5920	1876	SearchIndexer.exe	101
PID 1876 wrote to memory of 3312	1876	SearchIndexer.exe	102
PID 1876 wrote to memory of 2444	1876	SearchIndexer.exe	103
PID 1876 wrote to memory of 2584	1876	SearchIndexer.exe	107
PID 1876 wrote to memory of 4884	1876	SearchIndexer.exe	108
PID 1876 wrote to memory of 3560	1876	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5867a15e4dbdb42bf4d4eef9d9fb2c43_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1828

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3692

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3240

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3956

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4532

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5288

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4524

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2144

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3012 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2584
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3012 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 57f8b5421ce27f8abd93096e9370555ed8c631785ee652e47279e6b10a5188d1
MD5 9a20ad6218558e04866a932caacaadc6
SHA1 829604e22b0df0848586bfdaf9727030d2472eb9
SHA512 eff41375245633bba4ed0c3622877eaaa569510fd43a4f9de8fcd76a6c485eed3195f22eeb86b138a0c559965e5c2ef91510abe779304a80c1951740d5891598
SSDEEP 49152:Ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnPx4x8EVep:O3q6HjB0ix8EVy
TLSH
T11FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 4a78b21ae8615d9d7736d3679655a2f497684d679db875fcde943cd01cd5a265
MD5 5150669cbcbba255580d45e14374a905
SHA1 b02dfd0399deaddd5e7e2cfbf973b7cdfca82ea1
SHA512 7a3c467e6929b787251545cf4bde0c586950b640fced625b8b9c022c978e2f82f6e026f796846f8af5ce038262b222f9c04dd28324d48226d444d80e3ee72e73
SSDEEP 12288:o1XLsswWkxy2lRq2czAt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:OXYfDtczAtyxknw4FYnshx8OfVe247
TLSH
T18B75F12877D508F9EC6B8139CDB28511E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 951ab923dc30d61d17cf09518f47c5e98a45c8b9dff17fd772e53d6e56b90e01
MD5 baa2be9937b7330a3c93b6c85bbfef81
SHA1 3c4cbd7074a3a3d80d86b9d03f06ae7a72958256
SHA512 7f51ed904673a276779a52638c608426e54d292490f67bf16b29c18cda7b6ad3c07f1336d8c60217f9e50186bcd08f27fcb78773b84c198a45290aca5d54eea2
SSDEEP 24576:/0Le5ji0hmxFrM8yxknw4FYnshx8OfVe247:/Pji0Aryx4x8EVep
TLSH
T1D895AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3237b2129e77e448e8014ebc426fce84a4e269e04f0af03d78f5ace72c0d75f4
MD5 c867425de82f816aa2ace6fe3f302f6e
SHA1 0ddec1d926d71ad34b9dfca76600e5702837cad2
SHA512 6264b5dd0712468452b5a20343823042fcf96a70256680c905e7a539c6160dd068b62832e349559288d778a39823f4cf3397dca62dddf20f2f9b118353d6f2b8
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWE6q8wyu6yxknw4FYnshx8OfVe247:e/ezSC6vUzPvxHjy2x4x8EVep
TLSH
T103756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a2c72770dfcaa07f5b135cd820a701c3f5973f5fe11fc21c396b0a27a1187083
MD5 aa26c0fb7e11b21181deafeb17d10f26
SHA1 1a57405d130fe2551473072561cc29339573f9c9
SHA512 44db9dc1bf180d207105608cd86d44b28ddc5a7ffb0154d823ec4bd630668edf43532f468d9acdb731f81cc48dac03646b5b3121b2a6400bb9a4464f65bfbce2
SSDEEP 24576:5VbqPb88hv/l+6Byxknw4FYnshx8OfVe247:5VO88hXl+rx4x8EVep
TLSH
T140559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 1f23b05a9814381ef7543c8d9c15fcec033d87d90e1b4dcce8d11a65d0f8bb14
MD5 da1e280917779953ba7ca7b7d2bc937f
SHA1 6fc120e05b9eeb74ab3ae6d64c8878498a3a3bcc
SHA512 610faab4785ef2215332cd0950a1e24f9ca3bfd83de37ce1924df6b2287e7465877c0e5910c92e05b13f768c379eba034a298beceb36baac4233e93c796bee2d
SSDEEP 12288:WNg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WNgyxknw4FYnshx8OfVe247
TLSH
T15765237CA7DDA4E1FA5E15331A7172623616B9A4DA74C11BCB78B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 39250f06ad8bfd16f90c8817e2a611574dbd02deb37f9311e36347fa4bd46f19
MD5 03ef4350b5fe31eed8e574a94d569fee
SHA1 ac866241fcdda55409228971bfcafd6bced74193
