34548e40b1d88118ea2d9b31107c6a3b3bd3b95386ac386300848dc0f5e8156a

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.5MB
Sample260803-pczehsxbne
SHA256 34548e40b1d88118ea2d9b31107c6a3b3bd3b95386ac386300848dc0f5e8156a
MD5 28642ad9fc43edaefb8cb5aa2a309406
SHA1 cea49f9502daf89112de72dc6d9ea653e87945f3
SHA512 682f464477225511aa01933d0c7ec8af6773e875cb98bd157bbceb46ea670cc3de4ef695d1ec1599e05260d3d2ec2833b0f3d9fd6ab382824987d9069db4b34c
SSDEEP 49152:FrxRP9sg+UqVks+J0LNiXicJFFRGNzj3:F3MRVkm7wRGpj3
TLSH
T14E756B1277F99179F1F37BB19EB883645A77BC71AE39C50E6280215E09B4A40DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5116	elevation_service.exe
1460	elevation_service.exe
1864	maintenanceservice.exe
5804	OSE.EXE
4740	PerceptionSimulationService.exe
3752	perfhost.exe
5600	ReFsDedupSvc.exe
3572	SensorDataService.exe
3244	ssh-agent.exe
3156	AgentService.exe
2872	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\70700060c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed61304f4123dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d18c554f4123dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008089594f4123dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3a9fc4b4123dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc80134e4123dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000229a2b4f4123dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
1460	elevation_service.exe
1460	elevation_service.exe
1460	elevation_service.exe
1460	elevation_service.exe
1460	elevation_service.exe
1460	elevation_service.exe
1460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3452	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	5600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5600	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3156	AgentService.exe
Token: 33	2872	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeDebugPrivilege	5116	elevation_service.exe
Token: SeDebugPrivilege	1460	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3452	2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 4332	2872	SearchIndexer.exe	103
PID 2872 wrote to memory of 956	2872	SearchIndexer.exe	104
PID 2872 wrote to memory of 4616	2872	SearchIndexer.exe	106
PID 2872 wrote to memory of 5904	2872	SearchIndexer.exe	107
PID 2872 wrote to memory of 4452	2872	SearchIndexer.exe	109
PID 2872 wrote to memory of 2148	2872	SearchIndexer.exe	110
PID 2872 wrote to memory of 2460	2872	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_28642ad9fc43edaefb8cb5aa2a309406_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1864

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5804

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3752

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5600

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3572

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3244

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9a37cc4fdddc64bdd6637862b9457f01eb694606a7b1ea31f297b1429b254e11
MD5 2d16826d5963c34307385fc170c9561e
SHA1 ee25008619eccd91ed6b856fcd0a975047d8761a
SHA512 d4bec08b9aeff2dc932a3168b33bce79ad5be8ae692e14c9711f4e5885c4068e1b14e4aa3cf96dbd8c0c60ae58cf871687578e5bfa5e4151471fdb7bf143074c
SSDEEP 49152:Hb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnALNiXicJFFRGNzj3:13q6mjB/7wRGpj3
TLSH
T173D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 30a60c15c06ed241fde7f47f25e34aaf31ee2f25c19bce41e809785ece999b86
MD5 3de95c5e77e44f28d56d0fc1a897ad77
SHA1 7d551574a052575ac4ac77d0faeeeff5b02deff3
SHA512 e8b24fa9638f649013c5adf982d11988a67f89097ace5d9b5ee8cc0e6d9a2679e52f3cd673c0e39a87ab409cf093997ecc70380c935b5c0b6a83d704b664feb2
SSDEEP 24576:nXYfDtczAb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ytcKLNiXicJFFRGNzj3
TLSH
T15375012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6103ee1468014d17bb4d19e2234ea9e64f2bcd7a27269067951ca962b267c7f9
MD5 b66045f72359e08e92504beef6961a1c
SHA1 2c9f07c97c69084bc6bc2fceaeef9382563695e0
SHA512 5f3ea0825e084e45cd5c9b4b3433f3c98ee38cd591a36a1518e60c100d3d92c0f4d737a0a3e27059704647222cf1105cd5aeae6439baea560d5d3626a2a2dd63
SSDEEP 24576:N0Le5ji0hmxhrMo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NPji0AzRLNiXicJFFRGNzj3
TLSH
