57ed9e075edc92436fa7071cc81e13fd3852c6504296aba0fe82693ddce321ff

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.5MB
Sample260803-m6ssqaxtbw
SHA256 57ed9e075edc92436fa7071cc81e13fd3852c6504296aba0fe82693ddce321ff
MD5 c64efa8a83f9ba5c4fcab026a7363f64
SHA1 aa7749dfbfd5d967a4eb4234fe131ea8833ea3d3
SHA512 9f9b3f8fe0246f751f777f1958ff4f3e4a30a569d51e26c5a050a619da431bf209cd1ef7f1b8ad7e32267049c6b51067229f01652fcc5695f48cd11e7844a79f
SSDEEP 49152:nrxRP9sg+UqVks+JwLNiXicJFFRGNzj3:n3MRVkS7wRGpj3
TLSH
T167756B1277F99179F1F37BB19EB883645A77BC71AE39C50E6280215E09B4A40DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4296	elevation_service.exe
2460	elevation_service.exe
2028	maintenanceservice.exe
3044	OSE.EXE
4800	PerceptionSimulationService.exe
264	perfhost.exe
3232	ReFsDedupSvc.exe
2344	SensorDataService.exe
2388	ssh-agent.exe
472	AgentService.exe
2260	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a4845c9d209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a4aaffa3723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000292d6fa3723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000984c33f93723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5ccf0fb3723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4296	elevation_service.exe
4296	elevation_service.exe
4296	elevation_service.exe
4296	elevation_service.exe
4296	elevation_service.exe
4296	elevation_service.exe
4296	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe
2460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4288	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	472	AgentService.exe
Token: SeBackupPrivilege	3232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3232	ReFsDedupSvc.exe
Token: 33	2260	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeDebugPrivilege	4296	elevation_service.exe
Token: SeDebugPrivilege	2460	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4288	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 4780	2260	SearchIndexer.exe	101
PID 2260 wrote to memory of 3568	2260	SearchIndexer.exe	102
PID 2260 wrote to memory of 3088	2260	SearchIndexer.exe	103
PID 2260 wrote to memory of 5140	2260	SearchIndexer.exe	104
PID 2260 wrote to memory of 3272	2260	SearchIndexer.exe	106
PID 2260 wrote to memory of 4668	2260	SearchIndexer.exe	107
PID 2260 wrote to memory of 4504	2260	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2028