SHA512 90f90f5618099dde35ad7d9947b883287232fea2ad4aa37db5272ca9e637a259e047a52d75a1957d1a76d4e8b08bf58d015a2d02162a0a32150e87d2642f09b5
SSDEEP 12288:zeBNUbTVO86Up+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zJIUpyxknw4FYnshx8OfVe247
TLSH
T1F675CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8eddbb9f41bc32058fa0373a62a27a174358b86252d8d011b37daf59b69d87f6
MD5 48865f38348afc0ce0847f3d4f4fb74f
SHA1 9445c46beee999b3e0361db6f0e20937500b3c5c
SHA512 b0a69eb35a5a2313bb97c1a25a0b6bd2b3040dc15ae87480ffbdb92390c70f133e6e604e881447967798237aa118a6236943001aca3fbbcc17ebb1c63d9e07ca
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THq:FQvGAdlCEL8c/yRNw5Clix8EVy
TLSH
T179267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 4663d0ed12036cccf11c8fdb4524df46009732b2f2afcaabf414d91e0f17b33a
MD5 31790251c7a8d86b6e73c722c86cddd6
SHA1 929e273b69291b7b11dfe051eef8e98cc0357d7a
SHA512 3880ff205c3241c10321bb980e4ebb89a6d2673a58aeb91af0eed99ddce244f5a838e135b9bb8b7536b82d6fdc61cc6474c0bae846398a8bd0f887312d186cda
SSDEEP 12288:CAwSfxL/2Dc3LDLLmt0LDQewsAj3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:H6ewsAj3yxknw4FYnshx8OfVe247
TLSH
T17485E030FE74E032C6BF0DB21B36D716142DB9604F611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4b868e406642f7cbca7af4fe9adcb34aafff7f6022f0e84699f8fb98b59a26cd
MD5 532ff6f623df72f557db8652a0f98eed
SHA1 51349af26ab9cbd7f43d97949ada294775c8e0b2
SHA512 0808fc36b0dfec1c6b5d3abc18c0f4509ed77f0a714160e4a06efdb8ed3a8746acdd873c080a01befee7a65ac2c45e3affbc42281dd0c52152d0d38c12c47c4f
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH/:6UEtQevvqc2W1cpV2EI32
TLSH
T17B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 43ce805d9f004a11b29e7b3e46f9204f837f566e03aa8af5ffd225dd8240a54d
MD5 6fa48b2a56a999467372c22d45038d6e
SHA1 8407fd2af4946f445131fbc83a8d1cac69c8afb7
SHA512 4665686de4c8e4f1bafd58264422e8d757ddd81088c9523126be470d0073d096b39654c753d1c679a70ae3e3435dd6531211e2ea284d329287527c09d7011f98
SSDEEP 49152:0CbRquA/m2yL5zQfFiV+XenmE3/zix4x8EVep:doqtVjnmJix8EVy
TLSH
T195D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 230efd812bf98a0856c8a9b21c1b23fad130fb413303fe27fcb165afe3606786
MD5 25b00d812c13e5f5d3752e9bc6e3b39c
SHA1 9f3be2f1b5a8796bb9efc7ba9e3188047f95f816
SHA512 97d5567b49cbbe3988414823bd4536d59effb7b0f86c908d5f94ad5a276c1cbf9b9f69d95dd4093696f049cb9b435644efb65a9736941f583a4d33777112302f
SSDEEP 24576:FAhGLJIFoiwtA5l7S532yxknw4FYnshx8OfVe247:FAMyFoiq5Zx4x8EVep
TLSH
T19535AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 a35985bb1936078b6cf85447c210b11d10c71f0812518afc938a12954a0cb030
MD5 5a1c367f67facf21db9c9e80e9e0b457
SHA1 599ebfb98d86ac7e9edc18f92603a81bde88c52b
SHA512 77d0741ad4561065fbda544379be5e46282ddb3bc33a4233c2a673fd5c9edfd4fc95624006d534f0973db3f721eb3176fa4ad8a0c6c7e8bb97b365c4ddd5e557
SSDEEP 12288:dmw5HEjsChNoBFgl0WDm+Ca+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:YwuFOWTyxknw4FYnshx8OfVe247
TLSH
T1C575F14977E91CF9E96741398697D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 cc8304ed4a771a5922fd7e32a3e80e17a96f3fdd3e8db82878fb57528c317454
MD5 e1ceef7c8ddd03d8e7384ce3f521cfa2
SHA1 1901b1f8e0b846edcecee611cd6b79c9acd8afb7
SHA512 ec17e3fffb007938b457fd08860f09962662a54b77aa6cfb2f2a6888e620c2406b35e20bc8c9371bf9ab89af8a6ef129c3db415922c6ccbef6638c3f0bb5064d
SSDEEP 12288:RFZ1IyH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7ZuEyxknw4FYnshx8OfVe247
TLSH
T1396512AC33E860F1E1A7113A89F15205E76274A2677183CF4764A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 91ec079e3847801eb415d59a9380d7bb4900678b0fefb7e9f28830c3966598f3
MD5 3845b806d0a23e810d8b2fb8179086d9
SHA1 36400066311cd75e3abb04fb45c12cc908084b13
SHA512 1ed594374aa36691442e9ad051f62ea294eb6b36527042accd6f90bcd73edb43d18e33cacda8bfb735a3e927f2900ba9f07c9c602464e1d6a37bd542c9f0c8db
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:rQRQyi36YOcPQLvw2gAf+PN3gix8EVy
TLSH
T164667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e9611a5dd8177f15087e39c220bfc3bf2989e85ba29c68653fb4d5e7d374311e
MD5 7945009fb0e6ac90c7a11f84536bb6ad
