4b2a68212481dd72c33ac48c2a4f0538d0eaf1d609221ad9389cbd946b069579

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.5MB
Sample260803-plagraxenh
SHA256 4b2a68212481dd72c33ac48c2a4f0538d0eaf1d609221ad9389cbd946b069579
MD5 0730c8e7f6520d60526ebfb6a985d6da
SHA1 a15122dae148913710670563e6db34ef08afa52d
SHA512 bde3d67e21f5f0d142e52bd9070000daf8264c7a6cfd2042ec9f9c63576bfbef271101985069c3708f94820f631b98e1217ad84b71732161fabcb0c5eee2d397
SSDEEP 49152:jrxRP9sg+UqVks+J3LNiXicJFFRGNzj3:j3MRVkN7wRGpj3
TLSH
T163756B1277F99179F1F37BB19EB883645A77BC71AE39C50E6280215E09B4A40DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5376	elevation_service.exe
2856	elevation_service.exe
2752	maintenanceservice.exe
4960	OSE.EXE
1920	PerceptionSimulationService.exe
1080	perfhost.exe
1736	ReFsDedupSvc.exe
5364	SensorDataService.exe
4812	ssh-agent.exe
5660	AgentService.exe
3304	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2d0da182238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000867fe6154323dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8cc121c4323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000946f98154323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005133ae564323dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6ae24154323dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe
2856	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4324	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	5660	AgentService.exe
Token: SeBackupPrivilege	1736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1736	ReFsDedupSvc.exe
Token: 33	3304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3304	SearchIndexer.exe
Token: SeDebugPrivilege	5376	elevation_service.exe
Token: SeDebugPrivilege	2856	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4324	2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 2792	3304	SearchIndexer.exe	102
PID 3304 wrote to memory of 3592	3304	SearchIndexer.exe	103
PID 3304 wrote to memory of 964	3304	SearchIndexer.exe	104
PID 3304 wrote to memory of 4536	3304	SearchIndexer.exe	105
PID 3304 wrote to memory of 5896	3304	SearchIndexer.exe	107
PID 3304 wrote to memory of 2488	3304	SearchIndexer.exe	108
PID 3304 wrote to memory of 4900	3304	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_0730c8e7f6520d60526ebfb6a985d6da_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2752