T128859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 af601f449898b34f1aeec351f3174f3b0fd8a6e57cf3ae47a19b3372c23108e4
MD5 05d3c7a7fe12c4aa0faa809132d5461d
SHA1 11e76bd909b34c26af4de61d61aad821ba9f1b00
SHA512 fed73aeadbe88a310869b996d1c7b76578ab32d17e1febca200b67e97b9cd793922a1f442e374327328ffbc15439d988882a4288b5b3e34af53b0a435dee2a03
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWj6q8wyua/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:V/ezSC6vUzPv+HjytLNiXicJFFRGNzj3
TLSH
T1DB756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ff870cda8450e175214d336a1f33439e5e8cf56736cb8a858a8e722747253dce
MD5 8e57d28faed7f21b54c4bd86c612ab17
SHA1 76856ca6f6d380046f016e93827c386114937935
SHA512 ed85eade6e408542f910d3839bc1dc0f5696f357e53b7591df22eda1dbb75943b8b9380827d8e2847aeeb1d2d2edbeb9cd5ee738a7f32a12898906c5e32603fa
SSDEEP 24576:BVbqPb88hv/l+BP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BVO88hXl+xLNiXicJFFRGNzj3
TLSH
T1C2559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e7c4b43fb799872c39093bb672889f1f47d7065a3069b435d1d8400793f70cf5
MD5 31054a463caadc5cd96a5f0d5908c788
SHA1 b824bd7103c8e9c423bfb84f5c96438de7ce5c3f
SHA512 bc597171efb72088aa876c010eda7f3c1aed3e9272a0821fdca121e5c26f360b34849ce403ac684c70cf23fe13c9808695f68bfa88d2c5776975373797efdf93
SSDEEP 24576:cGM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MLNiXicJFFRGNzj3
TLSH
T12C5523D3468854B1FBFD003A867A5828B5845E2CDA595DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e1fe49ce56fd58ecbb183fe5449336f721a35775d00b863065af12640eb67ccc
MD5 aea45d77711b83401b663094d2a913a7
SHA1 38114f4af33a3bff467c6e85b7af8e0593a85491
SHA512 46024df1676527302b24b3cfc07fd912f2ec82b488a4fab6a6dbe412aed6d12b2eb3778ab384a2f1169f2ae48775a39db9ac935dbcc3ce9177f05742a1f6586e
SSDEEP 24576:OJIU3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OJIU3LNiXicJFFRGNzj3
TLSH
T12D75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c639124506b9a5e5dfd5504d922b48b3dc29aebd6a71bcd3df9ea27ca22a6914
MD5 f3bb0629db16e78f707325e31cee1aa6
SHA1 ddee3457473e6add4d44f2bbfac148e561bee8db
SHA512 4ed0bea6987aede30089a7120efc8f50ccec8001a9b01d620b047fc575b207ee37a15ff2900d8b9a707a15cdade9d1df9fd1774b4ec420f07bb317f6c873244b
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THz:AQvGAdlCEL8c/WRNw5Cq7wRGpj3
TLSH
T190266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 40b35ef4a7c96e9d4d2dd88fdab45fec8ec2f7f0169c09f256a711d5483d8fa8
MD5 eb226f134cead3485e0d4e9d3335d99c
SHA1 b74bdd82d57c175d9fcb060aee3f51ab8b339b06
SHA512 0b7ef64bebd3b7196c35e92ec920c3499ed9e479c735ab550f0605dac3f99fdbc3ee08cf27b5e7939deb8313af7e1b3bba6596d7ff5b39c5f115a53f03961eca
SSDEEP 24576:9fewsAjh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BljhLNiXicJFFRGNzj3
TLSH
T16D75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 314189da8756e5fd0d27ffc3f4239b2171efba683093f0335eaf86d28a124cad
MD5 b88ea8c37b9d968736be1c0676503c91
SHA1 62c98719512dddf400000b458561672a42c52360
SHA512 5c0ed2943df3ed3348917bb40ecf024d231a9d545ec18e1bf84b2afaea603873910d6cf5cf44f5221566f415372eac9ee6efd22d3453c6f3d17ac23056ec7759
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHNF9:UUEtQevvqc2W1cpV20I32z9
TLSH
T1D8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 28bebc3772a62877646b195b3455c7e68ffe9056051e0b681f7f1d3d51998c0c
MD5 a56507f75a0d42bb56cbc50231e86be7
SHA1 e807f783887e1e7f71067927467af69709b88c9b
SHA512 7efc402406292c18a3e1d2e876c203fc283f2056e8350869810c90783eb027d2a85c4a09ac0d22b38770e8e99ee817878eba183b2b7d2f83e45ab962129d3be4
SSDEEP 49152:hCbRquA/m2yL5zLfFiV+XenmE3/zBLNiXicJFFRGNzj3:Ooq2Vjnm27wRGpj3
TLSH
T1DCD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2250574905650edbcea6c7a90ea1f5c63dd230479445144d9319dc56d743ccd9
MD5 403dbcc3e7af5d5fc42ab83049c81b64
SHA1 1717ada6d8eea8d6e7353838279b7f259a12b2a3
SHA512 fab20592188d3e32aeb9c00435d6618c00b22a2d474d16505ee83b17f3b4dcde0724d6b83110400f55be71957aa844ebd54b3934a46e223e4f760afaccca9218
SSDEEP 24576:8AhGL6IFoiwtA5l7S53W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8AM5Foiq5GLNiXicJFFRGNzj3
TLSH
T1A9359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 16551348bd09c1b1e4f87365e7bb80c54de2a6da330c4575f490710dc7cc7ac2
MD5 594c99db8e3082205b31947e3da5060c