SHA1 2b542880e98871b26e194882058d3070f71b751a
SHA512 39a988c9a1ed3434a80081f8c7d933f7a2d63432b19f86866a9a9d47c6043ab9a5a99b8c5ffceb756af87a8b19089fd8f276d2ac6d4423f67400547ad08b039f
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:6QRQyi36YOcPQLvw2gAf+PN3gix8EVy
TLSH
T194667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 170cf310063d2cae32c9889feee85ff41967598eb1cd5c0e1d516ae91d79fc9b
MD5 f4add38a374f3bb7462a3cbf8e1578e0
SHA1 863b0f76298cca1d48c38d4e6b05f97508a3ce43
SHA512 d330f526b0062ff982099c42385cdecb70c0e0252737cc337b60174a1d73fc0e2920c65b1e31b6cc5f99c28016af814eddc6ef203d45afe193d57dc534564fa7
SSDEEP 24576:IwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL00yxknw4FYnshx8Z:O68Qg55nhheWu7PNU3/yx4x8EVep
TLSH
T146B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 da6db60b990744b748caec33149ad6ab7ec49a2a2dc4f50d6633812e8195d6c2
MD5 6d8b495be41c3950dc56803f32a02161
SHA1 36f0dae60384975a4148f9d3a41b3d9ac9dd5709
SHA512 d55369076bea30677c530ea17cd67f813250ea571be326593ba7b69d944bce7dd9e7b2eb5d1ce114ce3d0db0203529177d89b615661138ad824ede8f2fa07054
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:Ry5112gYy5azzVvL69nLKnhZjix8EVy
TLSH
T1C2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4d0c14db4418e5903c90e8ceef9440c14fec91baa151553fb92732fc0a1bf06d
MD5 aa0b20b7e8a7334874d1f5dee4235e51
SHA1 a13d1cd74d1e4d392d13cdcbb02cb2f5f745fcbe
SHA512 18990b72df5ecef605daf6c8e71526b614c765ba317703c403bbfaf2c217ec803bdcb2690e47900f74e2641aa28e55b79bef5e895c9e82a7aa241b17f42f706a
SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glIx4x8EVep:wu6JmVxd2dIix8EVy
TLSH
T14DD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 45501daae5bc2869458618aec9ce3536bb5b9c594f46cf97a7313754967db00a
MD5 9097d6a049475cd305798ccfb423006d
SHA1 8d063984d11e62ca6709822af465ea1a7982dd74
SHA512 7a21fb8b315ef3b53289f2ecd8be34eeb2f081a7e300dd9a02b8fe8c65beb25d10f103d537448d4231f88c544a8dab4d77429f1115840aa7857613413789e81c
SSDEEP 49152:C1hpsNoJpF1A6UU44CwH7R4xMx4x8EVep:CmifPbRJix8EVy
TLSH
T1B3B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2abaa1231988dd661ae5d8fd288fe5d6375dedff9152050aafbfd793af009180
MD5 4b594c5c4059836b585fee1f58b712cf
SHA1 89ff495d9054a64b803fa2d1cd15f00b6cbf89e1
SHA512 77626e090913ae29d004b6a251792196883a8febff44c8f4029e59719f5496bfb55682d67538c7add2a446c3942d7e7960bb214e5e0ca56429cc721c666c0e92
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHqfx4x8EVep:q5dKTi61fix8EVy
TLSH
T17FC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 228a0201b5b3df4679776590d031661d78b0b9b0a913c60f366be7d4991d2d53
MD5 0c217576d06688f0ffc8896ba88a3872
SHA1 7314bf8843ade39e83ece0dbcb87353c087b669d
SHA512 fde45649e4e844259945a919ae57d229118fa5c6d2fce40e198a427185fdd669a1c3edd5645d21ac176250825a40b0f45a776ad5d4dc279a4a4b51bfdd25ca3f
SSDEEP 49152:9htSn8EApI0figngiDn0AP5wYx4x8EVep:sX2iyphdix8EVy
TLSH
T13095BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 e167014ea2f840c1819cea3f1ac97fd61f2672bb6fd64c9c2281a1eed1629f8d
MD5 f36f0444c230e69ae2e36d315313cafb
SHA1 8d896a8fc669c4c1ba70900cdc86697c3a647964
SHA512 343727b037e9d1eb4e69b941743af0007ae04a5b18d3b3b06390331c981c99da07dd3fd3e1fed448aa445e4c1bd2d4ca26ae099d69ffcb9402432340c9455f03
SSDEEP 12288:DI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DIyxknw4FYnshx8OfVe247
TLSH
T1286523BCBBDE95E2F50D11734A7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 a5c180134a43540c1a74d319c82ec2741d2465ce177bfcbe97e8dbbabef70892
MD5 415d99545706e913b9432031715f7638
SHA1 ffd649c78d82798e5083977df2d275a09895aad6
SHA512 e7676dfaed5ff20c536cada920577e515e5ade7512e8fd16a873a42705923000eb77aa0d3c61fac1500c2022a9df0b0edfbc50767145e10c1eba989b22e7e4b0
SSDEEP 12288:UL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ULyxknw4FYnshx8OfVe247
TLSH
T1AC65237CBBDE95E2F50D11734B7162626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 0d99dcf5f23aa57eedf8071db3ea164bebddf3f8f16164c2a9c230d6c4b40950
MD5 f6f6820f444cf6c98095901fce167297
SHA1 9050277f64a440c9e82c1d94c16ff1e796c8ecff