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3044

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:264

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2344

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2388

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:472

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4780
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5140
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0d0f86f8ca54236bc0086f406bf5ac1aaa437b6976e309caba6aca71a9abf97a
MD5 ff963061ccbcb7400a9cfcab81423e5d
SHA1 7be6191f259740582165c770f06ac16d661bd2c2
SHA512 7f1de5462b985e04446746a997f48135d1845e662a40d7270d125e771835ab4920893901ec043b905656f20c7ee09fb1c69fda0a49e52d2e5d219a7ad8539fe7
SSDEEP 49152:jb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnVLNiXicJFFRGNzj3:B3q6mjB67wRGpj3
TLSH
T121D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 207a8c6cc8eb8205ef12853d1700dad5b3eee79bf0c8151e7a78e06c92e4d075
MD5 ce2fb713feb8337f067b3bd9392f5d0f
SHA1 e400e364e25f323d841aff3977ad65b0a0cabb19
SHA512 ea5bf8686cfdc6d62ab488977112a0193e01de6b71b361c4d2d65e4268d7e87b1f77a21a365bb3aecc302c59142cf879e2ed47091f52de28fdbe741853e22f0d
SSDEEP 24576:YXYfDtczAe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PtcbLNiXicJFFRGNzj3
TLSH
T16B75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 323e5664eef65d2cefcde258d028d3d66ac1245bc93330c24b7a6a0756e31637
MD5 e9989d2756cc15e0358bba6521c0e06c
SHA1 a47dd77a6c9dc10340c5fc4eaa7e6c45f59724c4
SHA512 a5e9066c3715c6936bfaa0c52aac5cc6a1b8284d64dc0c05729cfb408e63fb19700c377c8de9ba19782da76367d094bcca36907815c887091e5f76da10c3dace
SSDEEP 24576:v0Le5ji0hmxhrMN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vPji0AzQLNiXicJFFRGNzj3
TLSH
T1C6859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 76635d22518763c62053c53ce3464fd0251e11e3b8c127f03dc928d95527b3e6
MD5 9d685a838588a39bada3aeb0a05397cb
SHA1 22c8c61435f27433f9bc4ed3b983b0ec06a1f2a4
SHA512 653bd3f1150146dc0fd0d8fe0b3aa87e8d993e2158589271ee504e01d519c9e6d9763c126a9216a2c7b747ef3d44dd2fcb6f56f414f3715b2c3d46c30ebf5b03
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWj6q8wyuL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9/ezSC6vUzPv+HjyELNiXicJFFRGNzj3
TLSH
T1AF756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c0b227ee3af547255c7bfc78351a108e736b314e2567ce1349df54c53c53a7cd
MD5 fc696d92d33fb6827ba4e4fc2d0bc331
SHA1 d61480e87c760d10c0840b2490f6ad9203b287de
SHA512 25bd846fca5067e8ec74d5273399bacf434f2d49775c24799370eee86178dc5d72522750674c3e17d718fa32475b56a8746e6e4630a4fce07d5d5d360dc42b31
SSDEEP 24576:RVbqPb88hv/l+Bq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RVO88hXl+wLNiXicJFFRGNzj3
TLSH
T150559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a6e6d24fb8567f8572c060f43878145a507dcb6aeceeac370c392f452a81cac8
MD5 9242c42712341e5a9105f5a66290ae3e
SHA1 fb1f9f1fdf585a731db229617184a765917f74f0
SHA512 2fbeb76c0decc68a9860c423f4e00af949d28ec10d206d17df204294302a054637641d5700afb01569eab65adac4270da343eadb7307df68df3cb81950cda90d
SSDEEP 24576:uGJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3LNiXicJFFRGNzj3
TLSH
T1495523D3468865B1FBFD0039867A5828B5845E2CCA595DE2D2503E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 1c632fe4e7215c16542407bd125a3afa592ef31cd9780c94f6d979d643e84467
MD5 739a946725e5c8c5136fc12e27f5f669
SHA1 bff0899a650a1b793209440f2900d14019b1f999
SHA512 4ee9c461b25380e60f0debc8a2f115c6a772c50606188f9f9f6af94837ce79198079ea3e2b773cad91606c9ebf26667a77816acaf70bb43185479d1ef988816f
SSDEEP 24576:TJIUi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TJIUiLNiXicJFFRGNzj3
TLSH
T18A75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b21341f871ee5228193266ac406024c84e3e90731e076e782e75e850a281ab6f
MD5 4e6524ce126d1739496766997599bd1b
SHA1 2c24d149dbe935f7cae3bf73cc8f551dc5b6cab3
SHA512 9e6d0d1a44368753adee6e0cec6317c7080e05aef2bc0e6f63f2edf16b05d743acd0c50ae632e519c24c3a5f8fdc602cd63a77303a8b3fd77bc55f3503e133db
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH8:gQvGAdlCEL8c/WRNw5C77wRGpj3
TLSH
T1D7266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 0dc9dc50834377a3a1b955bbdf2545df1250d2f1f8737959a1f63592b79d6c62
MD5 23f94e3ebf2c0155ba2c0ae491723fb9
SHA1 d44896508a81e6261f73a8e0677a055dc249eb50
SHA512 6a51cc64303a71cb75bfcfa70bb582df77b7aab546627f99c484180ad009487710a8605f5a3a0f07ef7bdc206f91e0d00b216c3d6e77bf21c160988537db2498
SSDEEP 24576:afewsAjA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AljALNiXicJFFRGNzj3