SHA1 9c92ede7048f6e8e3f6a3e9634d57364c9f313bf
SHA512 bd5a77e365870308b6bf2d4c0c6bafc7d7f667a20750de483ca7caf0e7f9bd8e6e570c2f79e392fa56e151b785d9cad38da3adc91d2a6f483441cbad5e52bf89
SSDEEP 24576:KwuROWN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KwSOCLNiXicJFFRGNzj3
TLSH
T1CC65F14632940CF9E9B641398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1e11b86e18faad8a428b218c39cff1bf6aac1a19d548f4d30528fe2a3144b62b
MD5 f2ff9e6fc32532b596c89541c6b8ec99
SHA1 4fd83948c979244b0dd6dad8c0ba68282e55f0ab
SHA512 35956e369f941a3fd3f7b28fee0e45ec3331a10253bf010dc469eb21a50030086a3b5246405bb027a64acc2a7a620c25ba0eedfce7d1465ed56b93a9d38015a7
SSDEEP 24576:mZuQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sLNiXicJFFRGNzj3
TLSH
T17D55129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 316d0fd3beb350df30d1e4de87cb30d6925669d3eeefbb1d178635edc9445d8b
MD5 0e9f83a5b03fd3fa741758fabc8e094b
SHA1 830650c83c8d06b9903f16bcdc775e7215801143
SHA512 e5842caf6393cad446d9c9a932b2b50fc68bb7bc519d44446fae99abea0e0fa00b1c59d117febfcb33d5906c7883e44aa8d12d8e1f23d613d8ee133f98c8347c
SSDEEP 98304:KQRQyi36YOcPDLvw2gAf+PN3j7wRGpj3:hQyiKanX+PNnF9
TLSH
T1D5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3fb1c4cd955c8164dd67679f02de712b47c1fc13781d227ba54bfac947662e30
MD5 54a738ecc1e10a346429d3cc84d2c34c
SHA1 5a03eee781245cddacfc8a58f6c6f060954bc165
SHA512 a640b0da2997cfab42f3208a32a5f10980e7b7ddaf7127125134f5eab69c22f95ede17a67fff131ca6730e8802e5675da47b7135638d4acb59d8fccdc72856b3
SSDEEP 98304:TQRQyi36YOcPDLvw2gAf+PN3j7wRGpj3:CQyiKanX+PNnF9
TLSH
T18F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 edea9e715f3e7f132940be4129b98496e0f0363acc1ec4fc87264d432c9db4d3
MD5 dde9f254afcb4b0a3c56dd4d9013a4e4
SHA1 4c22f5a34ccef2d87fda2a18b61a260745df1fff
SHA512 f5283fb3c88e0081c87256590e75f180de8821f49e661e05e33f74f0b3b12629351b07cc7282873a423be1b6c276f0c994efeed9a17c15c24890e359a66d15b2
SSDEEP 49152:a68Qg55nhkeWu7PNU3/RLNiXicJFFRGNzj3:IthTRc/R7wRGpj3
TLSH
T163B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 86f944981ba3f587188c641a25d81c0bc2894a33993225e9ba22b42f7ae01f2a
MD5 999ef27a0bd21a588355c0f007e79dd3
SHA1 a3428d10c7be5ad0df23f0c625dbcd66de20390d
SHA512 ce70d627ebacff2f0a602787c82f89b5beb641d955610b625cea97b4290920039874f3a0fa3b7e855532a7e45de6baee5c87b4585299cfea25b5ba7b35faacb6
SSDEEP 98304:3y5112gYy5azzVvU69nLKnhZM7wRGpj3:KLIHRWhCF9
TLSH
T168167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c60ced15200df5485006171e99bd95f8da5cfeb6c1deb060f15842cecda4f55a
MD5 b58cd7cac188d76e9eca29770e85f663
SHA1 1e50a1e2a2e2b1a05583b1b55ae2ec094a5dbb9e
SHA512 f5b1511fc77572fd24b4c9697b045d9c68c9f5efd26196e1f5e295e1397a04e6bb639cba8cc174ccb9e0f1e12aa0e09de3b49353a70cf4c7bca457cba4ecf313
SSDEEP 49152:kB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glLLNiXicJFFRGNzj3:+u6JmIxd2dL7wRGpj3
TLSH
T132D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4e021e25294d36562d634b90533e757b8187ca82b8e7ce638312262d50deb0eb
MD5 502b5db337e0a3b0327f042e3493e10e
SHA1 0faec44836f0ef63dfc0d0e1a2d9834480cf7e52
SHA512 aaaf9d369a1f6ebf6d9c2e039618778cb9735d8cd3edb02b921ebc8c14d8f83d4523802368261e2212f78ef42ac093576d2975104b4cbb812eb0cc3523183ef5
SSDEEP 49152:D1hpsNoJpF1A67U44CwH7R4xXLNiXicJFFRGNzj3:DmifPqR27wRGpj3
TLSH
T1F5B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fe1fe67a4cbe8d5ec0b7d8a155fd24efb5842fbeef0f5a05773e6918b7130c6f
MD5 b34285e42882051378f4ed5caade2cd7
SHA1 0963ac3c1374693ff90c5cc4e3e3eadcceac38ed
SHA512 d91fd83c871cd1993c23fb6c97ada49a9337732fed85c831bdecc1ac556548fbadab5fe03a7c471fcae7a8240aa4e35e57b93bda9b6daef31205b6c74381b849
SSDEEP 49152:WSuZQIY0Be2KkRVtOnks6NMHqQLNiXicJFFRGNzj3:45dKqi61Q7wRGpj3
TLSH
T128C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b84bec31c5e8275318cfbff39bec464cf0b358ce8d872bcd5c6c247be82ec9bc
MD5 02e43c53e30d8937d4f890e26d3058b7
SHA1 dc31cac214c46a9b340a94d50ac24f03b7320ec3
SHA512 ec224bbd279184048236d15a4ba95e1a3073fe6c8d19bfec931ba62a13c05cf81e95b796b7f2e91df6411d0e57aa9129bedd9b0ac55490c3194d20fe4d1b39a0
SSDEEP 49152:yhtSn8EApI0figjgiDn0AP5wbLNiXicJFFRGNzj3:zX2iWphi7wRGpj3
TLSH
T16595BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c25315af1ebd2075300051ec14f4dd9777a67efe02721a8a8886350c76b63e5b