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4960

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1920

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1080

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5364

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5660

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4536
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 60ba193536f00578ddbc5d688b40f3da21d431e3b82c063ce5679b0b55b16547
MD5 70e5185c66ab87e4bea85377fc802f96
SHA1 1effbe0b2a66e73c7d914950cd001484ba634a5e
SHA512 bd53ecb0a8c074f40dc31b869370cd8d0510f4438b2c2f5ec3cf5426cfcec9a81bcf501ab107793efe1d7c89ff6e9039dbd089058e355b1e6c965c3b7bca848d
SSDEEP 49152:db+632BuPkFKRrdE6ohdstBhuXjfS4LWxnFLNiXicJFFRGNzj3:j3q6mjBK7wRGpj3
TLSH
T1B7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 abb6718fedd1227b64b16490a0a3dafb854effd54dd22e23905740147ad71a9e
MD5 02eee4f5f559c079584e1172c31dcd53
SHA1 9876d9a14bb35c0ad9a2fa18c136323e544ae295
SHA512 ae2624b217dac44514091700910f0ecafbcaa071b2ab07218d9f2171b3e6067a4ea91602eb2095cfdacb71ff81828b31968a64474d5a0667f288fec9b0d8dd91
SSDEEP 24576:sXYfDtczAO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LtcDLNiXicJFFRGNzj3
TLSH
T14C75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 090e035d7eade160fd185aa5427a056b0e23c36af2f56dfcf21ac52dffd01231
MD5 32b1ef3fcee03de51e06025f581324db
SHA1 55925100c907d63052d2bdd4e8a28a2547ab8047
SHA512 77a13f73492c2f4e4133b62ca585b80e70d932bc033f68c2e7d8c6393d324c38465a8a45d48be79420ce60448f4affb9fdae6c1ee19ff5bef7ca487412361416
SSDEEP 24576:B0Le5ji0hmxhrMd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BPji0AzYLNiXicJFFRGNzj3
TLSH
T19C85AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f433e810cfeea610815e2a746527bd3b9a95e26c6584a8847c6171db7c43a553
MD5 24d9ac5b7d66e850baffdea2135e747b
SHA1 14f7d5e101a0d60109fb11209e0680cc38aa0386
SHA512 a9db29ec18de10df0df84c6dfdb8fddc98160b41856f72b8d5e135d401472546e955c640fbbbc11e277521bc169d79a85dc7d56637f6dd8ac425c28a477c7381
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWj6q8wyuz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:K/ezSC6vUzPv+HjyMLNiXicJFFRGNzj3
TLSH
T168756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e99976c664c2b773074fb21926965b8ec9532de0670ab60187acdb6f4e55d525
MD5 44b17df7a7eb0dc1e1dcf036b07168d2
SHA1 5cacdd107b9092d325083e8605b91841b266f87d
SHA512 7c9fcca53dd7ebac2cb0147ac3dcafe02c4f79732d1ef2813605ee7c527cd0564a9ff93eda21192223897c5151d0da2a8c63cd8618f38e3460fef1e22462e66c
SSDEEP 24576:zVbqPb88hv/l+B6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zVO88hXl+4LNiXicJFFRGNzj3
TLSH
T17B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ed07dddc373903f07596d5a4cfe2f56dab221be1a5b299d034fd76f9a713fc36
MD5 470479c524d2765aa3073462852e602c
SHA1 930f8aac83f0279f2fb47e9278ffb6ddcd65d5ea
SHA512 3a260527c58fa5cdcaf727dd677af524d25bf6e7bdb42b5f011f7d5852cae5af84cf0e590e7c7e74865459e33bc97095cd03ee400d00d714b816f996a6e189df
SSDEEP 24576:zGp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0LNiXicJFFRGNzj3
TLSH
T1645523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 367d27060f04e108c5c6695bbef218cd6a97f91861f2364bd4984f4b000f72ce
MD5 1becd415047297d4b009b8c1c5ddef9a
SHA1 ea6260b0e70e7ed71b587506bb683355101beb6c
SHA512 a4990ac9a00e0f9f28e69f588aca2ce17cd64f7f9767e86178c5370bc26962bc45a4d6e6f1fdee30c7042dd617b3f14dd676f48c5161a300e45b24945654cdb9
SSDEEP 24576:lJIUS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lJIUSLNiXicJFFRGNzj3
TLSH
T11875CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 03006501dd2a5f54de4b779287219498c2ef36ae08097097b2a43860328bff49
MD5 b13acc2f7978ecb3b4e988e4611833a2
SHA1 7e0f48abd18ee77b1baa75e02b26dfefa38e2516
SHA512 55a139eff4fae1f4992c9df41afed5ee0713987531a6109b06132d521da7b3dc27cf245b694b231aa7bd03c389e76c8dd53f2c4818d098627c1c6a6cb1ee39d3
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THs:TQvGAdlCEL8c/WRNw5Cj7wRGpj3
TLSH
T1C1266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b77c3a7a18b4279f531282a68ac87e4ebcf7b7e6dc4cbef9c9ea26d31b4390b8
MD5 1371353f399e819d00272bc390884bb7
SHA1 d8ae98e536046047de69f3dbc6fc86ceb0b95571
SHA512 0bd426a6f939b2d6db56657bbc3517588725ca9ca97c2fb8aa675f0883d573f6603a1e017290ddb2ab85a641351330fa1e09258542fc95f599d487e5e95200dc
SSDEEP 24576:YfewsAjI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SljILNiXicJFFRGNzj3
TLSH