TLSH
T1C775E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ba258866861c87f405bc8a9bd4bef456809ac1f3846828fdec582039b8e34225
MD5 eda362b341cb1d1ddcab78ad044df108
SHA1 21bbede64c556dc7df2fd72c9319f58db9dddd6c
SHA512 e7ad6fbe0126d745028a2d96a791a5ec324342160e37553d9e78589865313a806182ca8fc20730e9b68c137d91d52e7fa4dc480b77cce0f5a568c6a7f0fa806c
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH0F9:0UEtQevvqc2W1cpV20I32o9
TLSH
T15A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6673c85e67cce7d665ccc0487d1c029de3b9dc0a72dc187157cca38aefd5485f
MD5 08411f5b07fe1644ccc3da85135d9156
SHA1 86a8b49e54148d58f163939b13966e1f18833cf6
SHA512 07734faa099f5a5a6be8161febdbdb284446b8acd38c79c9cd5f55d19d9643ed5af084f9b64a9f0926fbaebe332b33e005cfa17dfdd6bd3b7a8d8606e0d9ce85
SSDEEP 49152:DCbRquA/m2yL5zLfFiV+XenmE3/zgLNiXicJFFRGNzj3:8oq2Vjnmf7wRGpj3
TLSH
T1CCD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 236466cd57f55afc40db09932bac87678e701d68ead0d5045135a1f80d04c3cb
MD5 016f444c1e0eb77a7450a915497cb67e
SHA1 bde860d0a64c92493231f306c3fef7de149b155a
SHA512 5a8bae423ea2a5c8fd3020cf3948ce3baba58bc5303bba07d608d579a4d07fb16cfa6da5e3cbd1bc778b99d6b0827da4d35e6d60afd77ec6a839adefe90be9d0
SSDEEP 24576:4AhGL6IFoiwtA5l7S53//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4AM5Foiq5PLNiXicJFFRGNzj3
TLSH
T1E8359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b5c5c504149eb45ad5c4ac922d08fead03ddb65c5423fba9c530afd6050daaff
MD5 f82201db6bc50aefa7e399178a45a27d
SHA1 acf8e4eebd47fbc10c4b97f906fb075f6f632be2
SHA512 d186b341fa76e819c81a77aad8392e097405ce05821e6e970526d10f022f6a2124f5b84ec6453da978dcd8d00b76581f727e60f8993bdd17e44f81bcc4b5d340
SSDEEP 24576:twuROWk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:twSOjLNiXicJFFRGNzj3
TLSH
T11465F18632940CF9E9BA41398657C036F7F2BC152A25DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1506b56019aa18eb652aefbb9ea7cb050662670d19db303dc6679ae11bfb7dbe
MD5 b21318d5c606652dc78b7e71111a594b
SHA1 e6d80d329f7739618aacedc341c2e9a936fdd63e
SHA512 687199eeae462d07f27ea24aad3b033608a3e09110f82cc5237849d10034b0448e646aa80b1c67f2a1df0c24f7fbc7dc2305f1a19a7ce3b6a1319b5950a3f4ba
SSDEEP 24576:yZuF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lLNiXicJFFRGNzj3
TLSH
T1C555129622C820F5E6BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dc543f8c7deda4b04f08a85d25d19cf4fc89c8030499b6ad2f8d7ce9a387d74d
MD5 f192c88bfdd255c3b29fde9cb1104481
SHA1 27f0021296d5fd240c95287b7763b0d909d782e4
SHA512 b1acaea6f304b7b05ff886aa46b61a415726214aac23d1e0b1c2b43af8d3ccc2216aa3cfc3fbd5f7f681f56f12ea0cfe484ee5bddac02a1a85abcab64008e86c
SSDEEP 98304:6QRQyi36YOcPDLvw2gAf+PN327wRGpj3:xQyiKanX+PNqF9
TLSH
T197667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f7218457b8ce5b9052d4d58b95f90962ba856150bbeed25435601839243dec4b
MD5 d49aa2537816946507f55c1fdc198cdb
SHA1 24062e226e0d8fbc76d3e8907259df2bd04818c7
SHA512 f720b16a668ce50cebbe5baa9b5a2623556e7fc2a40578d83085c97d2b7392504f523483ce02603b329b91f707bd2ba05a15734c9269f5c23b7d91e7de9d0538
SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN327wRGpj3:dQyiKanX+PNqF9
TLSH
T12F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ba1a5ad717326861915f185eb4a995d6945bd01ac1c2e6209897805a38e79570
MD5 ff4a8dc0464b0bf9ae4c8616e2e6ce09
SHA1 7879d4c6efe9152bd3c9df1948c229b396a7e036
SHA512 a65245e000f17618a0685198c47a897df36b7c0a00094213d6b0c572e8c8f82d6534fd542dc0b87f07324fa2bba7680044cc8b5cdcb38946c040f4b8fc276828
SSDEEP 49152:b68Qg55nhkeWu7PNU3/QLNiXicJFFRGNzj3:lthTRc/Q7wRGpj3
TLSH
T188B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0478677b035c75a13ce140cf08400535d204e9e65e5aa31b30403862b256be47
MD5 add85acd8a7271446d794e723dbd0fbf
SHA1 476e2006b8a7de033972cd7116ebdf27f0a40ba3
SHA512 f55e412a515e165982a0fbd1377d581ce532f960cfd710790cae38d27fc51c205f5030bec7d5dad44eaf44550f1885bb7e312e7082c83d17abd3e26e65d6f962
SSDEEP 98304:oy5112gYy5azzVvU69nLKnhZJ7wRGpj3:BLIHRWhbF9
TLSH
T16F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 51a3983ce1819fffa454641a0c8795f92338f12ef47a210c44872b5a9699d834
MD5 8182231434e74668a8c380bd36368450
SHA1 36a28d49a6497eac1ea54e6e359660da04a7badd
SHA512 cb71d38f2820a7f3833ab7be8caabc3b4187eae1bdfe853257e44271da9f1d74d11933be048c436050b4157696dd02b1bb21c23d1ab68de4cbd18bdf3b09e316
SSDEEP 49152:lB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gluLNiXicJFFRGNzj3:Lu6JmIxd2du7wRGpj3
TLSH
T1B5D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 47e18ebcac6adc752d87aa8bc7167231bb2953a68808e48931ed594dce2fa8e3