MD5 b0c6dd7df56a5ec761ccaf19180de1c0
SHA1 dbf15579bbb2e570085e499002212e655884e54d
SHA512 66fa0c3ff902260a790e48775b9e3353db2a21337ede79a22cb9782e1c7f3a0c1cb891dfd17f96b8695889e0fca7b0671da9f89b1d64b9d7f40165dcaf6658e6
SSDEEP 12288:ryiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1285523D354C955B1FBBC0039C6765428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c7f29bc757f3988a7adffcde1a61be34bb9f1ffe3f0b868345c95a12460f0980
MD5 9d48c75aa9391f5bae21242a75ab88f7
SHA1 5f0bc6e8af36a70a79339aaa0595609139fbf092
SHA512 63a69e3f6aa1a2678bc378b003e9f5892d12823b015a6b22600bcd9847a8d9cea187de16ec06a328a2a2a10ca7fc8745c84f5a41bd67a3ce38cf6664391dd00f
SSDEEP 12288:KZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1565523D3548955B1EBBC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5e29a1c01ce2144a5436760408dcf471894409eb8ebcf2ac642a50b3ff3b2cb8
MD5 978864a8fd430bf5ff2508aa596baa2e
SHA1 8a286055ecf5d58c0a215b738b034229a71d9ad3
SHA512 663092ef0f5c51c853b7eec685cff76013aade26da05b2f5ab8fa382de3f772cfaab31b871a8c494729ea5cbdfd06e21d8aa5838220f31e9926821dedd236431
SSDEEP 12288:PriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:P//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1525523D3558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2003c74a8fe3e6803ce774b5306d1f53aa0d91c7a4bb61ef854b0fc538a33ed3
MD5 5f022175a21deca650f031e0128ff58a
SHA1 16e049b2372719e40f21a63e8014f30f51e75a99
SHA512 bb9dc0c2affb8b9b101533351c7f8b5db87773703c46242810731834d93ec13e69f7c1416f9d2f901f3212df5150c55a1440e076193031658bae0ec3161b9bb5
SSDEEP 12288:zVMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T150552392168900E1E9FD803DC6764424F2A47D6CD7325AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c64748257582291e790fd30619c94b8abadbb3542c0c09cf151622921f29667c
MD5 2a9f21e163e10bb6ccde0fea3d0e7690
SHA1 3d139f898f0039738a0537766772b2afe9c1f40c
SHA512 b55136461c9b04ef7246561ac0777631275be92579788eac43d6cffd7d8d2871f935cf30b7c3fe3c4677a17a7906285eec0d0d08a1b9b7e6cc18e5beca6c83e9
SSDEEP 12288:8EiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15B5523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 885975d17300a084dcec8db52162eced22cae586e0d77757cab2ed282f035f90
MD5 579f103c9c199c362c900cd00e67b623
SHA1 0b5d802a1f4007cb0de18b1d7279d25fcf55007e
SHA512 412357484c9ed76153b9a1d1ac276bb4f1d2e00bb500a5b719fe7f3e6d8abe62808ea796948cf331856042bb89b06f50bc6aad0d13ad246e9a8e9b1f6ca21312
SSDEEP 12288:qFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D2558955B2EBBC0039C6754428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bd508cf573d3956d79dc71d6c546a748d1c7b27b0e11d8ecd457bbc798017b8a
MD5 02f4e1230867a662d8ad113300796db6
SHA1 27dfeba31b5f00984a4e0bd9d9987063c4d82947
SHA512 56fabf4ca38a53058c036ed1720c0ffde894247b9ba8529c1d511ee962e4232f674c81e32f9f98f5f6799c9ade9873e9764e6f7ef90781a013dc9d4383b472d0
SSDEEP 12288:BxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1885523D3548955B1EBBC0039C6354428F5881E2DEB6658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4a2c9059c00f4fc40c25aa3a8c310fe53860b5ae4b74fd8715aa674cfbf722c0
MD5 5bfcf0970a98ff95229e423798db6b60
SHA1 3c5ca9f97c639ced7917a6faaec5bd35ce1268ee
SHA512 eaa67b0c120d5ee16affdf14c1255c788e5405b1afadabf7a17a757224c64bf32ec7456314627d56acb5774759842a42f699b208a1101eecb4874e9a025b579d
SSDEEP 24576:PZM3zFVSOl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PZM3zfZLNiXicJFFRGNzj3
TLSH
T1E7750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c9ef8164f93e45579131fad6dfb3f2727d9f4cd9eff148f80baf604d7b3a714a
MD5 82fe4b57ef416f88b325d8089006a012
SHA1 ede0221c07c4d31f0e2ce2bf2e11b742096bc2b2
SHA512 f670755403aaa0ad60383657b233114fee16fc3e633cab6aa35227285257273122ed5d236080558aa102612436a6a6b23ae451008b048f93a9965fb1eaf70cd1
SSDEEP 12288:6WiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D3558955B1FBBC0039C6764428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 01358b629a4a13a7521677264c5a804d1dc0ccfdea7e019ad7cd4a0058f6533f
MD5 b4897e6ab10b97466d6607e256820c45
SHA1 49579bfda24f092d5190770628bef0338495bdd2
SHA512 051e6d213b7be19aa1a2ea4554365d8de87fe57d2959908de218d472f392a7d096039422b61fddecdbc08caf641e6da4ff7d3940a07ef8cbf3090c5d67049cd0