SHA512 cd938303a3be4a809b8047b78bb6c81b6cee342e5166f2a25cf63fd8b5aa743e3ac20beb2e5b89a251ec62f18ccfe08e0b9aa63accb7cf6b295fcc2dee191a73
SSDEEP 12288:Mx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Mxyxknw4FYnshx8OfVe247
TLSH
T17165237CBBDE95D2F50D11734B7163626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 35487c0d0e538dbe1840e09baa1bc6728a9ccb820a137ee520e86c0b3ced1e0c
MD5 66232f7cc73ebf1fcbb56f922da1dfa5
SHA1 40c7f9ce6e3040960864661cb844b7b823416d32
SHA512 d4ebe3ef0b6b0034273efa4fd0a0b7a4c11c867c4d9a7ef03bbb8a3f66bcb68a05e81fd1bcc5a783021fdf9c3306e4485fee00cf6db353c932fcf42544128a00
SSDEEP 12288:dVW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+yxknw4FYnshx8OfVe247
TLSH
T16865237C77EE50D1E85A51738A716222B365B8E5EB31C35FCB24710EE9B0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 eb81158ea2ad222b2fd9b0133cafb2e5ca96d2f853b4ca6097a36124748274a0
MD5 1d215e72f6e63cf2d7a00d0fb58502a5
SHA1 5d6021b539ccfab12a8f499071693079aa28de08
SHA512 31eb07e8388ea8963a705e9ac493c8bfac623edcfb1c31b671e6be209e44fef6bc94850f30e8a1621cc1621317167a263f0797b569b41c5719c9c9f25ffdb0c5
SSDEEP 12288:Su+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Suyxknw4FYnshx8OfVe247
TLSH
T1A765237CBBDE95D2F50D11734B7263627609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 418d24904f783867d51f91b2c6a38017cdae8a0d07119e852ee15126e48b7c42
MD5 2f6ad6a53a5ddc2b3f0b2dc80057eb9a
SHA1 958eabe4f07d8af229194febbf97056ab24c3f8a
SHA512 6563883a7e3c421818fd00e4864b6fb06e1c9a31444409448a38033a5bca97215eeff532c994c66ec1eab090c37b55c546a7b7ae404e1e3a6c61a10add55dacb
SSDEEP 12288:n/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:n/yxknw4FYnshx8OfVe247
TLSH
T10065237CBBDE95E2F50D11734B7172626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 0240136e0152d653c60a04b1afbbcf8739c4b139f988b7e9735be060f1616e1a
MD5 0c2ba66623a46baee4004ae9b17d7f44
SHA1 8f226bb80143be424f83871d93475d6df3daabd1
SHA512 2d0bf2be0664383dad6014e89e252cb92f4b30fa0b2bb97309683a307f2e68f29f7e490c5ec1ab1aaf61f876e3e5249db4d5bb8b5487c3c5d4fcccff69999006
SSDEEP 12288:dD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dDyxknw4FYnshx8OfVe247
TLSH
T1DF65237CBBDA95E2F50D11734B7173626609B5A5EA71821BCB7DB00EF1F0C60A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 7971ed83eb4ff0bf47bc2b17ff82acb6eac12a17e55a03ba9ddb7b47ed99a07a
MD5 06da8f74d91d1c2cf4ea3eb6429f685a
SHA1 57dcb388fd12d6f6388c6e6ad4820b38bf762359
SHA512 4e6fd29319aba098e04c8596806a85b552318377c98b6cc60bd90e8672075505783bdbd599bab41392d1b10de6bc686e4eb510c3262ca9b25ba640998d92bd33
SSDEEP 12288:6iZwbZzzFEoS2cPvyr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dZMdzFVSOryxknw4FYnshx8OfVe247
TLSH
T1C97502A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 2dcc13cb16b3a506e204581c6357309f8c3e053f67164205deb51825bceca980
MD5 b5a86331a667242b2a3fa14dae31591c
SHA1 0bca7b046ec15ab603b9df89528a2bbf88a52b22
SHA512 a1f01aa0c346d65d8da9ebbec22b3eae00f5862e8bc5da14aa35ecec69e685f45e7c7cebcbb1c0fd94e98e5e2466404f9eabc723fb9038c2ea87173b57d524bb
SSDEEP 12288:WU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WUyxknw4FYnshx8OfVe247
TLSH
T10D65237CBBDE95D2F50D11734B7163626609B5E6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 87be8baeaf61d63ce90f6b0c75c1bd915b8989caad1e262c9be79affc9a1c8b0
MD5 296c986965fb3eae75d649930379ec81
SHA1 ee5d9376733e602c1729b4a6017dcafdf9854759
SHA512 a1d52078182ec55e68bc479d159906ee8de8b925dc754b7765bba1ad0f32679effb09a85306433ff1d1137ea078699378ae89dd33fca779222e8defcb0fefc28
SSDEEP 12288:7w+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7wyxknw4FYnshx8OfVe247
TLSH
T13665237CBBDE95D2F50D11734B7163626609B6A6EA71821BCB7DB00EF1F0C60A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 5349a8ec236dbfc3c43b3f0c21f895139b4ebb5c04b6d568ca3d16061b22ca65
MD5 7b1621b004de6bdf9592527467ac5061
SHA1 ea80f1b46897152ee6c6bf88e6cce5dbdb8fbd55
SHA512 0a59a88a2953ea123466053f76c621c33b033bb4939f0203ff8c968e0f9f746c7d58a7150e0673cdd6a2116b11d7c389d3a3d4b752cca6818aa689f37342803b