MD5 d48416865b591c0bf9fc2cc41d2da7f7
SHA1 82f9b79097f2be234ba9b93b7f1377faa8e135b8
SHA512 d7fbf55398b3ff2a17ae33d32b62b1609a0cf1d2ef89958759ad81092bb97c69599e8be76325901b462215c8db737a13d7d3a1ae8585bc10a7d186e27f36c904
SSDEEP 49152:71hpsNoJpF1A67U44CwH7R4xCLNiXicJFFRGNzj3:7mifPqRf7wRGpj3
TLSH
T192B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 87b0f1841e7fd8e9b4886e093625c2b3420e3222092e98c999250e76a26b1abb
MD5 761f6596454b1e0e1842c9ccfb1e3349
SHA1 31834e9f570311da6bc4e4ae849e7ae76cbdafa8
SHA512 f135bfca294c519ff18ba1d3ee63f5599af33ac33f1d35ad0567ec054f9f3f3c1313909210ccada44ca265bd033712ab8d2c028bfe9d4c0e59e9a80db3bd2eed
SSDEEP 49152:mSuZQIY0Be2KkRVtOnks6NMHqFLNiXicJFFRGNzj3:o5dKqi61F7wRGpj3
TLSH
T1E7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fed98da52534bdf028d24bcfe48b2bfdf3b0491be66eca9e64848fae8a1712a1
MD5 aaf2b456b55fd99723f0c781ac96ff6f
SHA1 ad9f610ac20b6ec7831ca884c86cf16271fb6514
SHA512 6196f440a94a3da5e1f65d474cd70c00eb417181203349762a3ebae895b07ad9f52d18fd10237d9f7930406941520ca26f3d15095697b8221fb45555e97d23ae
SSDEEP 49152:/htSn8EApI0figjgiDn0AP5weLNiXicJFFRGNzj3:uX2iWphD7wRGpj3
TLSH
T1F495BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 866d5b7ead20be151bd4b4af67568da40a1969ec8aacbb50c0510b6f9af6dfbb
MD5 ea4dfcd68f65c70313f4f7aa6f34a66a
SHA1 6d9707820e10377c86fa30555ce4e486230cef67
SHA512 71cd8e8281dbb29048c22fa62efdcfaced2cb45a4981cfdb157588b47d3e51aa0c506d2d67574121751e5a2289bba3a853864f94309ad867ffe6ff875461eb87
SSDEEP 12288:5diJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1705523D2548955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7550b805d256d1c9337be9aad6a438f61e127f4e45dc153ef741d796338ce8c4
MD5 93c882d38b0819ee1232e8e8cd6270bd
SHA1 229ed32d405de2c2ee005615e5185b5ad3b16865
SHA512 ee6c48631dee7817c274e031c8a8d65ad82bde531bd82515339a653065703b845256593dc7c29ac9b8bea052bb9a01f6ec9f1073263dc6bd8801b7bca41b105f
SSDEEP 12288:bKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1515523D3548955B1EABC0039C6764428F5885E2DEB5618E3E3483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a72b502066f8d8c39fe2fc193fd6884891154c5ee114d21a2e5c7d93bf0e982c
MD5 a07c2132d59964a44273ea9ee59f579d
SHA1 c02fc5ff4421a878bd4d0c5867b0fa13ce37d291
SHA512 a3f34d2754a321f27c486065442dc37d6c6aff29c3e2b47195687ec78e34be7b5345d8603dfa696702d8a8c5304fcdac70fe29ab71029678e3fc3d7577d8aa5d
SSDEEP 12288:iIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:i6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1febdd90fe375180eb6ba25994fe69b8e60a8293bab1f0f661f4ff9c79c8dcb2
MD5 a221df5fc5c5db24ea88daa816f98836
SHA1 6dcb3f1f986d7454d42521af5614f38138decb0a
SHA512 f63f9a5a306e54ef3f00853a849df08e2731844b668c50080e91ba745901dfddbaa0237b07aad76164a3439ff40d6957d9a084cc3b67f989774ba55939c40aad
SSDEEP 12288:CVLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F6552392168901E1E9FD803DCA764424F2A47D6CD7365AEBD3003D0E5674FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4cadd453e6801b266e4b54966ad2ff985e2a78283f7fced44c6f2ff9ac7ce7e0
MD5 dcee09c5a08a6dc2d49ed0eef20ab058
SHA1 e4ddd8c3ec32f0cc76cb997de7205fcb785c8f25
SHA512 c7162e63c61f1f0d44916948ff07f4b7eaf0d631a855fde6b1b9fc37d8cb8c162c39c1f1efce0544e88ccf7df5d4e8dcd10e0373baf6f513c0055e67c3a9c192
SSDEEP 12288:8TiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EF5523D2558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7efade8ac2e2b4e823031ea231341478f09168271f6a0ba149a40227bd7bd59c
MD5 8e840bcdeb74fadac7596fb5a1f81b8d
SHA1 1f812246e1577f9382878960618882cc33ceb126
SHA512 427ebb4ccd1b5f26fdc2674e5b6971dda76675c60e4317e9358ab037896577c6fd95146d13b796f175a55950a77344e6705de5204c0ddc3c2508289ee6a90d8f
SSDEEP 12288:3uiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AB5523D2548955B1EAFC003AC6754428F5881E2DEB5619E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 551ba6e818a31766376ce6c871550138b5d0ed6fe8ef194314a811bcfb6c4807
MD5 88cc570a539fd75f5c17d2fa8b827784
SHA1 c209f395f7f043e780ff3e23dd2d3664e0daf8fe
SHA512 75323f129fc9e4db35c0a9ccceae3c88255d6da338382000205f24b66f398ad8156f466d3f0d3c86d4d5e71d6f93e348bb769938f1f4b304792fda3a8a6b561d
SSDEEP 12288:MSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1585523D2548955B1EAFC0039C6754428F5881E2DEB5A59E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1093366e22f4e33863cdbe27cd5174acaaf5f1fb541bfbb10b5aba44b840836f
MD5 181bfbc9502a234c8cec80844aac1553
SHA1 f9ac16cf550b0889ed143026ee2975ec2d472a3a