T1E375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e863016aa949568cbd3f9cc5abeee1b9ead9579de468d6fd89d2a6f5b7bede9e
MD5 d4178f5a1b960524e7abba491d750f8f
SHA1 fccc3dab36d4b1b35d168dfb1928e705bef373bb
SHA512 abb0ccbf50292977cc534fa0fcf23e033e819df3923c53672f454fd4d733638c9fe4ef3d562bc4bd47341158f696be9f60dba2bc8c1e329e45924d0c6ddbd2d0
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHMF9:qUEtQevvqc2W1cpV20I32w9
TLSH
T1EF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e7a76a4a3c96cf86c123da751dec56db67ecffe97e76d2677fe585cefce2aa21
MD5 ff12067d197d67ef6d304821ef047437
SHA1 6c243798c5fa747586995c196a2e6384546f15f3
SHA512 56379a5a6cdb517bea8e30566a39e41110a9945d9e696d147787d5604e12e3c3adaf8e911dc20a114a701aa557412c580d372bcf3832de90bd8871fdd194e763
SSDEEP 49152:1CbRquA/m2yL5zLfFiV+XenmE3/zoLNiXicJFFRGNzj3:ioq2Vjnm37wRGpj3
TLSH
T171D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f4e8804ec4cb3086767c6bb19190420a334963422876b0f7931c74c8a13dd86f
MD5 2791e9238ce1fe3c822f10c3e0247294
SHA1 ca01c81e6363b5138f3bd460d5341b08d87c986f
SHA512 14002f7b8f9a30faaab9ba683a16321763b871f474f08034f7152748c6b7402210e9a2aa50fcf33b20dc489b888d8db798b57385300a998587d60c4d820ea435
SSDEEP 24576:IAhGL6IFoiwtA5l7S53X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IAM5Foiq5nLNiXicJFFRGNzj3
TLSH
T1B0359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 79226bca8208a301f505230d8381af8c5ccd397181119b0bdc778df17b8eaaa0
MD5 18504c940be6a133313fde46d51cbc67
SHA1 0d3a7067f238b72be7b4d2e8d3fe23d7a0cf8743
SHA512 508074c323d85a64f2e21948f1358c747d4258737dae43e5eaa5165275495fcd3a202b99689a09c984b424b0511d74fa5c05b21c4fe38d41c0f06fab50484429
SSDEEP 24576:lwuROWs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lwSOrLNiXicJFFRGNzj3
TLSH
T16965F18672940CF9E9BA41398657C036F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a38df19e4a3209101d4322c6c0a5d2b654cdca46a0607c7ec94af4da0a21056e
MD5 e5b864a2c7096619da718a9e17148330
SHA1 d49b374132819b2effca7be23b508fed6b6a29a1
SHA512 10ac435bd406103b2b81c0e32e8931e06f929f3e4d6486dafb4f27f76cf9e5fa05a943610ac404ff12132f2d957d7c8982e720c06fbccbb17ffd4f29b69c07be
SSDEEP 24576:BZu1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SLNiXicJFFRGNzj3
TLSH
T17C55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b7510cf7d00eecb3699f96ef3887571e06b39bb429b17edc4409107b138f1ffa
MD5 810c28317429aeeca7c2cc9de917ab9d
SHA1 6248ff482b1078a85c7f259b35191a4b82d32c81
SHA512 4627575bf17005e67ecbef14100f1f9d38c448e447f1887becd17f9f764fea9170dd840df63d52db66106e5461371ae3a195f6817bfdacef551c91f0346950dd
SSDEEP 98304:RQRQyi36YOcPDLvw2gAf+PN3G7wRGpj3:IQyiKanX+PNaF9
TLSH
T1C8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 06a3578e2b989d25a85a0cfe31683c5cf3c48742111eeb16708d44a347ef994a
MD5 8f98c95b4e758a142f239ca5a394fd24
SHA1 441bec7d6143d4501c255c715ab6e659afb852cd
SHA512 ef0d8cafac47b441d24cd1aa2351e8a96476f61a2b2f1314861e98d3bb1306e83a44ebce2a57632084714ce4f1bd16ea9bdc179b98187fb69dc0ca73882f4eeb
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3G7wRGpj3:BQyiKanX+PNaF9
TLSH
T139667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dddd84976a4eb79024fe6b11a0663d42df7450772509f99d84daf3e7ff59d6d8
MD5 188cf0d4a857e9d261435b1b7205f0bb
SHA1 94d21f8ee38db4aa170f2ccad89aa3bb2fe7bcbe
SHA512 ad2fe3bcc228f9e277ba4d41d28bb0ce94cd1d58be9b4ed55a2366e09dddf790c0443bc0c979c40d3a4d3337cd808e9bb3587e5132b0511f7d6810389cf54630
SSDEEP 49152:768Qg55nhkeWu7PNU3/YLNiXicJFFRGNzj3:FthTRc/Y7wRGpj3
TLSH
T10FB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 340803abefc5a5929d6be41bc5e53f4a4b271a1b372ecb5e632ccb4bf8198e7f
MD5 8847f1d3ec37c63af532b9f357eed776
SHA1 f671f317cdc6595ba6dc55d9cc3f28dee9450bbc
SHA512 51f0088b94255aca578571d8cb4c414dced54ffb8045dda9e45203b3ddea2cb7b584e5f0250423e3355a2e3cc0dcb5bfec89d393abf715070182e5dd3f2ffcee
SSDEEP 98304:Vy5112gYy5azzVvU69nLKnhZp7wRGpj3:4LIHRWhjF9
TLSH
T187167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 91698f5ee3e627e5d8140f4f1e5453aa0fdd8c50f7d492eaf40b0a0d8bfab8a9
MD5 f1f772337a0cf7c5b98f830deb7821bf
SHA1 e026b390a20435d5c6ab6c66da0d114a1a3912d2
SHA512 39e862dff600f89ec3cf7b80bfe013a8d3cb4cc554251d22a1aa481cf7015bbe1d0b635fb70569956921a1f7b60507cde12dc7bd24b1b11960b9304c9eaf20b1
SSDEEP 49152:9B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gleLNiXicJFFRGNzj3:ju6JmIxd2de7wRGpj3
TLSH
T12BD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9b2c5c7284f07eb76dcec4626ddeb8e3baaab5a12870279917f60a15b4076ddd
