5e671d4129498e0ac03fbce58c99de52f0bb9d8d8e7bbc429a4ef2a63db9c8f1

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.7MB
Sample260804-g2m4saed45
SHA256 5e671d4129498e0ac03fbce58c99de52f0bb9d8d8e7bbc429a4ef2a63db9c8f1
MD5 9106103ff3399d503812cb2129a4bb7c
SHA1 3ecf6a9010a8d9f6a9a010bbd7e3f0c0f092ea06
SHA512 6e19d05cdd64bcad118a29b935bdad95a5c1d32865325b95b6331fbea9182cb5bf071bff754eff71d9a1536734948f0abe5fd736c139cd966271ec29978c6024
SSDEEP 49152:+NZCWOLT49XGQ6m6K2MtENyv1PiqMymJ/+hE:cwnLTiGQHDtPiqk9+
TLSH
T10B855B1667F94128F1F33B71EEB992645A77BC71AD3AC50E6280125E0DB4E90DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	4636	Process not Found

Executes dropped EXE 13 IoCs

pid	Process
1256	elevation_service.exe
3752	elevation_service.exe
5052	maintenanceservice.exe
2688	OSE.EXE
5688	PerceptionSimulationService.exe
1260	perfhost.exe
5580	ReFsDedupSvc.exe
4564	SensorDataService.exe
6024	ssh-agent.exe
1020	AgentService.exe
3560	SearchIndexer.exe
4224	Reader_sl.exe
5820	RdrServicesUpdater2_x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5b678b8cd744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater2_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b573e498d923dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ad97c99d923dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f7a95d8d923dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
5820	RdrServicesUpdater2_x86.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	5580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5580	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1020	AgentService.exe
Token: 33	3560	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3560	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3560	SearchIndexer.exe
Token: SeBackupPrivilege	5580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5580	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	1256	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3132	3560	SearchIndexer.exe	102
PID 3560 wrote to memory of 2640	3560	SearchIndexer.exe	103
PID 3560 wrote to memory of 5460	3560	SearchIndexer.exe	104
PID 3560 wrote to memory of 5348	3560	SearchIndexer.exe	105
PID 3096 wrote to memory of 4224	3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	107
PID 3096 wrote to memory of 5820	3096	2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	108
PID 3560 wrote to memory of 2728	3560	SearchIndexer.exe	109
PID 3560 wrote to memory of 6076	3560	SearchIndexer.exe	110
PID 3560 wrote to memory of 3388	3560	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4224
- C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
  "C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe" R32
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3752

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5052

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5688

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1260

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5580

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4564