SHA512 048ba0ae8df6b15bd065a4d682a997d9283728d581f445023cec987635add1aa97405bc771cbee7b9967b8b18eb6f49836782410f699597382ca253c7d990787
SSDEEP 24576:UZM3zFVSOs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UZM3zfILNiXicJFFRGNzj3
TLSH
T1AF750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 edba5aa4b0cd12fae82833c97fb9b065e16dac47fadb3fbce73bbd4b58094c6b
MD5 37d1abf32795a0b39b16eaf12fd2db8a
SHA1 a8155e9823fc75ab1d57c7d0b9f069b0b4211fa6
SHA512 b6e2fd26769a59613e4ed06bedcf57bdcc8a07aa89eeefa5eccff2ae6771901054cca0738d8d09b1d7d4b611a6ade679f448d105a5d703445e5d0591dfa8e340
SSDEEP 12288:XpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1635523D3548955B1FAFC003986764428F5881E2DEB5618E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ebd06dcaefa88a0e7e187309b110058ae74eb77463b35a4626bc115055d92402
MD5 80f4e54e51b31a01bd2bda1f54cfda25
SHA1 c66a5e7d19c538faf5ba8a3d21a6b791ecf10950
SHA512 05b458caad63ee9b758409e907777d64eb06765df2f1af61d1e9358dd831906715a56db666e3f1c032567b5f540469b07ae4f6cb56e2a27c49c141b1dae5b210
SSDEEP 12288:RViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:R5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1135523D3548955B1FABC003986754428F5886E2DEB5659E3E2083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 6b4357528ffb7952f7d8036af1143fe571812398f4503cd1fa5d2a2f4db0b4bd
MD5 cb73e94d64c54db61da9753a3b1f3f68
SHA1 ecce1fab1c672612386892a8ff9beceba4ea3d56
SHA512 0865436d631c069530a12fa1f6b83afbe99218a156dcf8bef1f26b3c3eead39d3630978ab1b2bc21a1c68204d6ab388fb0eee0fb6206ad7977642e8298c77a87
SSDEEP 24576:7zyw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7DLNiXicJFFRGNzj3
TLSH
T14E650157629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a3891c1fa5508b3fb345955a79802da84a5f9a48d53d18b049a739bc450ef50f
MD5 0b47230ff09693b93c5a64b61e1a225c
SHA1 a2db86ec2b611c01d6795879f59bbbcf8aba25f0
SHA512 06aeacfed2487f8320236118c723b2aa2de34d9bad017151167dddb8542863f065490bf7d4f33531bfc9a3dfe6f5b6845320f004df2a05adbddd18864aaf33e7
SSDEEP 12288:/piJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F25523D3548955B1FAFC0039C6764428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c982ceea8cb7d296cfe304374b1e81ce2cc339b0e7c20f20389499f52961c26d
MD5 39774c7e2fa519c4fb5370275eb7277b
SHA1 ac3231668298d83b0ae1878b7cd5e698a0182cd0
SHA512 8de14f8622f8328cdb05497b6504200488777a5ac60071da85c45b6733d6913462dacd5ff20ad342102150386606bac5e275c35071b9f7fbc4db3fc20fe4b06c
SSDEEP 12288:mpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:m1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D3548955B1EAFC003D86764428F5881E2DEB5619E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 3c86899cfd561486ac9706318457f9937350d536c1f555354f539499a95a7fc0
MD5 1cf739f5be718ed6101d6246f3ad8dc8
SHA1 398048c34e6d48f050b50e0581ed4eb966ad0949
SHA512 0faddd3803e9c031b31218afcac32067dd5b652a70be67fba667611cff85ecd72578bd4fdd90653b12d28212e510474bc067709f7b7c2be988f056172a0a11ab
SSDEEP 24576:Fzyw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FDLNiXicJFFRGNzj3
TLSH
T12F650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 1bc6c9973f96b4bf29705f0fa7cfb923c97ff2f4639a9cc31260d29890bd1a1b
MD5 786e190b0b1d4eca75f04e1c8b2d8caa
SHA1 079b912aca714564a9f8d97ebdf83618ca8263aa
SHA512 8c21aa489c2599e969c81a9b93174686e2c59667c73e8814fef73b9a92f24947ccda034cfaf854f8afd286be785c3bd3c851d4b0f05549c91bfc431419447c8f
SSDEEP 24576:1T8aLl3z0zDK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1T7LljLLNiXicJFFRGNzj3
TLSH
T10A7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 66ecacb49860fe5137035ddc0328f9e1fe8339462b296f7b2a0a0bab1f9d6d15
MD5 5dc56d928e2a4836b76843358f010b03
SHA1 8155192beb69ead6b7e643c0b89f004a998e2d18
SHA512 0880c139c1564f40450dc3552dae0644659585973ed5bed95661698a00f1d5be88bb1efe816d9124eacd7d6918e73ea9ae0089cf173a5258fb9e66a151fcfef9
SSDEEP 24576:a3rd9CHKy7GZW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8rd9CHKyaILNiXicJFFRGNzj3
TLSH
T1EA85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4d53bd275ff707a9bd65e7f9dd4ca440080215dcc086c5c3a3189b5b90607889
MD5 453e55dcd1ff20c987963d5bd4f5289e
SHA1 d3ba122f03f791119918742feb783848b35fa71d
SHA512 b0d21f829ff50fc4649838232f9afc152fe0db5a2d375644628321347069e88bd6977d482069b2ad714996563fd156c47de8975be9d3ea4b2a501bbe871fede7
SSDEEP 12288:CoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ca/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D2558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9867f7065ff180bb1862549173f07121364a357cdd9f6751da0b2040432a84fb