MD5 f2c7228fabae7a9b254b4e0af4f516f0
SHA1 030a08f081463d382e58092d441d73dbf4740cb9
SHA512 886189cf8902ed1c24ac7750db6c985e3102937866c5dc00a2589ba046142e151ac7c74e990d10880ac352132fd3dd74ce91657c6c976b98dbe73e86611d739c
SSDEEP 49152:n1hpsNoJpF1A67U44CwH7R4xyLNiXicJFFRGNzj3:nmifPqR37wRGpj3
TLSH
T1B7B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a4bc3837434ef7c8a4421b6d4ce533056458df50be22ae5bfdfcf5d19000ec40
MD5 3e4c01a506138e9d769b594180ab857c
SHA1 689c1afa6a9f6c996bb367851d902ec101cdb239
SHA512 b3703e5046751238c3c7e1fb4f5d8de7154ee6e2b58d0e530262a5dc7f3a4d4287b631a9f56530a71c27245b50320fe6fb553eb37fde45e747a6878b44ef7340
SSDEEP 49152:ZSuZQIY0Be2KkRVtOnks6NMHq1LNiXicJFFRGNzj3:35dKqi6117wRGpj3
TLSH
T102C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1a919bb450c60416281c5be152a52a77b1c4dabdcdc640b4618c0a9d31d1df1b
MD5 b641f64afa88cb8092fb4f2562fa7508
SHA1 7b9d73164251f7a2fa605eed29d40dbe6de4f7a7
SHA512 4daf08104b99214d17fe0997f94e5caef5ff7f228e681031e72db93dce550134f0b4db4429c73d85a5a88aeaede78ebad73fa155ceac716c148251ac4d1e2b37
SSDEEP 49152:ghtSn8EApI0figjgiDn0AP5wOLNiXicJFFRGNzj3:xX2iWphL7wRGpj3
TLSH
T18E95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b3d5cb150b0f30bf8e9ec7a4ea95a9cae95b1d8154ef3c89250a8c0661f80754
MD5 d50a59102d77910025ae45d2f235d664
SHA1 d71c64d5a16c738f35c8255d690ad49005e97709
SHA512 7d2bfff72447a005e878ed8cfb9aefac50135bf545126614b45eb69b0ea09d0dd9edda892699f9f540cc79a29847ccf0b5ed76f12959267b3b0401ede96cc1f3
SSDEEP 12288:XdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1935523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7ab30e2c5fc139bedf0c848438324898182d74e106e767d0d281fa0e6b628eab
MD5 cec3d707b8acabef066b6a3fa7255507
SHA1 fed215e5eefe2bb84afd51fa693d326a128d7ed3
SHA512 645dc2acc03929c7eb07fc11f52c2895de1c520d05d72e5e8a34a2f6351fabbfd52aca044d5ebce474a552ea3f960df9fddc71cbc3421c637d1d8a92e3cb7558
SSDEEP 12288:lSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:l0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B05523D3548955B1EABC0039C6754428F5882E2DEB5658E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d10e09409bf0cf908beb8e4ddd29f74cab2c2fac33823791e55233728f7f15b4
MD5 d55a6c0afe451c6b2fbdd8015dbc0c90
SHA1 f51ab4b1e5d83d2ffaacdae537d2e8e57d0f3df4
SHA512 bf13ab6e380171cc609458ddab1e34790060228853df0dc18c44387e9379564ab027fd4a7c303018c486cc30635b04f0b4c83306e70ef7911944e2a4c24d9522
SSDEEP 12288:P4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16C5523D3548955B1E6FC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0d0a2b320b4d32e1bc2fd0637354d402f32df96e9ad659f9f3fd7f01d63b09ee
MD5 2a64dcebb55f0da3fb5c8ba6304a3393
SHA1 ccface4b099d5c76ba464d1376159da6a44df5f6
SHA512 81030e0d549a4b56965a808f5bbe707140ec5192a9e21628cf12e49e10f1894f5a6e5c05edb436c1c40c1d5aaed854bb673fd25b500958e76dd06464d06a07a9
SSDEEP 12288:VVDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T150552392168900E1E9FD803DC6764424F2A47D6CD7325AEBD3003D1E5A75FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c21fa08c40549e53c257dd11dac6a8e2496c3151d2016986cb2b2708304c7442
MD5 6461015f651d0c5c0b435dce3b0b1e13
SHA1 12f7ec6a23f99836600ae00faad8564190f2a1a4
SHA512 8696a65c2a8fe4cdaf4c3e1df93cf41c860f1dfbfc1ad6114be2574059bf7d68202391153888160b5a6dda625ca369adee12b7488feed9c1fbb7fbeb7f4355b2
SSDEEP 12288:YLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C5523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2be96d41bd530952b7fa1a7b7f6e0e6d3034ed0c81c3eea3cf94c9bac4cc3596
MD5 87595621289c3c2717025eb416ecd28e
SHA1 d90b02c33e04a82bfe07a2b4ba2dad253664ebbb
SHA512 603c981c3cc03ceebdeef7c744443ca26de8e52d682ed071d9255eac056edfa74b5f216b7408026fd57ea2036e220ff3313ae3f00352fccae3c82c475d5aa426
SSDEEP 12288:L2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1735523D3548955B1EABC0039C6754428F5882E2DEB5658E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 895e06d232fcd34c2033afdcb87362fd3e4b41665ac55cfc2b9db0c878683acd
MD5 5c1cbc81929dbd2e354913c85e8c8397
SHA1 126c468a466b2b442e955da01e319cd766924162
SHA512 0f9b7009a54dc4d7e0feabd14db3ed2417cb3b12d91350085ede0e75b8fe8ad6857f64b20041bdcd186697d0f7c9fcb863280769a18f98c82e884bf1542195a6
SSDEEP 12288:waiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F55523D3548955B1EABC0039C6754428F5882E2DEB5658E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 94bda2aad87a1d5a755e38a1d1757ab97e8e85aaf7adc594bae05e869ebf005c
MD5 f88629113508458b10751f4d93c2b97b