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6024

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 1.2MB
SHA256 a142ffe967c080a36c1aab824ce32498861b996d603ecfac92292dfd91d92254
MD5 dd8458b7607592c3a4defbb151d5c768
SHA1 0837fdbbd5cfa539df3d35da93fa6712abf3077a
SHA512 017d4b839b4dcca128b0a525808c7b919dbd66e419ec38dcd0b98da7e41aa732c36cfada37b99e77599de7ba2e2ede976b141666b25eec0ab8ff6614549efb11
SSDEEP 12288:HFQPrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:lQOBMvjRA+iqMIjmJ8c+hE
TLSH
T1DD552327269A4F53ED211A381CAA57F6C1A9D838FF1163437706329F4A7C1D12C7A61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 5035d8be251b2c2a36b1c26adac8f147e8ca51b8b7566cfa128b61dfeee96cac
MD5 d9c6d3fc9a6ac56305a49a001c368ebb
SHA1 70acbcb338e9e732601a101017c23a22a84af704
SHA512 99d8490288372ea7ab89db538e8a65068968514898b291a4e15485156d598850ef7b12f37ba1d6ba876fd6fe709d4e8d27f41918ca315a9acb2ab4be8ab4bc86
SSDEEP 49152:kSgouvAeFfenxyQHXS7uQ0NI/v1PiqMymJ/+hE:kS1uxaxbS7umtPiqk9+
TLSH
T1FC856A1267F94129F1F37B71EEB993645A77BC71AE39C10E5280125E09B4A90EE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 2dfcfd62ac64ce81294cf3f991f10594fb1b5f122b4960b734cc43fe1c05e494
MD5 033a8c01b0b5eeb6081bf0e60324775e
SHA1 63e76a4afe909b4a59513fb16c50761e62eaee67
SHA512 bfb201b3cb61c9a40be465a01915ab51e398a16c4c6bd40fc2d0b743c103d75de0b33412ae34def93c9c09d65aa7db76108f4f92b2b1f9ed917a81ccf667e552
SSDEEP 12288:h6dVWnxlMnn7nFKbltn+Ch/m6XjrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fuc/:I/TAbD+OmeyBMvjRA+iqMIjmJ8c+hE
TLSH
T19075E11033D0C135F5B329368ABFD724956DB8715F6881CFE388166E5E706E0AA35B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 54cf459eda52cab22ff32b7a6740510c0f1c847197e70bec3863efdf7367ed97
MD5 4b693bc84a398a2bbf64174f7b0fe4d2
SHA1 03e1b2796caa803c20c5bdc485b9412059ab2829
SHA512 bc1091a80f5a781976d1b9c5eefe4badb627b515c1bceaf37ff6812c9420d82c70f69fa7d9dd1418dd4d5ef1cf591dd4af1b0575a81934d2d64f9d12ae2b5d54
SSDEEP 49152:Fb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn+v1PiqMymJ/+hE:b3q6mjBPtPiqk9+
TLSH
T1CAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 4122efd63abbbc08f8d0970ddeaac17df08ff00fb52daa67ccf208b70698f4ae
MD5 4c586964ac8f2e7d87876baa5fb86fdc
SHA1 05406b5efbbd26db9286562229da8c0b78dce686
SHA512 e298ac6c94087c0f32e28c28d626c9b48e4791b1de0fcc9b27653727aaf7910b98c02df9ae0ea2215b49149a0a5611af55bb5e08fda4c31b0391c2494ef95a46
SSDEEP 12288:71XLsswWkxy2lRq2czAtrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzIT:BXYfDtczA0BMvjRA+iqMIjmJ8c+hE
TLSH
T13D65013963E409F9ED67823CCCA28512E773B8554760E78B03A4996A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 edbd4eded3b9c7e5e44ab3592744d059bd5c0eff4ca4f35ab194f00e016e6cf8
MD5 f8c63d53277a4197da5aef4823508712
SHA1 0500b02a5ed2619aa6072af985c05380ed88cbd6
SHA512 9bfe32ca32434923e0533b8b4dd21862aafc987653b7b7ee101b54a442b2be3f24da8269454958bcd3c22dfecdfb671a127c2e3e7d83ea8be3afdb93d0e849ed
SSDEEP 24576:a0Le5ji0hmxhrMrBMvjRA+iqMIjmJ8c+hE:aPji0Aztv1PiqMymJ/+hE
TLSH