SSDEEP 12288:hyPz5L8H+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wzyHyxknw4FYnshx8OfVe247
TLSH
T1C775125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 b39a9ba05154560f3c20e308c515387bfce0d2caf0ae986717b5ae210cb5b46b
MD5 eedd14a2019dbc447c75de68ab97e613
SHA1 0c785b80a950c347ce658f095054c23adc76adf7
SHA512 1096849104c6aa1e9c7d0a85126aa23eb0cf7434955ad2defab05adab545e264c09620cb3d0935e2b986c872169a5284f73eaf6d54d11b9c1f046f282563d5d6
SSDEEP 12288:nU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nUyxknw4FYnshx8OfVe247
TLSH
T10B6523BCBBDE95D2F50D11734B7163626609B5E6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 b98fca2aa6068d9431f8774cdd8359f4d514b367f733650e48d0364f872ce027
MD5 d74f5dc7f12b91b451160d2fbabf92f6
SHA1 605d51e237dbf6fe6181528463cc33fa5abee831
SHA512 5459bfa26e2e10f15d9144ca56d88bdf81ff6ddf5040a499fd3d0cc79292147f40694b332529c6c3930a03069b80e0f2efa01211b1dcde2d76ff4015f327971e
SSDEEP 12288:7U+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7Uyxknw4FYnshx8OfVe247
TLSH
T19B65237CBBDEA4D2F50D11734B7163666609B5E6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f6381689b537e27411e8738301d143f186d3ce9b1604fc60cef17937d6e052e3
MD5 7b4d988f08b1fa9bca85388a254e0bf7
SHA1 78b356b03ce8976775d6d273cc78102ac85bcc9a
SHA512 a1e1a39fac40dc7adb01dbd04fde02db6be432a7e82219aee1773d8182d05d9ecb442ac333503543565458f2f606bd03304b638fd1029d1b7a71a448c148d099
SSDEEP 12288:8yPz5L8H+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lzyHyxknw4FYnshx8OfVe247
TLSH
T15B75125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 20cfad243d5b3395924b2d16cbe7dccf2c902ab3648e0d2c0f79f8cade704c2e
MD5 663edb69d9ec550f8199112303d7dfe9
SHA1 7fd25251e92cedee0e3b07e3d54a28968d52178a
SHA512 c696cbdf216450f81159eafd276686847506c17918ee47125602ce03a3dd9639dfd705e0cb4babac55c976d4a0639ff88b99ce7b09b9b6813b8dd01b349ae04d
SSDEEP 24576:7TGaLl3z0zDhyxknw4FYnshx8OfVe247:7TFLljVx4x8EVep
TLSH
T1947502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 9487d6c4fc978b665b594f8992ad4d6e2e1e8a0c40c4d82631ab2720e3c5fda4
MD5 b18112db84e1f0a113b9ddc3af3a4767
SHA1 7bc4704ee919b9995c4b2cbb72e64b85caca847f
SHA512 2ed1714ea2fb996d52fe3d29f629e6b7cd18ffad7e10c669f3b6f3b1614530bd6fc17970402aee0ce30e4e5a6c648bba2d1f5282ddb0b9290d726ec94575929b
SSDEEP 24576:23nd9CHKy7GZ1yxknw4FYnshx8OfVe247:Ynd9CHKya6x4x8EVep
TLSH
T1FD95DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 989a8065d7590340704ef8a8bf9d24a2c9723bda3b95de316fe7a8771b92d7bb
MD5 9ce6aafba8df3f3395b95cf213a41914
SHA1 d243dbbaa21446ee153a05dc6283e42fb50d27d7
SHA512 976546f6f6b86b9369c9edea0de7a63a43dfd84c84da9b5c53ec734b89c04cc78e7feb39118114a3b122f091b0b1a52163936f2ac684c4a629eecf8a424c9b4f
SSDEEP 12288:FR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FRyxknw4FYnshx8OfVe247
TLSH
T12D65237CBBDEA5D2F50D11734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 808de2bcfab3a6309ac46efbfef1bbdc67d24469c683d6184a6fd2ee1eed5635
MD5 ac1b47efc0303ea41b37a7a87baf3406
SHA1 80797ba8932fec6e8dfbedaf4cad2f42803db0ce
SHA512 61d4074199048992b2bdd3ef0af5e43f347c3e1a5cd17ef97c98328e0a577f4f9d40a41bf4a891719fbb880b770e17e1099c5460d51b2ae549d87ae82cd1c41f
SSDEEP 12288:Hn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Hnyxknw4FYnshx8OfVe247
TLSH
T15665237CBBEA95E2F50D11734B7163627609B5A5EA71821BCB7DB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 aaa8b7202888793737e40081bc10d126653f6cce89de533e4b8d6ce0e133d7d3
MD5 7d445c792eabc707dcf6cda8e159d84e
SHA1 bca9099c0a46d1c75e6532362b32c7dcf0101eba
SHA512 cf2c5b8a1c64a0a6141472fb2a81f0845cc942ac0a061e3b9055cc93093c0834374c08b11bf39c5ba9ada13c23b4e15d51d4b6b6bf6138b329d1fa43b24baf4f
SSDEEP 12288:yy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yyyxknw4FYnshx8OfVe247
TLSH
T1BE6523BCBBDE94E2F50D11734B7163626509B5E6EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 40a71b45e9e076736b22573fe59ccf9d52f0d64a2ddcb9a810b0c350a29e1da2
MD5 5710ed9de5cfe0c4c6e2950f925ba435
SHA1 3613e5eca0314b483043534dcdab68a1475a2122