MD5 d7cd22ab5af014ee02a851a0c834ccfb
SHA1 228d6fea4b3655553fd1e25de6ae32cbb95f967a
SHA512 f7457054b582da9f12ebb791c0ccc307e27d4f4a0c65bd6e3fb67f90841efff27c177c821287e437689af53a76ae674af7459e04843a9a8d6b84ab7ea327dc23
SSDEEP 12288:dmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1965523D2558955F1FABC0039867A4428F5881E2DEB5619E3E2443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 479892e4f70e41a5de6ffdc1a914aa2bd04a99bce52c3f52ccdf8bf339db38d3
MD5 b024da6a252a5f83c59ec3e1e9571ea3
SHA1 8f6bbe9b71c5e0766d5d329b9ba35b91faef9770
SHA512 5ea8e6580e81aba1a994b9eeb2a8db4b8fd1cc4064f94db5f2af2bcabae722640715afd0b68969e2c503eb91afa229424beb55b03b7f4dbf15e619b8bcead99d
SSDEEP 12288:MHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A25523D2548955B1EAFC003DC6764428F5882E1DEB5619E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 745bd6547cc0327a32fd0dd244ea515f1f5da6232fc23b97fe958caf847037d6
MD5 192be7dfba6088a9b82f4316ff3e3ec2
SHA1 2e4250584a2e3ad818a55fd9542dd5749fd68f77
SHA512 d888c31f192028537927578e81247fa897d5ebdda8fc304e022ad058127e639f183b0832a5028abf28c092c4f8c9575fb6184554ba3996f6ff138e9a0b3a8df1
SSDEEP 12288:+piJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1045523D2548955B1FAFC003986764428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9e3a7807bada5f60a23063d62f09c35f41b953bd769387202dea63a9c3c5bd93
MD5 a3dc844ce0132784fe9884df80f9ec52
SHA1 7815e3adce9476a84b3a1e2676ca3133e2d3e8b9
SHA512 ffc6a2ae4c3428b4edd57e55a50c505a1bce199ed824c71c53c576589fdcb2596da97a387e9d07961b2c1722dfd69a27f3925a1912cf62331c2b61d807c179a1
SSDEEP 12288:boiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ba/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1405523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9bc008fa831317ef8bf44a81f77c45469b49798fab2611050be3468ae6eeeb57
MD5 8b3aac5b977cf5a0bb8109b47ebed2ad
SHA1 e8cb7c211965d86f2534f7842968f60bef168d2c
SHA512 a074e6a19f6061fe69874c4cd52139fd9a73765a32bb6040c071d94360d1e408a8b3d6985f8dd47d878a08e151a9691c9acfb50c7dff12f3bf3d44455e3a2877
SSDEEP 12288:HRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A15523D2548955F1EAFC003AC6764428F5881E2DEB5659E3E2443D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1d58fc4cf184cc4214779f9d91940b8ed4cd542055d7d2fe6d2a37b1a53ef14b
MD5 2502013b78e72c630bc30c852b5f23a7
SHA1 f6463ed891673c396618f34b99836f25ee086a21
SHA512 8e9b51b0c6732fc9c4aade868b19c9427424fb6121b27439ca9eda0e70ff71d36e9ba8361c150b54cd972a9f9403ae730b3dd17851c6ad135f3e124a9c8326cd
SSDEEP 12288:kTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CF5523D2558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 3b4f9122657178dd89152b65ec68d3eabc6a848d1aa20ff748b5ad91e3f0f595
MD5 2a844a8673b3ab12e0980345ab2d26dd
SHA1 41d3a76c03849d7ad78178e3666fd2bfefe3ac26
SHA512 de6b17a4053ce23c6b8cbc13bfcf492abdb77a633f43e3ff6e0ec9167a115ac3f1d868219d8964fe0a2d0f78997e5c8ff46ad63d2aa625d0f755683ccbcbcc82
SSDEEP 12288:AAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19D5523D2548955F1EAFC003AC6754428F5881E2DEB5659E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 39529ed93e7ad0e4594dc41d3a280ae0d5dcf1b56ed2fd3d7298b5e2c9d6dfab
MD5 2516d71f8dc2234c9ec34b2247ffc5e6
SHA1 ee2bf26cc493c87a8d8f8d10f76e0f581864b1c9
SHA512 2986376fe863f48fa3bda157aed12d7afdfec6622e32511db40a6f16f1308c8ca774908ac5a1f09ab35c095e987c6c18c9b3fa454270f432839d176511bd003e
SSDEEP 24576:Afwvzk9RX6wkyAIp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TMnYIpLNiXicJFFRGNzj3
TLSH
T1F485DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9cface052fb95087120c2aa71a8bff551015e8b57a4c3c28e90dc4426c1a9046
MD5 08ed51f87d6f32fa69502a4423ad05ca
SHA1 593937f3c91cbdc0e9c475b0e33163695c41434a
SHA512 237e9648e218dc6d152515b148663ea7809b08288065e1a7c9e83bd61ee6f470bc327a714023030c826192f59c5e30b801dd421eaa111b805f41c751b05c0424
SSDEEP 49152:+YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+LNiXicJFFRGN:hySzPW7wRGpj3
TLSH
T132066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cc5aeaf046721f25169851133d2a7f95a4426ac47c93be410656036a2ea3a873
MD5 fe2ee1dff0d555b1653a95176212c30c
SHA1 bf1532add9b4d1db024a2b8d37b40572b82320e2
SHA512 805bbb532c97fe2b4a3b236a721b1b7a68e05b78b2f4588adbc729b43ffedabf7d4b193fa0ddbf055a50b43d28b27fb6b8f9a82be318b204b961e0dd2d5eaed0
SSDEEP 24576:F47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:F47JUQjqirIhCnDHUPfF/uLNiXicJFFS
TLSH