T16885AE26F5748731D073C0B9C5D2A68AE97130865B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 59a6cfee707aefbd863d0e0c95d566e2edd51c4f8a73ed60dd3abaf2ea1c7175
MD5 87c4c9b6fabf94b183f5cb8a64775bec
SHA1 25aa473d5227cf3741805647eb1ac29754c44dd4
SHA512 40f216af46b698bb407ebdf61de2e5bcea2fe6d00f170fba9af181a2409a9c5d0245f0a717d14d45d7f6f080c5012d7066e87567a8df6154db3453974e330179
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWj6q8wyuRBMvjRA+iqMIjmJ8c+hE:3/ezSC6vUzPv+HjyRv1PiqMymJ/+hE
TLSH
T107755D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fd0dffaf9791d48e255638406590afe8f1895138ca991519df9dc4b5a7f7434f
MD5 084a6aa60a97cec01b1fa82dff3f4992
SHA1 1dee9a33f1fab38c99d10ef5a31e82b15e3e7ced
SHA512 6eaa5145bee9e969c820b6f907f1f90e73d54045bcaa28065912ea3c6033410af4db5e76e030495ad67748ed95ecd071668e813a481e274ca8a3dfc2c8e16bde
SSDEEP 24576:kVbqPb88hv/l+BwBMvjRA+iqMIjmJ8c+hE:kVO88hXl+Nv1PiqMymJ/+hE
TLSH
T172559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 95297c57b500105f9b1b9ed383e2fd30306c41da80628a308660c591cb3b532f
MD5 7105a5814a1aebe88f3e316e943d15e2
SHA1 f963520112c3739c736ae03196aee336b9455727
SHA512 91a76ac9330d2d3b89590fa258467db68623a1cdf3568a4891e36a8ab12309ab08db88d87ee64b89ce50647842cca6bf44bf6e16e4d6991e68c5de952efa7d3a
SSDEEP 12288:pG+rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:pGHBMvjRA+iqMIjmJ8c+hE
TLSH
T1A545233600A80A95FF733F386DEB67A3C245EC7DB561A203751676DB563C1E0A88A607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e8cc9b2f5f10bcfe0a7cee10563e9141e0c98f1992420fc859faf2b84b545300
MD5 f2a779ecd29906a6d4268ba53a092585
SHA1 40d03c4579621e85186a15f0724155ae6618d95c
SHA512 ebe58d9ec4fa150a8151d6e379e5e45a1dddabdcc7a4a5438a68b889cd51a8c677b2a0f7beb481730bbaaed7480c66274b69b1c58ebccb98ff9b4cbef958361d
SSDEEP 12288:IeBNUbTVO86UhrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:IJIUYBMvjRA+iqMIjmJ8c+hE
TLSH
T1A865DF3BAE28FCD2C67A5D785A918700D77278304F62A3CBE165834EDE235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ad08d7426b08b0f4d829e372901c9db07447eb976fea41aa878365c98a3274cc
MD5 59983bb9567425caa3b35da2002cff91
SHA1 2e79fae8e8460cc1015674019947402559d98ba6
SHA512 536dd53d166c34af06c7006c8724b8449862e3f25d9ad90bc918edb2737e61e61c74fd8815d7a3fc5959eabcccc615e83d2e1ea29420916d07322e3b6dc6e52d
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH6:gQvGAdlCEL8c/WRNw5CEtPiqk9+
TLSH
T1A2266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 679e12e18bf8e28a6d80fe49eac72decb43c99033ff045800cb55990b7ac2ce1
MD5 4bbb6e597ac598f16281e2b4d4a3bfe8
SHA1 d4b0728ac128fc240e48591cccc2fa98678c5859
SHA512 0620d5702356b2d2669a7d0582d949df1930c2bc8a390d6dfc24d9a55ebedb48f9fa75722d792c904fe114132d4534f58c1d432d33cd40092bc42ad1eec2c1a5
SSDEEP 12288:PAwSfxL/2Dc3mDLLmt0LDQewsAj3rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2FuQ:YfewsAjmBMvjRA+iqMIjmJ8c+hE
TLSH
T12075F031FA74D432C7BB0DB61B36C716542CB9204B612AC3F3A89E9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2d42f50b9483ed7a678c78aaff1f276391ed01a6c64e97907c62b5eea9a12ae0
MD5 4d8d570cf5f9ef10b092c401c3ee5b46