SHA512 f2e90fe3b1910919bbea522df0e1b9ae4a92d6f2894f0f1e9a6307ef4d3e96739b5e0a08236b1754251f5ba0a9d860f4a3106b3efc3b531072f872b70692cae1
SSDEEP 12288:nU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nUyxknw4FYnshx8OfVe247
TLSH
T11765237CBBDE95E2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 f6f7e7a49bad46f8e588ab3d2d254c6a0b4f31b6481b1628db72acf33f59b236
MD5 25146bd1c5cc521ec45f288a13fa08b7
SHA1 c02e5186ae9255d2ccc25bc8446afd3ef7e4c110
SHA512 18c8e40b0a322b64eedeaf21fb6cd88756eaf03e84584b9ba89519fbd1b87162f7547b5407465ece70372d8d85ff85978ce155fb66f6260329ec2010e75f18d1
SSDEEP 12288:iR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iRyxknw4FYnshx8OfVe247
TLSH
T11665237CBBDE95D2F50D11734B7163626609B5A6EA71811BCB6DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 ced3dc6c5482d4637d451188ab3055e556c235ef0c03193594a82d996d9ea1e7
MD5 ae3b6c11bc87749dd91c2732306e5c6f
SHA1 739688c15bd5c6c10df558568107d7a447599f24
SHA512 58122f7ac33236a8277f859973b11a4a5e7794dc4caa3fada0739308b957107d46e42c3193620a9d4bf27944bbf34aa401ca5eb18acf90b3e4af7d5b357f810f
SSDEEP 12288:fs+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fsyxknw4FYnshx8OfVe247
TLSH
T10265237CBBDE95D2E50D01734B7163626A09B5E5EA72821BCB7DB10EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 d4ad5cdd7b38e613882e08fa53abd16b4bc869bb03bcc1d10e1bff9307a47417
MD5 b59b6f6420403e130e7732cc29ef0ca9
SHA1 24089fdc46f65c6e65dabe4788606176f1357590
SHA512 51967bb2f77d4123891591b1840799ee91b2b776435797df85e21c065fcdf5d3449799f5a00209fbde3c1c4710cf5d55d26cbf8e622322892941ae079afd75d8
SSDEEP 12288:eu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:euyxknw4FYnshx8OfVe247
TLSH
T1FD65237CBBDE95E2F50D11734B7163627609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 aaff567fa41297fac937325101b9bf16e2a38dfbd5261eb92d2fb7c1e0e9a8e8
MD5 a6c1ad929fb89a41d22b921bf6addcbb
SHA1 b7048706458b3199909f91bd3d6a71bfcae4fe6d
SHA512 2ab159fc50d0c1cb12be1a2f4bdc1eca7e88d281aacd3b11b8e24f1c2346a173212daa071b044bd55268d5b77c079e942a4ca9c2b712d22c94dc1c81d98a0744
SSDEEP 24576:BfwvJk9RX6wkyAIAyxknw4FYnshx8OfVe247:mMnYIDx4x8EVep
TLSH
T1EE95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1d1543d095c622769f22c71304bc5a2133529d88a4dad0da9e8961df0fc1d3bf
MD5 743365cbd5586939fe0ba5a2be34474b
SHA1 8221087eefe0efa4fe9661faf38ed1e84e1b52b2
SHA512 2fb409a9f83ff017056f52f73c3c179ecd5dea9df2d0931b8b8ea18f8eea6a0f8e4d128ea79bf5459ccf58938a22a47c648b5316ad279c6883bd52ad79c9174c
SSDEEP 49152:SYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04x4x8EVep:MySzPAix8EVy
TLSH
T10A066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 19f8980fa272ab2b340fe26df143e72bff265b1c47e5c829cc6c3448f2940b3c
MD5 1b9df83adeba56d8ef72ed863dab7f64
SHA1 12c375ac07a09de6b6a26a6ece54b46b191070c8
SHA512 9d4336a99db6b87cc49212aa242fdecf09d164a2f6615b65c4f34b3bb16fa81e1c558a00134f2ce47677d03470769c408e9fc829fc10289faa7a22afee38161a
SSDEEP 24576:e47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY7yxknw4FYnshx8OfVe247:e47JUQj1irIhCnDHUPfF/Ix4x8EVep
TLSH
T11665AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 23196c824220cd340b94dfe4c75c32e58e8e27f418c37b8a6cd8e59234cc34c9
MD5 a45c753ab8ba79780ea6dd6c2fcff9cc
SHA1 f87adaa11678e50e6346bfec623ffd7eebb21b90
SHA512 999659f1c80cbaf5b20b677c04cea8b527cfb6e29af75a2413469026105aa93d49176fd159c66d3d35e268c4a3a81b04d038acbc146a607584f56230e9bea8eb
SSDEEP 12288:o+sfE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oEyxknw4FYnshx8OfVe247
TLSH
T11075F028E29802E4D06E2276CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 960KB
SHA256 5379bc325c08b5b75694d475d2b4c4474de12007da9aea8cdb64145d8ef5412c
MD5 7088587231942080c9107dfb0668c49b
SHA1 c9d18f1b707bd3c6fec2d5d6f17d785830cbac27
SHA512 ee71735a3f879e3b20b290bf5e6936cc5cf3aeab25cb31090aa687a2b4dc082f269598ff6a4453f20e3cb03467a4aa7e7f627b85f03228b4cbdcc1d27d65e787
SSDEEP 6144:NYsBC2naEE9pR9yMDcbPotMx+IV1U3fUk6RmbqLrIUNAm3yGiqkW2Zm9OtnSdd1i:NZ8qpU3f32L5NAmCGiYOtgLlO5Qzy+
TLSH
T118251800766AD75FC6AD40321E36D5CCAB707D01EE05AB0372C8972FD57666CBAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 cc512f4ea46c46b92bf228785f120310b46c00534d6513bb317de88e778beb39