SHA1 6d6fa30d2dbeb97b58405f21c2dcc6c1a0aa9b31
SHA512 ad0383816fb6571d831ad721e623686e6d66be101b4e2bcd16d2753a065b373e484ce0c2e5c345242ca5b62fa73920c4198a3e8bc6be43c1a8359754057e8376
SSDEEP 24576:nZM3zFVSOU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nZM3zfwLNiXicJFFRGNzj3
TLSH
T14A750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4e32156702883c6fb7cf1781b59eaa2c13d3475a016c3f239a2d67426eb0204f
MD5 55e909f653e708750d381404ed3855a7
SHA1 35bbe7ae19fc45823329a111433b26c6394a87f4
SHA512 788752b7ed1bda87181679bf65d4b863352a7bba59815aaa7bb5823fc4292342023a2d6f33481d6954a7edd059d4213164585c0b1590d6be122363a0d2f20f3a
SSDEEP 12288:05iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1545523D3548955B1FAFC0039C6754428F5882E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 949991015d52f694bd24306234fe2c4a995417782c2b50c29fd8fd2a5207c4bc
MD5 1b500d8e9974ff2d4d58f5dc966edc87
SHA1 a58a7d0f9bab5706ab570f51659a73a10b064d6d
SHA512 4b151f97ffdd2ab84a4a5079bb57adcb34ff9f21b415dbc21ee7c8560a392c8c846b9bf0305b5116719580a8176b82eb1a80b9dfb664262ce07300105d31e19c
SSDEEP 12288:E1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C75523D3548955B1FABC0039C6754428F5882E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ed4fca7159b5b30e76a0e83e05ab2bb1f451db565b26f480b52a69a136f96da5
MD5 67e0dec6fcc0436bc92bfbbea1355ebe
SHA1 6767f3df19b37dbb97061fc38a68041e01fd33b8
SHA512 6552a25bea7a24229328c3e207db30abdf7b77279cd312fa383ef66bdb8d4b67039993871ff17c84312e02d2da9ba75000293d02b33b54b2dec3ec156f159b9f
SSDEEP 24576:Mzy4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MLLNiXicJFFRGNzj3
TLSH
T17E650247629530F9E17A4139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d1d50dc84f94b6b2d040745ded5936c5d954100038e0c76373d598aaa95d5c4e
MD5 8c64e475872a335e0f14923c7cfde0a8
SHA1 7cb5899e37438b397f380d57df3cd80666595eb6
SHA512 37131ac134168aa8ff78dfc5ca203bc2c053256f8a9088d7447dfaa5dadf127d748eccf1cef05080da41646fe61212e7fb13ce60419a6b3887243ef5a86333e1
SSDEEP 12288:x5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1835523D3548955B1FAFC0039C6764428F5881E2DEB5659E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0f04f0fbd54b943e6e3888ac088dd0f98dda66f3cf92becdcd3671b006c0d372
MD5 a92593cedc6a39e44d76f778ed8336df
SHA1 bde3bcf42ea0c25ae3fe45fd9f059408a64ff3dc
SHA512 2c84d90a2971b22e6c941406881d1e4d4e758aa6de7321f01fb4c7a9c048b2357b1c9b37ddabf676148327f3209ebfea7beabab60a84fdebb7622d899ec87374
SSDEEP 12288:r5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C5523D3548955B1FAFC003986754428F5882E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f7d899d36b1ae51fd827fd10d371f1337489471444650edb3cf6c04209073bcb
MD5 cdf340d6bfa59975953184873851ede7
SHA1 25a5ccf03c05291125f44b768ab9abec429fa6d2
SHA512 0dc9d85148dff499b35c2bc553b6aa6e15aaa8b0b13530d8ed736651b6befc2a524fc554408eaddd18c01d5b9fb04042c4a91068d310cc5ff60fbf7005e87fa9
SSDEEP 24576:xzy4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xLLNiXicJFFRGNzj3
TLSH
T16B650247629530F9E17A4139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 4891d462549c60ef89d582835239086a045ec58763e8ed209793afe5055d2ce1
MD5 0ec8318eeff9f4567802fa41178cbd83
SHA1 02eb0eabe2e6e3c4dab11e5fa42cebbd5e3d3ffc
SHA512 d829211304f714ac3f2431d23e619f0ba343103a8ea4d5aac5eec38c6e368d6c4b79a39b338190d1211dc9a9bb24287a9c435be96595fca61e39a8a4bc9dc349
SSDEEP 24576:zT8aLl3z0zDa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zT7LljzLNiXicJFFRGNzj3
TLSH
T1707502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 05020513c3be8c5f3fb6e0271a3f47364cef4d510b18a90cb92e93ef6efb354f
MD5 a93ede994f5e6393ddbff2789c6d7110
SHA1 0cb95308bf597646275bc0241d9270711dd83ccb
SHA512 3d41dbd28b7dac6b0bf2a2af82c8fb274067adc93dba683748fa3291191c7c42fa26c9441d7f5c7a7fa017096e68f025983c29b621371e82fe2f7e4646eb0fcb
SSDEEP 24576:43rd9CHKy7GZm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Crd9CHKyawLNiXicJFFRGNzj3
TLSH
T1EB85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 24bceabade4706d6bb01ab8ffd39435c8f88cdfef91b869d8beda864539d2243
MD5 6a0115f94721daf887aa8cf615cb08c2
SHA1 32e0dffb77c29b3efc859df3b4e1163b1e6e4f83
SHA512 42b7fcff25bb11d3b7a134d552628f3c8328b00a2ae35ba3c535ffed09e86d7c02a871bf38ed9e8f5a48d0c3c8a59f764c08e3969d467b9d5730e8e72ac7b7d9
SSDEEP 12288:8YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1385523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 23f2e18257a3774057e20f67eccd0968cefa6675f986ddd8f8e85c1492379d4e