SHA1 7b258eddf009bde4f76701287021c9c170a279f9
SHA512 63e97b4761302ef347c93a686d579ce873177c6d63a77eb0588634f620cb44f9b966b13df6156f0f47975e707bc28e913e14c04f6a017af04fe861fb48b4bccf
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHfaT9+:iUEtQevvqc2W1cpV20I32faM
TLSH
T139474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 97f4776426f2c411932d03647951fd14e2ab542043b1b1ab21547f7fe6700b6e
MD5 44a1d9a5a6c9e4b019483c9becb8e22b
SHA1 21920845afe175e235f03f5f4e6c5b6bb7a5b520
SHA512 72566d40ecb7a34d6c5fe061f850e6b12ddb397e0e4a3bc3fcd655e10b5fd1bf4d7a7d527d88658d1e209245bbdbaaa4fb356b25e5f90427dc59134ecff4d2d6
SSDEEP 49152:VCbRquA/m2yL5zQfFiV+XenmE3/z9v1PiqMymJ/+hE:CoqtVjnmotPiqk9+
TLSH
T116D58E1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6e7a8556e023afcca8796d4a8a466f9fa4b24d757e2c048cf4ad155f20be5feb
MD5 33260a037bcb033dbd4022c2c9a23896
SHA1 e17d2c092b74765ca74a602a984cf1b36c30db49
SHA512 8ce61be0fcfe37bd6929313f027e90f589ed4a023086205f25d27911af890fb57bac094b5a9c0d1f996ac3806d3c287b5d436bcf491786819b11087a04fbf5bd
SSDEEP 24576:FAhGL6IFoiwtA5l7S53FBMvjRA+iqMIjmJ8c+hE:FAM5Foiq5Yv1PiqMymJ/+hE
TLSH
T1E235AD81E7F945D4F5B3AA7899B68171EA76BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 36861443449b8369e5c730eee41ec7e8587ddbc7ee72eb14ebcce28113f7c187
MD5 663e3b858611f2d6f9080ad4a13167bb
SHA1 910e66517f897ee2202e9f574ff696a9f2b1fa75
SHA512 9fcaca30d5f959f92f3342240672ee73948ea68c8e17f71f5c1b97c3c427a19e542273bc8e9bcbd98e222933bee4f639aa5413ecfc3636c5b16a37b4d3ecfd48
SSDEEP 12288:rmw5HEjsChNEBFgl0WDm+CIrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:qwuROW6BMvjRA+iqMIjmJ8c+hE
TLSH
T11C65F11A32A80CF9E96356388597C236E7F2BC163A21D71F1760C65B5F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 dbec66626cd46fb6af1eaa2a6068a22afac6d18b711eb7b263ad5e85ae7865c5
MD5 3680ec3d9c3d7d6833e728f8b697a0a4
SHA1 9851b5f021494b9971c2432d0473a852c6e1ae18
SHA512 fe6109f955ee6675042d29ac86d7e0c195caef3ac419c988444ad84b1c88abb9265251500b648062b71f4504ff2557ab5873158089683e5b8c9f018ca2b6aa65
SSDEEP 12288:zyZ1IynrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:eZuTBMvjRA+iqMIjmJ8c+hE
TLSH
T15B55122A22E821F5E673173CDCE65742D362B866733183CF262552AB1F37AD11D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d180e776befa009b82a2b59d8700e63743bf2038c1cdc0ffea70c3fe76d1877a
MD5 be3f9d71d59dba39afbe45a31735b600
SHA1 dd023ebf1fc3c4d7f0c005d6a10d017df610bea2
SHA512 65d658d870b1b743d4a10123d99362665471f4bbf56600343b72ce3994cdc7ecce384617129d41945303ad4e4b16685d3ab11eac9331c4b50bc3c81ba64de7db
SSDEEP 98304:9QRQyi36YOcPDLvw2gAf+PN3rtPiqk9+:0QyiKanX+PNhaT9+
TLSH
T17A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e564dbc17b51d8c01d881d05e1295a4ea5c56900f609e51fcb1465b5db191777
MD5 eb3b5d307344ac5076f4a011ce6c2c4c
SHA1 4190521b56a02beb2a757b417e6ad7f3b9f2c5a5
SHA512 b2e86dab81b19b152ba5f9164db19931c792c1105ecd0575d01f667476cee307a62f253875fef37fbd144667b7da6f3a9e1e91d34031e66028f11edd900db56c
SSDEEP 98304:TQRQyi36YOcPDLvw2gAf+PN3rtPiqk9+:CQyiKanX+PNhaT9+
TLSH