T1B165AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e14c2a599995688223970c0fcf31c256b9ec2ec22f805f0a0d87138efa8090b9
MD5 6c0b7a7283203363d35429fb8adeea8e
SHA1 1191be3c559b88db55ce4a8eb0dea37cee7a606f
SHA512 3065066b3dc78fd6234b15c519490109c10479deaadc068ebf6ed2222dcd327a4f28aecd7ff07d069146c082db4c270b84e199cd4cb3ab6ffc407389cdf8ad9e
SSDEEP 12288:1psfZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C765F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52D0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 cd09b5c8d13ce1bcf638fc18ebca265d74b1c67e7b0b8c9c48a7d6d80e877402
MD5 84d783af16fbcd28202249371e36ce45
SHA1 4e6b26fc7720b2bd8e3c5930724aaed93f197204
SHA512 12716ceecc48dcc5cddc1d6c9b43b7d55556d7671de45cf6bc971e43089b33e505fed7a8077ea438812183080d45b4c29e5cffb8e89d972f2862c3e4501499fd
SSDEEP 12288:kYkOU3fSl/WIUDHYRV5RUWcDZ7zmKhXQsR+aREPDS97zVU6:kYjUPSHUD4CWcNacHRbqPu9v
TLSH
T1FD452840766BC75FC6A940325E72D6CCA7703D01EE056F0773C98B3F8576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 8f4a9cef9f3c97c3c8f4792603898b1908aee124ac4fe307123d698e967df794
MD5 13d57edf7bce70311a3cb6045391be2e
SHA1 4a4662f02efb7f46f0161557b08e5865a1ac0ce3
SHA512 686434be99109c327c95e86412e1a718d04f6f5d4b0d9563a524c8c84a1e6f9e127c1bfd93f0602ea1a6cc1aab7c021e067addc1f8dbb62243330a57f29acede
SSDEEP 12288:7L3vrvJ8vi8b9WpKOH5xWlj89dWlaUY2YrVb8rMAvNe:7L3vrvJcDWiKpWM2Ne
TLSH
T1F1650AC16137A38FD1FB507247265B8CA764EC16B7096F2273C8053AD86AB25A1FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 301b39cdddbdc00e96b63b1468165119af19ad5a5b3f0d4fe1ca7a6a5d8bd333
MD5 e429f4317beb92d0f60e1c65dbf1cb05
SHA1 aa2c93471962bb0fe4b4ed6817f78ef5d32ac416
SHA512 10a272c0da0c1ed993c7ad908db523c26fa06c71545d9ab1160595315934d48df0607657cc714019b11bdd7fbcacefbba0403ab56dd95e4856aacc3bcac7d9e4
SSDEEP 12288:7F7BiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Rt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15C5523A3568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c021e8844181e1668e8e343731aa36b47c7aba1513d921ba3cc684bc6625dbdd
MD5 918a297ea4668a76de2c16b760b68691
SHA1 cd55698341262d66353f9e52c42d814b46bbfe74
SHA512 3e1bdea8547b71a84b57aabe0fa05af6c8966909dee05e7d97c0bff712421a500641fd9a51357aa865b42ac122721b5d9998f6e1a893f5add24d130274a1e242
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Cgb4mBIBhGFcLNiXicJFFRGNzj3
TLSH
T14865AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 a88d9ebce9ba72cc587704a2a2dbe273b38bd41219c660ecfc95baa84bb83cca
MD5 8be7b2d0bc8010841b1fb41b164be930
SHA1 dfe7d57bf7862ba251faef370c4b38cfa691ec3a
SHA512 8dc1cfdb6ff26af648fdc3bff7fcd272f8f9bba81708a646a288b2a7840088cf563ccc1df2fa057ca9db7484c61b355a72b5bcfc440d55be2595110bbb7fae59
SSDEEP 24576:5G88u8FpJqH1vzria7/ms/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s7ZFPqVya7/TLNiXicJFFRGNzj3
TLSH
T1DD85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a831d850ce3004c308b5c16cfb34f1a93a94c99cc40b73b3a5c88d1b5cdd60fa
MD5 b638e9dcb127b9caf0fa420c28556a5e
SHA1 610f702f128825291ec9ca39c6fe718e45fd22b9
SHA512 b0075d5788d5847bc85332256077d9e2129f78c441308a6fad1980dbe2c0323ca1162596a1cad5e47005ecb214fa88391dbecbce47d1e0afbb268f4354323b0c
SSDEEP 24576:MPUr+NQI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MJQILNiXicJFFRGNzj3
TLSH
T13F65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 451108e284f6bc13071bc4a541b2fd0c0694e0f64ad107d0b77df54bc24732de
MD5 3baf1e0a54adcca955f54910610eccd1
SHA1 e5e571db479bb4fac3005fdf21b768f6f5106276
SHA512 651e040ffed07789398ec80f7336bc7b4c7de351244054782a04fff78e8b35f2c4e342dc90f939ebdabef419edb187191ec362fbc638ea2398a4d8dc6d6d8064
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYLNiXicJFFRGNzj3:iG05lO43bx7wRGpj3
TLSH
T1E4D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cf49e3fb71a269999ad8c220ccf69c8de4f6768770f64c94772dac942fb6ac02
MD5 4cd9875bf01e8b048bd6960717821993
SHA1 327302bee90a3764f617b70293dc351e8b3239b7
SHA512 b0e1b408b274878b7cb87f89079e1bfc7b38e48dd72adcc94ab027ee4d752f95a29a72cd12b32a8054298614ea92150569c62803335e62dffd8609e56a23feec
SSDEEP 24576:7fa5POZ3dpyWVM50JicR2hG0lasx2+47eidn+/TwSfVcYG3K/cJHlnFR+IGNe8jg:ja5POZ3lJt2pasx2+mQLNiXicJFFRGNf
TLSH
T1EC65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7358208b32c62e89aadbecd173713685021a66f0761e933d965a71b5b9b4b50a
MD5 f80b5c616311fb8c8aca478c90dcf8f7
SHA1 82e0342f19ef985df6c4566a40f38f36bc7c3f1e
SHA512 3bbb48ef36186480b59eefbe4dbc77b5b8edfc7bfc735a731153e3475888cb5ab5582d3421983a61396cabd53bf7b87d0b94bd30fb3b9469b51456e111f11b17