MD5 d9c311fbe1814848d8ae048de22ce90f
SHA1 bf807afd9e9e746651a5cc29ce04d3e9c349875f
SHA512 98e850dc6cefed49821ae04c993282f7f3dc4e0bef1b413a91425ec8f9c13a4d5a6d12f6ca1355fca6c24c9532d534d110d6cc7c0ff9c7434cd0d8827dbcd9b8
SSDEEP 12288:luiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AD5523D2558955B1F6BC0039867A4428F5881E2DEB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 958110b6a995d52183e0d9a8ee01e7eea7d26295e477ff9f97cb766ce83182f4
MD5 9a3bf3adde37c3e8f805020313aa17b9
SHA1 9f4747b520142899dbb97bd36d96a266396d7626
SHA512 71f4defc7dc897838c45688bed5da47e93de4006883c59a2dc7dc55e533c91f855879e90e4b1733307f03beec8574797093b0e9760d600059955b42d09105fcd
SSDEEP 12288:cPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:c7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523D3548955B1EAFC0039C6754428F5882E2DEB5658E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7ee22b6c8be3be79576dfab7a95b7b66c2f3e94fa1c437f0e3fd58996cabbba8
MD5 f6326e16929043df8c38e41876f04023
SHA1 c1c048bf059f6fb6676cff38ae0aabca4c504361
SHA512 1487ed153a23b274522077b647b5c95fb1cbc29c9cb5e8dcbe09bc58ef6b772e635255b360f60d8d000a148b6d7064dd7b25480123b2e3cf91620404920cbaf7
SSDEEP 12288:M5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ml/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18D5523D3548955B1FAFC0039C6754428F5882E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 074fdba1f32b5819d9ca1cdf3638a62955bcf5dbb30d8e55caa26f2ed17d76c6
MD5 20005be13497b0f75afb280628f845ec
SHA1 0561de10b1a3d17922bbf36fefac807af41ea94f
SHA512 948b5e30c64cb7cccda78a29790d29e5d2431fd57bc7434d1cbf34843ed61615aca1718e5720cccd98a6cb33a2040f9c1e5ead7ff19b90044e3b29f52fca41f2
SSDEEP 12288:1YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1705523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a80a962e1baddee3eb79d7ed33700b5dfb1ad6d7c2149c01781dc603341d8678
MD5 5314e15b5da90b00f8abed25b8bf248e
SHA1 ce1f85516064a3f25dc57a155dc23d8469166135
SHA512 dedb4a47ae3f562fb73c203139cf4bf920e6de7ca651f04917521c95e211eb22768b752f568ee2963756cce7cf1e6df4ca93dd1b0d14368a93b1532140f01114
SSDEEP 12288:GBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1205523D2548955B1EABC003AC6754428F5881E2DEB5659E3E3483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6e9bc4a9b6fbf064a910a547a26f2765cd5de48401ba2141b842d2b297adfb71
MD5 c85183fd36aed326e9d6275716e19f05
SHA1 2583f6049e82e042b32943ea4f2f106e201d19fa
SHA512 0a2aa8a0e1fe7ccc09fad4005d76ce1e344dc85c4594aecc36bde760e5c7572fd213b0d316e3c54684fdeefc33ebe64470e76fed15ace4c9a22febaf3a72125f
SSDEEP 12288:uLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17E5523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 167c7ccf222fc0e3dd8405ebd68c46d5187fe6a3a268ba1170ab162b5585923c
MD5 1927a2c5026ba207565d586c9efc958d
SHA1 b250342e517560ffee8167b22627c9d54b9144be
SHA512 f125f7f842d537684102c2c6badd1b028f088c2d11d3d920d76c6c3e6989d5db2b23b2c01e0fe708c26d380b6209477c91071bbc85ce8384b74733eabfd7720d
SSDEEP 12288:pQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1695523D2548955B1EABC003AC6754428F5881E2DEB5659E3E3483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 3196727ff8bd916c3f3d457dead1e70efbd46df5fd8b28b72106d52c8e4d8fb9
MD5 2fcf923443d9b38c651de3bb1f8f5de9
SHA1 267fa285bbe2cc6f682999c81956d25a80d42201
SHA512 99546f00e8e2f66ee90ff0a44e73502ce5bd1a69da4f907b81f488ce06485ac1cc3a5947789b29cdd73fdc9719296f7aafe5f5ed6c6e6d62ffada141c1cd76e3
SSDEEP 24576:Kfwvzk9RX6wkyAIJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xMnYIJLNiXicJFFRGNzj3
TLSH
T1A185D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e1958b84199da8b37a0f493afb6e27f8fc9d8ea69d3784625d3c55cd468f3547
MD5 d01607dbc55d3d26708026ddf2cf3826
SHA1 be8d19d832ed66bc4db36c3e5c5460218abd51c9
SHA512 d82b9d14221548dbf39dd6321c174a843f7262085543d69099fea888d8fa428f1cf33b092fc9e465a1d7b400144807d0ef87347c313bbf42d71f0949fd7e5947
SSDEEP 49152:oYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uLNiXicJFFRGN:nySzPm7wRGpj3
TLSH
T173066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 323298e6a065e100141902daa29afa6d34463bc7622952d6625f300ec369f4ee
MD5 51371d602c912b985d5433f6bace1a51
SHA1 c566c34d55ee9f6ba042e3160cfaaa3e1040715d
SHA512 9f50eddb3df98fc30ce3c9730607c41c91b1a28629cfea4a4d6cca85c500d1b668b8baab42e33a08e65eea5639797ce73667681958161404dc689e684428c334
SSDEEP 24576:y47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:y47JUQjqirIhCnDHUPfF/eLNiXicJFFS