SSDEEP 12288:c6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1505523D3548955B1EBBC003986764428F5885E2DEB5619E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 efc0448def54c7288e29e09786e7af9cc709b9f2dd84789ff065516413af9511
MD5 c42d48e92eaf62a90510aef1bd21e580
SHA1 31dc51e8aeee525bb68f1761d73acfe205f3486c
SHA512 ce7014d097e0f556d1bf0514ddcb269f22ae7bb37a39ae342b155a6d0374a4f77103cc51b55ee360e82a62afd77fbd0f46d67d6496637cb57d5c3ea987a7955e
SSDEEP 24576:Nzyx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NiLNiXicJFFRGNzj3
TLSH
T19D650247629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8a503ed6417588f8a3014f27949fa6e4e16b88668f23e56856928e394abe0e39
MD5 ad1c8a0c3c12147e3935990f765447c1
SHA1 94231d1122e85b508b05b9ff32d5f36f1f5b2a63
SHA512 ee2ceb8f9b6dc5cf33df04c6199bb6ec040e4b6fda3556c7f09cf5a9d34c2b1244c850a2fcf8277f3963856ab87f15c5f5388e1550df8c7e401738c9ef9fa365
SSDEEP 12288:eWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B5523D3548955B1EBFC0039C6764428F5885E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2f5254c522570043a238bae2632363ab95c3180c4c3433eb0920ca342a7fb023
MD5 61343b723aa18fe7c9aa72063860e98e
SHA1 906fb8d00b3939567c7103b3781ff73d0d67a624
SHA512 1d20e31f8d406aaaa1909c611c7ca937006fb361f2fda5c079342e65be166e7585f7eea2ff37bb63309442d65c64e66717678cf88ddd69d085d7c79bd7aa9eda
SSDEEP 12288:HWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1865523D3548955B1EBFC003986764428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 9863b8e03aad91c5e4b3a3fce24d48c0907fda2ec0134432b3d2551c8d38b2f0
MD5 9b1e07b75eaf28376ccd341427e2caf7
SHA1 af8f030c3f2420248e4aeb6f1cd89cc6c6460198
SHA512 59f71e92ddb8c98781123893aa0b5265ed6712c25f38868bfdb03765f88a42a9ad472b03932c2905d2de22550958bd9d8331247668ed5a4647e52b3ef98a04f9
SSDEEP 24576:ozyx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oiLNiXicJFFRGNzj3
TLSH
T183650247629530F9E17A4139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6ac480fc3e0b60e6488f59da91521c16b8e20a0de56f6535f8c6c14ee9ea6d79
MD5 5c643a1102883a232dfe90e3117aa922
SHA1 ec0f012ac395cedc14f412b7a3fa7e6edd38fb08
SHA512 f9088125a0f9d00102daba44666b3b56bbe4428bd2b8fe37254a16c373ae956f16dacb90200218e2210d023bce1d1a92b9e1a6070778671946843c3003ab9835
SSDEEP 24576:jT8aLl3z0zDv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jT7LljaLNiXicJFFRGNzj3
TLSH
T1527502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 10fa574f1c7b154953c905f3249c9a5b23080867af125cf59671c292d3662f72
MD5 1a75369fe342c8b98c105960d2f87a79
SHA1 c5de9b1dc64cea457f28944b8c7f758f567b4bb6
SHA512 a1d552ebf76ba7a22c49563d737f524ec0ed120cf2f560fb1f7ec97e303d14f7e05fca7f702151e41ea1585be43cd14dac5d5bf03954d4cc76a2956696e25039
SSDEEP 24576:l3rd9CHKy7GZD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Frd9CHKyaZLNiXicJFFRGNzj3
TLSH
T1F185CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 09d29e41f6f640e4ef1019e0b6a4700e910434732344bf836f5e72961ddaa030
MD5 e7cc3bfaf6edeb08df5cf43a289b094e
SHA1 a8fd06c878ff74b5b0d7c3ebae4eb948a0a2d308
SHA512 facda777f0b7fba822cfaee57e9af53dd9a6b34cece926d02b8d530bb16dd6fb8f3fe611155b94ae33ac23893405913d92bd6fff2d3a721286f3de67416617c9
SSDEEP 12288:RLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Rf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19E5523D3548955B1E7FC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5083fa5702887fea990a2c374ab554cac8e2b04ce9d2b2d5a00da5df08168bc1
MD5 56f82888f6a50d979fec81529f016785
SHA1 a98f91e126ccd1e469d6eaa2d890b701f517eeae
SHA512 99a2f032d6249cf000a9b1261a456218636f1fd0b5a4fa47c7ed26cebe0a3023a01b70c26267c2ac227446f9bc4d5f352a62e7cb51012fc0f2026ade6165484a
SSDEEP 12288:2NiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2R/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1455523D2558955F1F6BC0039867A4428F5881E2DEB6619E3E2443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 10c5baf032a302e7bdc043f5cc24c0d44489f9794c4a86b12e5bb32f445ac354
MD5 0ba04ba9d2a26641487e552479a40c91
SHA1 924bd91388b68f744e3781acbf1374fc2009ce18
SHA512 f876a8dc4fc14f3e9de4c605e16656e5a50cee67bcbf04e88b6a1520ce740942405726640a82ce6dca39c5ae0295dc20e69a80bbba372af490b73e46d911fd17
SSDEEP 12288:jgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F55523D3548955B1EAFC0039C6764428F5881E2DEB5659E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ee11814dfbbf4f3e6fc5f2244f10265e2f8580d483b2b816b0c72a0f6bee8562