T19C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9ede6a7b0ae496b0e5489735f32c1d7e46ba44a21e88654cef4d06515db012a4
MD5 74a7736595fa32e11a3c0a63e4d23034
SHA1 335aba1c956ded28acbc31c6ceba4d202766063b
SHA512 7701a38efffb39d9e2e8f888eeb4ad1a4d64a58da594efa1eeea1f9b6aa400a67b4c8afc65719e9ed393d99a01e8325fb57843ed153696190b179b6d2ebb2292
SSDEEP 49152:f68Qg55nhkeWu7PNU3/tv1PiqMymJ/+hE:ZthTRc/ttPiqk9+
TLSH
T11DB55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5ea60ae35bcf136d559d0da87bf2fbdfe39d06c18553177e3df75b97d44f91b3
MD5 34d63bc7ca8fef9539b1ed5f4f84894c
SHA1 f852da0bd152a6dc0301389743762b45587cbfbb
SHA512 d56858c95f82fabddd049583a8bf3b24dd5ade92075cff3d1c62f1e13bb35149d09bedaf241278ab4057ed706d6828526b4ead2dc76d7ffea0fbefd1efdf2aaa
SSDEEP 98304:Ey5112gYy5azzVvU69nLKnhZytPiqk9+:FLIHRWhcaT9+
TLSH
T124167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6ac79fd46f33c209413d7403e08a764f7a1c2bca516d0f6af80e8bdedfa7acb0
MD5 7154daf8f899dfa78ae4861b134dad59
SHA1 6d67eecaf36665ad61982a20e22766a3e5725150
SHA512 bfff12a1df105d50694b28f418ef99c6917d2d2e927ab2179e0277a8ba38afe8abf64141a24f7f465c4e1af7045b31317166e189edbd8f9149f892a2567323ed
SSDEEP 49152:AB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gljv1PiqMymJ/+hE:au6JmIxd2djtPiqk9+
TLSH
T1A2D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 022a52f4cdffef4d0930a5bff7cada9f301290549e3ba93f3e2052e2bb878cc0
MD5 3060481bf85221a130fed4aa17a02d29
SHA1 666f145f596decd923c2cc7e40c3545b9c04a3de
SHA512 7f0fac54311b3624f4b444c1e1f64292bfe2d5bd8fd2ca8756327bd93bf40188eb47cbdb08568cc176a7cf459a73d7eff1243cb1f1f885290aa634cccc4f9db3
SSDEEP 49152:H1hpsNoJpF1A67U44CwH7R4xXv1PiqMymJ/+hE:HmifPqRotPiqk9+
TLSH
T152B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4d4397e539f343d58890fd6cddabbd8e89478b342c184c414ac5ca166f14aef2
MD5 53e7f5b0e1f1956b4334dd9863f622db
SHA1 26846db53cd9317b96f37be30cc1b8a727f9e9ca
SHA512 c092fa2d699c4526a62fd09a40950a2083e203fe58d810a498252cfb10547f5e7289155caabb27b4ee760aa1d3eb2540124fd126019d320a01b4843ac273ec44
SSDEEP 49152:RSuZQIY0Be2KkRVtOnks6NMHquv1PiqMymJ/+hE:/5dKqi61utPiqk9+
TLSH
T1CAC5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 66496126f653b1bdaf73f688f04ae054fc40d3f89f57fdf5c78dba35c1475fbe
MD5 e6a7ddd9642b59c121a3be7f80109461
SHA1 e5a18be40c63ce47e1268b557631546073403218
SHA512 92fd3a313968d07b2fdb382bee092b7a593e2017ab62cbed3006482609de69ef1e5a9554f92e05d79be0311c9312c767b50ae5b0817dbb293c2f442d850c275c
SSDEEP 49152:BhtSn8EApI0figjgiDn0AP5wTv1PiqMymJ/+hE:QX2iWphstPiqk9+
TLSH
T10695BE13F2D901E8D06AD178C7468632EA62BC160B35B6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 898a2a8ae04020b443ff81e964d9f5381e4ac4acf4e28f4e46f584f2dc49cdca
MD5 f209f37edcd04d5d5959a0e0420511d6
SHA1 ffbb196245807729d8faa8d64d3d183a5ba78ce7
SHA512 e777c0d83efb4dce1c9a136e6c3038235b65026cf6f3933e1538fdc1cf3760f6bd5b0f9bd9d09130cd55f1f3c9dafcdff22a7383954f6fc3751a9c76ba231f07
SSDEEP 12288:s2rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:svBMvjRA+iqMIjmJ8c+hE
TLSH