TLSH
T1F665AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 6d28bf57326de40680c11491eaca42fb64ede8071d6f6f365017017be7f7bd80
MD5 3dac6b2246fd53001ab5383c09331291
SHA1 7f532f285a1cb07f3d8ae4659a5e9eee02ac6942
SHA512 405f44a1f454948f303d558d099c065153dcb245fef31824db73a14a2b9d18def43805573feba84204e7aa34a4e62abd286270873d519e1dd4ac842d6f44fd75
SSDEEP 12288:TpsfpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E865F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 47a17acd9d6bafa9223e64325d3ecacb2d25dedeaf7b5ae0bc8435967eab2a2b
MD5 de392aff3bc6f1236d07077e5e15d730
SHA1 fe314d82fedbaee9b2b6c455fc5aa2604c47da5e
SHA512 883c1ec2385564bc8d22d31c0e37278039df0fe8af18ea6e2c95f0b1a72e57f772d311af294c518d6baddd82542476621253be3ecb27c9b5a89742527b10e0d2
SSDEEP 12288:b0jV9Gy5vHovKGHHnfYdPlCLIK5iErIBsOVfyMfB:YLG4WfixkiE0BsO9pJ
TLSH
T13C453840762BC75FC6A940325E72D2CCA7707D45FE456B0772C88B3FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 7b3f4ebb572eb8b081e13c14fe6c5d62dca63a527146c63b4211a3d6c0058cb7
MD5 7f56fdaace9cbcf858b6e0d76b382f00
SHA1 f03f749fc97d977c1e2df3efdbffb763971cf206
SHA512 a96873fa852ccc6f96fc3c6ffcff1e25a12a0d3513891486ab7872a2616f2efda6b7d5b31dc4b19d7250d8167931aa2215e60c1de52a13bdb97206ccc8e7245d
SSDEEP 12288:GGX4xkg2+YRe1kae7By3C20XWxHwMeAtuzbhg7tYCiAZCmFzT31qRX2MgtXJd/hu:nlXHaquzQ
TLSH
T16965E7819537E3CFD1FA603243395B4CA764EC1777096E26A388097AD82B725B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a3259fa4bd03514719d709694705cd5286da1d6817b886b7d935c8ac20ee74c2
MD5 594ab805522af75601487a53d6828799
SHA1 a006e975d88c61abde45448a90759a97173dc89a
SHA512 d4b8a446908aff506e1905324b62b6d94689dfe5a7a7b2720df6f67aac0cb3c040a172a532315a095c10969d191071b849c125493065adf2dc600d7714e012c6
SSDEEP 12288:GF7xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19D552393568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 299df404b3065cb606be7558bbb3cc88c1dc5d97e7c1ed06723ddf220726701d
MD5 1e5a3e6f84d32a0119702153dbcff3fe
SHA1 e753b1ac3e3b4cda00be29d2a1a8d7cac63dba71
SHA512 29314bfdfffc6d8ebd451cdea95dd4b2acbbe7e64a28c9bb18993ab246dfa166b35f66ed68ac032152a0a6475daf968b547792c83305361c1eb048e36900dc31
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4gb4mBIBhGFELNiXicJFFRGNzj3
TLSH
T1F865AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ff5503e3bad840f0d0214090c96931d7ea49812acbc4d00f36e2542cc4f5cf4c
MD5 83a0990b92778f8f115f76144fac8a26
SHA1 73fae9cc87886dd333b161d42507fa511c4c1717
SHA512 b3ae781b6e277f9a82e269b1a30a814f1ab51ad3eab979c009a13d620ff4f0f2252430cbb2003b15f198cb91776b7228fbb56f654ba902c9567de49186dd9483
SSDEEP 24576:qG88u8FpJqH1vzria7/mU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:R7ZFPqVya7/bLNiXicJFFRGNzj3
TLSH
T11185F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f63165cf799529f91aaf016c5a3938d7341e03d8853bc0bd8f3a11f1e28f7359
MD5 08c28e13b7921f5e9c4d6cc36e90ee0b
SHA1 8a09b7bc274038147a5a5c147a62e3a412d60536
SHA512 093695d61ec4b1c207db9cbc89358331c62fd8735873e1a5c5e9d627fdf17252084d8779f0bb1effe87ce8316a56445a9bf988c723b426d58d8e9883ee30575d
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjALNiXicJFFRGNzj3:aG05lO43bx7wRGpj3
TLSH
T156D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 db989dc874a07e24c046c02bc86e158e31b6df9ac6fc63a2babc1c7b90d6b7e3
MD5 272aa19f4a4dd6f045aca77edc6bcd45
SHA1 d105615b80392f039a882150e0330f8b5386b3df
SHA512 ed6c25688b52cf13b3e8846eb7164a8c426d1a01e8954714e466c5238593aa9f9e3f11c1785f305b64c24e94ffade396b07e4d7968f7d03958300b3496d82a67
SSDEEP 24576:Gfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnu/TwSfVcYG3K/cJHlnFR+IGNe8jg:ea5POZ3lJt2pasx2+mYLNiXicJFFRGNf
TLSH
T14765BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d0c4a70a10788f7770477b723a38a420a1f20e8586f32f5a83c1d6e2fa90ac92
MD5 04ee4e0aad0589b2b4a27badd9ac012f
SHA1 2f63c02256d0d2b62826ae49bd53e5ec30c65d8c
SHA512 ea6a4f56be6f26878247c7542970d6b7c5759915bf38fdcff00097d4e08b774044b404c69b9fb6fd20fbe920a33000d2c217555fe261f8e52ef7db220d3128dd
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JNc/zEOVHF7LNiXicJFFRGNzj3
TLSH
T134858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 65aa74ed20e091e09d2a79c7fb377a19b9b640adc19070439e0d64d79480ff15
MD5 d11cf2f1f03649453062e49237a594a2
SHA1 66313dfc5e8fb52e59bf014f70e6d8c66247858d
SHA512 ccced5024c8a86649fb91166d7fa0c5ee4a3e2fedb0ca195aa8387f900feb1d12b1466361c13643ac072f1b1481ddc3ac921c06ca9cce288b3b6d70cf7d8ee93