MD5 a6601c9b80b80ad152fd7858b8bf95ae
SHA1 24166b7bc7090adfb3e5e57ffa4351f6f5c25abb
SHA512 baff0e6afeba4aaf7d9ecaf205e7ebd501aab2c252db65d765683434c153eca140b0e9caa87e202df2bfc0567b7cc39bd812cfd8d98a796ce3281ebe5263e566
SSDEEP 12288:NWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ng/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A75523D3548955B1EBFC003986764428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 50b7be97d82a68735901a4350f1adb8767d3d9a09f12280e6299711bfc30527c
MD5 fd0eb93f1fcd817801c1f71006d56c77
SHA1 9abc9bf1b528dee3e6f080d9d3b9f04848c0f85c
SHA512 d68ddff864e4151f957d07776f136330a94765be21f0ecd88e01641a81ea0631c30afe4b58eb5f41c1bb6594373fb6dda83d6aa465fe7cf4b24a18327d47e013
SSDEEP 12288:TLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1825523D3548955B1EBFC0039C6764428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4025765ff30b7b9b0b5072f81a2420ccf7845db0d10b232df12e90d42817ff2c
MD5 b894041c5495da9b0fe59f0218a076ad
SHA1 8532432fde4c24ad3c725b9545e7ca6281d8703f
SHA512 2725bc639f1543a0f95b42d2008d06d6198540ef7699404416be7e86aa087d7bceeb653cad68c1447bff90b8e43b5edb92a5f7c357a583983eb55331a47de52f
SSDEEP 12288:XuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D2548955F1EBBC0039C6764428F5881E2DEB5659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c8e8d42079ce8ce3d78823379ba3c41c6e77a3e1e1d0005864a82d681f324073
MD5 653225f6f6b2072019a20c2d12ecb8ae
SHA1 a930445fc71a5478cde331ca654cd5e269342f0a
SHA512 8be97afb53150097334c7aaa4ebf32ed37bda46d759d6b5585a530e426406940afdeeb2a7efa3dff384cb3720e7e8f84f30ce0afe05589601f07bf2e85acb189
SSDEEP 12288:2EiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11A5523D2548955B1EBFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 7957bf5f1f062014f46b63bec208b1e73c20fef7236f90c2777df9abd00b8218
MD5 77a85fa1550ebc7739d1470a678d0d83
SHA1 efde0d7017e52a7ac78d5146b027e79d957bc285
SHA512 e5c594acc79d7dd456f2bccd556d5028bf9d9c335d0ba80d133aee69b2e731b3f5ed94d1b5b5e6e71e14ba081154c600e1f70f42bbe0692f16f36f87d2109fdb
SSDEEP 12288:+ziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1375523D2548955F1EBBC003AC6754428F5881E2DEB5659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 9151350481f782298101e355a678950cff0a39e5bf59a10b11b9457e615fc37f
MD5 70ca399de7ef73faa65530c639873c28
SHA1 bae8db8ebedf0ab79a9eb817cc1c1cefd994b365
SHA512 f4f4ca4031fa406da7aa372cb69a402c73a07106aa3f418fe2b9190c9ec5040b86c2b1f353593e55f341ea3bbf3fbef169653d98e5b786075595528ef3e7e64f
SSDEEP 24576:Efwvzk9RX6wkyAIs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PMnYIsLNiXicJFFRGNzj3
TLSH
T12D85D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 914b9982a5ac86660638032b655c4ae78817cfaad5bbc6c7619a33dfd0f0129f
MD5 6426ae29ad44ad76f17876454d7d9fe0
SHA1 876fd311d0d39110c90ddf73108535b1d87e3894
SHA512 a5773187511189a1dcead944dee42dbe9c8d4b8c2be45ed9553ea00ecab7e4f87ccb01ad34c0955386c966bd08187bf69440e8222cf80264323cde57b19b8e60
SSDEEP 49152:rYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07LNiXicJFFRGN:2ySzPD7wRGpj3
TLSH
T115066C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d769a25cbdf784ac9511c5a06a75258cf30cae152ea17efa2c871caacdf768b7
MD5 64242dc39b4f1f80ef1d02f8dc1383fd
SHA1 4c1a37e44117d24f72be7f159acd0c0d606c0bac
SHA512 fe9c497355c5b155f6fbf2a58ebf53d7f9cdc1dbdeb63846b206996e3e1c64ab13061eb50b625e85b7c13b1a8aeed16cf3c3a75e0bb96bb95a46ca2954ac31c5
SSDEEP 24576:C47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:C47JUQjqirIhCnDHUPfF/LLNiXicJFFS
TLSH
T15465AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 21788d53b1f140422e6a638bfa477d5537beb4efd9aa8db98487583c362044b9
MD5 58f5fd431eff831b81bf0089d13ba314
SHA1 c5993f7d87256cba9ea61be04c94b1faf60b3d57
SHA512 7fe377ef19a243fd9cd655a18ec3d2d7a19ecff221f6f97e228c14a0cd96d9c63cf182e12f02b7ddfbbe9dca1f8469002a8b4fee1349d3663201014a69bba2ac
SSDEEP 12288:vpsfmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13F65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52D0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 267370a8f297df54f7baa0fd7df34e33ae5e8ba1dc7ae2f97c3376e5111aab0a
MD5 7bbf519142fc9bcc91af13ff25c6fd4c