T11945233A00AD0F86FF323B3C99D75792C284AC7EF661A203761E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 039849a666d083b9a80770569f03dfd31e5f3de5f7168619427cf5fd77ebc897
MD5 d684170fcff6ba0499544b5a5dafd259
SHA1 d36df8a817f2685a8ff96fbb3870c61f601a5e0a
SHA512 e725c1742dedeca997e19b54c915bcfb9d39117aa16662362848578014a11ca7466b941d4837d37a1188ebd082c8c83d50c39096cefe0b257d87b071e905af7d
SSDEEP 12288:zjrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:zyBMvjRA+iqMIjmJ8c+hE
TLSH
T13545233A00A90F86FF323B3C99D75392C244EC7EF661A203761E719B533D5E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 407b3cc6a687ce95b2e4029bdc0f63ef996e98cf0b608052691b6f8f08c97246
MD5 db76c287372c92a5ab95ebd6d10530e5
SHA1 408885775b5aa7547a51001d19b9dcc85158c08f
SHA512 bb52d822dc1bb9f17af97d80b843dffc7de8fb1337ad1bef32ade96ddca349004bff1627a9d52df96f305a32f13199761aede5bdf91f74cc484244afd7a6bee6
SSDEEP 12288:nZrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:nABMvjRA+iqMIjmJ8c+hE
TLSH
T18645233A00AD0F86FE323B3C99D75392C284AC7EF651A203B61E719B573D5E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b6697ead8bba585f0f7dad5d77b70c3851d90c30c6ba1319c1f243a1f53c4537
MD5 469f9f1fab4c231b320aa6e71b9dec1a
SHA1 340ad7c39ae0519550e7dcd4e26eab6d2d8b29d5
SHA512 c0ea963b0b442ffb2681d0782ea7dca309f903c727cea46f54ab32abf6a5c1ba5e1fbf3f375d020ac51b9e28df3505cf4b2df8fd29bf6c12eca00622a53296ff
SSDEEP 12288:vVcrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:3BMvjRA+iqMIjmJ8c+hE
TLSH
T15D45233611A90AC6FD326B3CC9A75352D395FC6DF732A30FB605259B0B392E02869F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9404155128a706d49bd0cc1c29e5894e1b67e561d302b4d59ec040d93c51d49f
MD5 904971abb248151c579c19e06116cfe2
SHA1 c3ae603cdf77fbd24d76ccf6b66439675e38c215
SHA512 8dc4cd61a3120f923d8ff29692b366a9613a2cb48701f86f1f91cdabdd04b875283a5db5ba6aa9940b4e891090c3e0f1fd175b2fd51e90a7b4a93e39ad63b5df
SSDEEP 12288:QErGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:Q9BMvjRA+iqMIjmJ8c+hE
TLSH
T1E445233A00AD0F86FE323B3C9DD753A2C244AC7EF651A207761E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 756a0ee5cc25a4115a5f276c493083438f288c836e1d013601d1a00110622303
MD5 1cf5b8fbe44e85d32e47e37f183b2309
SHA1 7eb0eff0dd6d6fd9703060e2bdcc55175b0439f1
SHA512 46928358ce2c3a878e153fe05ee6b086ebc88d1916bfa26b84d22eb58f07a00546b9b46052f7f83acf9049d7be4f3092b79b3174777014405f36a7ff737f0586
SSDEEP 12288:MvrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:MuBMvjRA+iqMIjmJ8c+hE
TLSH
T1AB45233A00A90F86FF323B3C9DD75792C244AC7EF661A203761E719B533D5E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 90c5e7ca65493ea29960034a524ccd85b2e12c246d463e2440b2c12c579f3c6c
MD5 41a1cff9b5990e3976c5b82ef68fbba9
SHA1 2f43f3be02fbc7af5b84d059398b866ccdd068b4
SHA512 a591f7d13466aded523ac6f08a913e6d524aaa45737418b84f91d54715ea5965538959716f9d22ede161ab502e7a25fab5f9f95e43c5696b04eadd3c56feb50d
SSDEEP 12288:KrrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:KKBMvjRA+iqMIjmJ8c+hE
TLSH
T16445233A00A90F46FF322B3C9DD657A2C244FC7EF661A207761E719B533D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 014e6c73c7a59fc008f6730393d528bedde70a46013552513ba3e47dae006a88