SSDEEP 24576:VzkNvNnaFeYhJNtmZBmC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VzMwBtOmCLNiXicJFFRGNzj3
TLSH
T14A55AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d66a9dcd61edaf6a457cc390a4bc3d0061b1035956a4b16d4a160d20e9dedf68
MD5 a78518c20f5c9f3c426283fd7363a401
SHA1 51f26bcc1ba4ea57790456113ee081bce87ab9f2
SHA512 6f61e63bdeaddd5814b47b71df1a483eed0b63a91b2a3577ba8c3f2c182e23e640ac9d342df2c0023ef2af43197878ee6d0f0745dd7de841b3a28b3f8edfd22f
SSDEEP 24576:9PUr+NQw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9JQwLNiXicJFFRGNzj3
TLSH
T15B65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 31d91573acb1a291a464a6d2cc20b18b75c50c562bad9c53e97d322295d4bcb5
MD5 74bb3ba8e9951056e0ce765a18446604
SHA1 6bc8d0b99c305b355396b4d78ab535fe1d9948ef
SHA512 f75f9b7aa0001908b48fa6ecc118d7fefbf6e4ac2656d514ad80a2eea0d6549fab6201847749e7eac367743707e9c0f662bea72df6e7f31e006ff744e3906d0f
SSDEEP 24576:MD3FHshBIYQgAh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MDVHeBIAAhLNiXicJFFRGNzj3
TLSH
T17E75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-82-0x0000000000A80000-0x0000000000AE6000-memory.dmp

Download

memory/1080-76-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1080-77-0x0000000000A80000-0x0000000000AE6000-memory.dmp

Download

memory/1080-281-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1736-474-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1736-94-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1736-296-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1736-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1736-88-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1736-472-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1920-249-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1920-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1920-66-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1920-72-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2752-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2752-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2752-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2752-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2752-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2856-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2856-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2856-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2856-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3304-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3304-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3304-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3304-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4324-86-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4324-0-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4324-413-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4324-8-0x00000000025D0000-0x0000000002636000-memory.dmp

Download

memory/4324-1-0x00000000025D0000-0x0000000002636000-memory.dmp

Download

memory/4812-120-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4812-112-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4812-114-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4812-312-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4960-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4960-192-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4960-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4960-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5364-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5364-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5364-313-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5364-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5364-106-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5364-100-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5376-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5376-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5376-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5376-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5660-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5660-133-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5660-131-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5660-125-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5660-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download