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4Nc/zEOVHFzLNiXicJFFRGNzj3
TLSH
T161858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 119f0bf3c27b886564b2c18214d5d05011c87ed51b87bf5c8c838d9ba57c6a4d
MD5 0d761fcacd15c36cbf49248013ff9e2e
SHA1 dcc1aa720c10929dc6a8f6601c332d58d40cf824
SHA512 9546e2c7dd548d685597599f138d2264d6f1dad009f5ed08912be8b18c76f11779dd12c49bf1d12e508a8eed4ab64698329c6577a33be22f7f1aebd3c6f7c9bb
SSDEEP 24576:JzkNvNnaFeYhJNtmZBmS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JzMwBtOmSLNiXicJFFRGNzj3
TLSH
T1F255AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e5b6433613847d2d5985935c325531295c67497229d6f044875774115bc82e97
MD5 5955cc1e1d8894a7ba991881bad3b132
SHA1 0b49c448f2a90dbf7b02b70e87d7401957d0685d
SHA512 3592861949767420c06686083fac1a2877cd6883006217a107857b7d0b53f7eb821d42ef0a1df460bb34da77dc1f98e5929d6acd39015aefa87ef82563da99b2
SSDEEP 24576:XD3FHshBIYQgAh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XDVHeBIAAhLNiXicJFFRGNzj3
TLSH
T17375E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-81-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/264-75-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/264-76-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/264-298-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/472-123-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/472-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/472-132-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/472-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/472-130-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2028-48-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/2028-43-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/2028-37-0x0000000001F10000-0x0000000001F70000-memory.dmp

Download

memory/2028-45-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2028-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2260-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2260-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2260-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2260-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2344-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2344-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2344-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2344-311-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2344-100-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2344-106-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2388-112-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2388-113-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/2388-310-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2388-119-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/2460-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2460-139-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2460-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2460-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3044-59-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3044-250-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3044-52-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3044-53-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3232-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3232-470-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3232-472-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3232-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3232-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3232-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4288-7-0x00000000025B0000-0x0000000002616000-memory.dmp

Download

memory/4288-6-0x00000000025B0000-0x0000000002616000-memory.dmp

Download

memory/4288-416-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4288-1-0x00000000025B0000-0x0000000002616000-memory.dmp

Download

memory/4288-0-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4288-85-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4296-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4296-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4296-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4296-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4800-287-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4800-63-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4800-65-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4800-71-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download