MD5 9a0e1eeb34b80acede0d89d05c460f26
SHA1 ae0a2ce06251c4cb6610e0144434813ccf35639f
SHA512 e27aa24c9f64cfb9139f3d689b83cddcd1106a177be3e7dcf97f8e48b2c6b1538228d55d1abfbca2088bfbfb77c90d4b838f53fab7335010dcdd61cd2bbdb92b
SSDEEP 12288:7UPh2Sg5wC5/4igp1o6nX5e/UJGi5e5CKtbMG8VyGdW/JAiDA7jjsIxwnrNtJMA9:55TJMA
TLSH
T17E45B681A137A3DBD1FB6071472A5B4CAB64EC4673095F2673C8053AD82BB25A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 f44fc0c7608eedc28c03c71a8d27c7839e1948c30094dcae96fcccc93e311a2c
MD5 9d812edcb453af188e9b98d7752406a9
SHA1 a8dfb3ccb25f9cf2a5bf73d6568d642a9d835702
SHA512 48c97a6afc816a7bbe9600179cd2632c079efc321f359ded87bf6b3650bc53822fcef7361dad5103a7e7c860784ec19d95e8d30df0fc7e0874f2cb05496b5a5c
SSDEEP 12288:Q47c+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Vcyxknw4FYnshx8OfVe247
TLSH
T15765237CA7DEA992F86D11730676A221360AB5B49F70C1DBD728B14EE0B0CD0D83E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c2fae862cd6e7a2050dfd16b049ff4120158d8b86aa07d49cc8abe55365ff772
MD5 4c327144fdbccbc2ae1d224321b9bf41
SHA1 a2800edc212f8c43fc02c69987b4e0b5cba1dd23
SHA512 60f4279d17ac4d92f873a0cee6a6e09e0dbac321c4a51224abd8d4a197b5815587bcb5f09d849cd75b38e42cd96fdbd165c9cebd5e047b302c1c3e10b995ace7
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bY6yxknw4FYnshx8OfVe247:zgb4mBIBhGFex4x8EVep
TLSH
T19165AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 a4887706fa0a5b7d4992688700e687fee83e57168c6b41a66bcdbf5b391b67b3
MD5 60841bd68bc2d72c8d5777095050c4d0
SHA1 1e8087259642449fd81758a1f158014b2e743826
SHA512 919a67070230961ab44abf041908c342fb828d710c46f45edd30efca31a9408787b190e552ef5b573485f019700c8d372f6ce047157876b68c6f39ea2ead99e3
SSDEEP 24576:zG88u8FpJqH1Kzria7/mryxknw4FYnshx8OfVe247:C7ZFPqVVa7/Nx4x8EVep
TLSH
T15A95F16977E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 18ecc7df60d18e7afe7fb46695ded69539a5b34fa5185d3ee184afe28ad4265a
MD5 948a5223431aeafd3c147441e2bd3b96
SHA1 77f02329a98ba5e5b2f0ee1a8969c7f1d3797779
SHA512 0f5e3892e170d703824ee81bf559ce2d1a372d9684ff8a568579f92401c0db18ae7e758efb295ae473bc8c16260f960396d66b8107ce4446dcda2600e07cf337
SSDEEP 12288:2HvUrBFrEjwaQP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2PUr+NQPyxknw4FYnshx8OfVe247
TLSH
T1D675F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e7b0d57b02628a84c8f22b6a33bf07be3a9203b1932db66a0a854c591f0bc601
MD5 703757f1010a7d5f20e88c2ebe17bab1
SHA1 1bd8387df7ddaa02b56e2c20a2955c56d19343b0
SHA512 ceb0739d54d8b72e0264e75d3b9962567da0b4ef0fe10ffa4681cfe5e1b5077375731bad35ab5f9858a3ecc5f83ce6bb818275abcf12aa80a99dcfee65448c8f
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjqx4x8EVep:fG05lO43b7ix8EVy
TLSH
T111D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5b7f7f768cb3364b170ad7ae505ea7b37961db260279ef942bc3bc219cad5033
MD5 2b8852102a7c6798d60fbd940029698c
SHA1 1056d5af67aded4655b233f04e86f97d7a50be66
SHA512 701e4a26a8ae7c1db26e2586779ac8c65627f736708186614f2445bd920c8c7324934cbc28a40ea9fcd59feaa2ea897c30b5b4d1f494554e16b276868f71847b
SSDEEP 24576:0fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnNyxknw4FYnshx8OfVe247:sa5POZ3+Jt2pasx2+myx4x8EVep
TLSH
T10D65AF5DA6FC01D5E5B9D17DC583461AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ceba31b46a9ef09d718b8966316e72b3fdcb5732aa43b626b9277b1f81e596a4
MD5 f608ae2a955e70c941f9744f86f2496d
SHA1 981cb02cd993040ebae9b201f99ef3ab50dbd656
SHA512 6053771aacf50c9b9dfcd017836dc2f625a870e44a0cc2ff5af97a2ff6787947af4a4a50cdf4ec9d6162516982ecf3dea3ea5c8ba0cd882ca38f3c0f706bf63b
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7Fkzyxknw4FYnshx8OfVe247:UNc/zEOVHFtx4x8EVep
TLSH
T1F4857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 eac29c272b483a10f2bdb2e4c50ad8c48d3a1f1cd12650a5e9b45ef8bf1a4622
MD5 c2f78c2253124736b8d6bfe1603c571b
SHA1 626db1c1239f3df4ebcc0236ef929461d32028bf
SHA512 5b7b8d00f2bb926dd43aa1f19149218143a3993676049165d13098da7c2998c2317c84bdfaa713437f385fd6b2e0101229db445ae8fe479ffd003fc7e8e173ab