MD5 a61131a74a8fa5d9946ae8f8ff2d1a4a
SHA1 30fe6f75d7307b9d9553d21d7212780d36536b39
SHA512 237b1393f0786cad9311a4426235cb9c1cae4846931c219ff0db6ae04d5800a4c673c9b056746dcfd5fb93f0e2d513f3cda7f69c0d3bf13e825785068f585949
SSDEEP 12288:biZwbDzzFEoS2cPvyDrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8ti:GZM3zFVSOSBMvjRA+iqMIjmJ8c+hE
TLSH
T15565016573900CF8ED63423ECD558A16D2B2BC6A5770C60F13A8366B5F373A11C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f6779827b99557a5424cf391fa1608fdbe3ac46dc4654cdd3b190ff68ae15a94
MD5 37a9580793c15f2cb59fcfb59180bc45
SHA1 d3c98647c3514bda47d1e512b34aa23b606a467e
SHA512 1014317e68226f1db693e8215fdcedc32544ef776edc1e4bba59f7cb07a277d02d236750f859274d284d3bfee3e6812cb7b81a3e85b13ec3b616c718fbad7f97
SSDEEP 12288:tarGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:tDBMvjRA+iqMIjmJ8c+hE
TLSH
T1B345233A00AD0F86FF322B3C99D75792C244EC7EF651A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d76aa06ff2f4827b9c70e92a073585212388c6f2421153b3900a2ec15de6c35f
MD5 d72b8f03cc52b925fa14eee0f072d644
SHA1 defc06f09ea421f8c13d316c2f53195a8677e29a
SHA512 2ee44422ade89ab2332377a146bd4dd547bc369a80010a88465af0d538ce7608e9a48b64aa7d77d17013fa19ac0139a4a1bc39c37bf170df0b4ccd285b57539a
SSDEEP 12288:rurGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEVa:r3BMvjRA+iqMIjmJ8c+hE
TLSH
T17945233A00A90F86FF322B3C9DD75792C244EC7EF651A203761E719B573D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c8988e7e4a2d4d39eed39fc8af214ccbba743596fa4ccab91cc561a8c70383a1
MD5 0dd3627493f9cce92d8c8f820b25116e
SHA1 63b13a912c6a6abc42caf274bf7b9c1df13775fc
SHA512 3bd2727611fcc2fafe5fd8b70f7eabf6469f9cb7016f01920bc8d88c862d9701ac3ae6a137c0b9e946d4450b76fe9cb5b647f5e1589aab48db7f73608cb4c568
SSDEEP 12288:/yPz5L8nrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:yzyWBMvjRA+iqMIjmJ8c+hE
TLSH
T13255021722A521F9E5335238CCA21B52E371B83657209B5F276453BB2F376E05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 85ee84c5b2e6b29291e728c73eab88a35c373cf98ecf4e90984c849e98d4f22b
MD5 e24deaa26441ae4b0a6d116fbb42fc0d
SHA1 8d6c078f9eb213d42e7f2d55b5d2f6fe91a00de7
SHA512 00025900f8dcfdd462f2051f79ca82bc3305d22b4a71a8e2794343d667fff7d3446e2c0c7e839436f8e5434c3fe190d6cf362ead4158cd4abe983b0bba2ce3ce
SSDEEP 12288:iarGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:iDBMvjRA+iqMIjmJ8c+hE
TLSH
T10F45233A00AD0F86FF322B3C99D757A2C244EC7EF651A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9b27463aefeedf2ff90fd6356766f61dd15bf5c253f0ec77d1c829ebcf52ee0f
MD5 84cec204705fb8d51b3fb25ed2920277
SHA1 3073e6fdacf5f9529396e42d0756bc6d7641fdaa
SHA512 a4e2f0a72592fe9d29aa912f7078c52a85df5d782aed4cbc259fd544ee76216ab1661a7387c671ee7ae90d6e42b9cf3a22e426665c64ede54288ba47731aedd7
SSDEEP 12288:oarGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:oDBMvjRA+iqMIjmJ8c+hE
TLSH
T16B45233A00A90F86FF322B3C9DD75792C244EC7EF652A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d8361ccddb1b20c9d9bb0a7769169ec352dd05272555d6a2b14aa7ad2b44258c