SHA1 1df07ddab907001bc24c1be7ac6397b0736f5523
SHA512 284ecc5965fb4541e76877a578a870a3ad0f95c3373f40bf275e1cd1d183ec4dc6655c2d8645f52ef10072973dd909535c40b2b6d59ab16db799f52a3066d98f
SSDEEP 12288:s0wztU3fGFmiBnV7Lv2ihvzjqJJr4VoGqxw9:s0wJUP2VvN+JJriofe
TLSH
T1C7353A50766BC75FC6A940325E33C2CCA7707D41EE05AB0372C9973FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 91db94ce639161c3e8cde3a48a5582425812049bfe0bd13049aaa2d58872f1ea
MD5 177b1597e6df5b11a74d8a2412d78e55
SHA1 84973f434a965e4118c305ac0423dd368fafc8d6
SHA512 bd48363db0435950fed04523e07d9d5a809657214c8b18ef3dadb8bfb6f38b14bc0aeadb99b7388f85cda05ebeb8f03e0c67b59d147ffeb3878c62b7268417f9
SSDEEP 12288:TuJurwzh9CAIZM+C2TZDoNMA63/QLna5q5:TuJurwzhIPTtoNMAY/gx5
TLSH
T1F465E881953BE39FD1F66032076A5B4DAB64AC1777086F2773C4493AD82AB2570BC3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 47f017a04f9a1091e766075460b4f2081401737a30b318acbc251c4d4afb5928
MD5 0671c99e803c942e64dc4b38f205d113
SHA1 e1bd34d840fb40f16045a89d82cdf7053a69ddc6
SHA512 41618235f956789b4ddef790d3b99fe4ae581e7fa13ebb40c214927e2a7ae81ed4043b2bb957ac3a66c45bd031305b3c05cdb66376192f206241bbd46994f8e3
SSDEEP 12288:MF7+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FB5523A3568C59B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7d36f4e73ef7ead80ac09a945aa9dc6024eb8e4e9fea2e02254ff8d53b517a01
MD5 10d9406e4d4f27931afbfda22355c7b7
SHA1 bb460c2d4e4d7128cb688850d820885c49ee6f2b
SHA512 41348ba3fb75508daf77b577de0a612092c141e57d6ede3d242ed25f435170d5b65e66a02d50e884ab8eb359b7f0b2bca080ea4cfc6f423bf4f55e3d1f198dac
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wgb4mBIBhGF1LNiXicJFFRGNzj3
TLSH
T15B65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 311df94a4553292165143a9caf96276977f6a16fe4afdcaa3a2ffeb1fdf91b65
MD5 d82c4b43f7c64d6b40ef0da94ccf9f61
SHA1 1decbda35fa44e0b6e7ccdc99696ae19e98d9e71
SHA512 e80a18736ff4925680795074d8fbdd0a2e77fec34a46721ef8d4fe03107763f2a6469d8eeb043dee03d0ae25b5470d0a11e14e1877840cdd2e04cb931ba8dba4
SSDEEP 24576:tG88u8FpJqH1vzria7/ml/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:g7ZFPqVya7/SLNiXicJFFRGNzj3
TLSH
T1A985F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9581dc8d33687ab32d0f2bee11bbbad2c5c91fd443a9aa58e1a18fd6e0525122
MD5 d7535d5b8d95c8aefe946cd88038f5bc
SHA1 b5e862ffa7677f5aab1dea4dbbc15ce68ea9e96a
SHA512 87bb68436419ac55b7e0bee56ca7cf530a855c45b43692cfbe19492d3f4238c79c5a3aef285d91aa97bf276f3c25e60f544e6baf9ef9ecb9efb908f89ba4df5c
SSDEEP 24576:APUr+NQZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AJQZLNiXicJFFRGNzj3
TLSH
T19765F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ea82fd064b9b08a3979142fd0ec857f7482a836ff3524467e56dd40f8e442220
MD5 11a14de81e561c220748116fb867b839
SHA1 cdb15b2cd5ee1ed3d76b9f1077bb556badee49a9
SHA512 9b1d40e604f70de6fa0cd579a5eddc33925709c7cf1b516aaf3585334d5fda32af3de03edffad4dffa26da9c38547e55289aab0923ff636c191429af51d1db3c
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJLNiXicJFFRGNzj3:+G05lO43bk7wRGpj3
TLSH
T182D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c5d42081a0d44bf27b4f4dc0ad893934d13d347b0e08367b64cde1646273392b
MD5 0a5af04bc777f5418b2ad3e3e45a41a6
SHA1 763aef859b8da484f9b639826a62a5e4f72971ac
SHA512 706e5eedc9d51545767208fd895fa82f0311c97f10ea02cf06ba33d4f3cf16c48533b1dd9a3d5be7bebbaba2b820982b7a9b5444932bc52364d1a90b46c1da95
SSDEEP 24576:1fa5POZ3dpyWVM50JicR2hG0lasx2+47eidn7/TwSfVcYG3K/cJHlnFR+IGNe8jg:Va5POZ3lJt2pasx2+mRLNiXicJFFRGNf
TLSH
T1A065BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fa09c4f5ac4b80d045ccd4e4e79b5e62b00e8ef205a20aaa94c46b720536e9b8
MD5 48b5e446cdee8d676643032f177581bf
SHA1 4332aaeb9ca24a6f6ce666b616c62bf27daab4f5
SHA512 f884739ec0054256982762f4e4b2c0ad29dc96bce24f593391075cd370941429e897bb1e721cad5d410d9334d60493c2cb02d8eca80832f4c6dae4f1088e407c
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7Fkt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VNc/zEOVHFyLNiXicJFFRGNzj3
TLSH
T1FE858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 268f2253544f061a4ce525a5137d111130ab6fcb9ec24593983e9792690e1c9f
MD5 a30e41ebd799b534800a63b6c49350a4
SHA1 a610282bf31c3fc33d19c7e61d28a62b17df0db8