SSDEEP 24576:Q8kNvNnaFeYhJNtmZBm5yxknw4FYnshx8OfVe247:Q8MwBtOm8x4x8EVep
TLSH
T17F55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 edc74b8ada55baadcd03958da5657464677235f63afc2d7a90461bd9d22e887a
MD5 ed7911fd021c9cac570dc6071e991c1a
SHA1 7c4a1607ddedb65a875bc25cb40c6fd6409b0688
SHA512 8a71dcacc0847e976f9bff70914bf4551fcd3416e7b18ba172fb87f882c5b15d783c40490e04b6cc5a96641d59525dee8e8b95e1b04a5ff77b1056a9a757431b
SSDEEP 24576:TD3FHshBIYQgAoyxknw4FYnshx8OfVe247:TDVHeBIAALx4x8EVep
TLSH
T19A85E17DE79C04E4E57AC1BC8A638606E77138A9033256CB029491BA5F67EE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1828-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1828-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1828-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1828-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1876-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1876-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1876-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1876-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2144-112-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2144-114-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2144-311-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2144-120-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2444-395-0x00000211ECCE0000-0x00000211ECF28000-memory.dmp

Download

memory/2444-326-0x00000211ECCE0000-0x00000211ECF28000-memory.dmp

Download

memory/3144-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3144-132-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3144-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3144-126-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3144-135-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3240-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3240-271-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/3240-53-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/3240-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3692-44-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3692-49-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3692-37-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3692-43-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3692-45-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/3692-51-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3956-64-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/3956-72-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3956-66-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3956-293-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4292-0-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/4292-76-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/4292-6-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/4292-1-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/4292-7-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/4524-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4524-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-312-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4524-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4532-78-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/4532-83-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/4532-307-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4532-77-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5288-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5288-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5288-94-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5288-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5288-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5288-327-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5544-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5544-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5544-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5544-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download