SHA512 8a028e4d181403720f5e8ccdc538136713c9993b667923980c041b0d45728736615973ca94a4949133c75459c471d5c8f2bf1577872370864b5797b6d7c70afb
SSDEEP 24576:zzkNvNnaFeYhJNtmZBmH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zzMwBtOmHLNiXicJFFRGNzj3
TLSH
T11955AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 de91dca1464086a80e8d2a0c8896da8fefc5ba4ae0818ce76515cdfe1ecc6b60
MD5 65d9a3e68852f46dee9dab8f76663130
SHA1 08c2d9ca9fd69b40486cc598a7ed97017f521ae5
SHA512 6e378a4a5f850f3038989af5b0c669ab7a3c8e4c1fd8fb79002c6c5433f47f72806150efa36a9921a2d8bebdfa0638f298e6898b99e20e7ed17a3c482ddb2389
SSDEEP 24576:zD3FHshBIYQgA0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zDVHeBIAA0LNiXicJFFRGNzj3
TLSH
T12F75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1460-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1460-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1460-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1460-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1460-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1864-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1864-39-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/1864-45-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/1864-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1864-49-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2872-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2872-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2872-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2872-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3156-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3156-133-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3156-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3156-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3156-135-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3244-120-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3244-311-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3244-121-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3244-114-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3452-0-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/3452-76-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/3452-1-0x0000000000D40000-0x0000000000DA6000-memory.dmp

Download

memory/3452-6-0x0000000000D40000-0x0000000000DA6000-memory.dmp

Download

memory/3452-416-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/3452-8-0x0000000000D40000-0x0000000000DA6000-memory.dmp

Download

memory/3572-106-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3572-312-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3572-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3572-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3572-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3572-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3752-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3752-83-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/3752-294-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3752-78-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/4740-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4740-245-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4740-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4740-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5116-20-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5116-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5116-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5116-14-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5116-21-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5600-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5600-88-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5600-94-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5600-471-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5600-473-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5600-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5804-190-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5804-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5804-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5804-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download