MD5 81eaf79a78122adf2f7341576390db65
SHA1 0f3af18172200cfbcca431658b12e37453c73941
SHA512 f847a5b10fc903bdd6bcb6f1272b12ec0294f95ed759ac3c8b53e7d718064a72fc0bc00e712b040eae5f077cc920eaca1f34e630109b3f79a5b124691240ea7f
SSDEEP 12288:EyPz5L8nrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:dzyWBMvjRA+iqMIjmJ8c+hE
TLSH
T1B355021722A521F9E5335238CCA21B52E372B83657209A5F276453BB2F376E05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d1d17058944546bae86b45ace937e25e67cd36aa24afd8e751f65002a2a5fcd9
MD5 53995ef8a243093cb70d95a0b8fbeaaf
SHA1 8e8ac64863f8183bb4ffd0e2a16cb51b6f4454c3
SHA512 0a7673385772c807d2a05a506ad0d3f6a58048ab144abe033581ef77593d200ff9bc9a40b9b7effdfb3315f7eb92d3aafdd9caf9c6cf61e0d59bac39861ca695
SSDEEP 12288:6Cd91WYoaLHF3z0z04PDvhprGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:LT8aLl3z0zDQBMvjRA+iqMIjmJ8c+hE
TLSH
T1D865026573900CF8ED63423ECD564A16D2B2BC6A1770C61F13A8366B5F373A11C2EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 aa6692e8037e172bffcfb0cc9e2cdb2e65ea2db6aaa2a1b5fa8497d682fc2537
MD5 789caa4f4c469988f5e6611f2d18c76b
SHA1 4140411da8abcc3edb621d3f2d80bcf9f7a3ff88
SHA512 a8e75ec01275f9a840366b33788831a0c9a760838751dd380b6e0a54c28ada979cd07efbc8880ef666c17bcac532503a47a997f415f160a454557891983133e7
SSDEEP 24576:63rd9CHKy7GZ8BMvjRA+iqMIjmJ8c+hE:crd9CHKyaFv1PiqMymJ/+hE
TLSH
T10B75DF90B3E414E8F1B39A35CD764512CAB67C5A1B31DA8F13A8265A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f0c112bfd9ae28391d8333459b80fc7b39082bd1eb8cb215c09460848d96fe11
MD5 f28e578acda94d607bf6b27a034d3d0a
SHA1 dc5c0d0c2304c40d87d56e36ca0f917365b88b39
SHA512 541750c483f5ca1aa43122995e44f6a5fe012c99c25e981a0a9515c7c349fe3537e176afa613e3d41924b3665a4d02085a3ecd147368febba4499d789e3216ce
SSDEEP 12288:/5rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:/gBMvjRA+iqMIjmJ8c+hE
TLSH
T10B45233A00AD0F86FF323B3C99D75392C244AC7EF661A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 73a7446bdb1473273d21244f26ae943750621930f7f35b50c01bd8cae4a67f1d
MD5 1370ccead1a641038dfaeec3465498c5
SHA1 9946b3c9bf69bcba325f3a2467a31798985ed613
SHA512 5486cfc2c304b0341025185581ae57925c5b7d51aa4da0a35e211b999a36f47dbbf08bb6dce2daea5adf5cb8105082815dd0f7db72d6fce3f6eb81d61cf1de2a
SSDEEP 12288:dHrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:d2BMvjRA+iqMIjmJ8c+hE
TLSH
T16245233A00A90F96FE323B3C6DD75792C244FC7EF661A203761A719B533D1E42849A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 09b0707ba45e5d496f9a556f99034ead7e97a8e698229c64c5e122b9de98a1f0
MD5 8e5227bcc4e948ed61b2f295eba0d83c
SHA1 4ba8ef5e29ea16c92ebf11f00fb1a5c36ad5a279
SHA512 ceea91011ac03ae306b32b66ed4664c4d488ae47bf186641b4df902d4a10112b6842e2771f769fb3ec5bf0bbb8a7a6ec4fa97e86422f18098a31bd9ee975b226
SSDEEP 12288:hwrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:hJBMvjRA+iqMIjmJ8c+hE
TLSH
T12F45233A00AD0F46FE322B3C99D757A2C244BC7EF652A203B60F719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ba8efcbd04f3080b1c7920bc82080b396db5634193ce141dce11c82a99c5328a
MD5 f462352a1e7b80876e9f7748cac30806
SHA1 d917ea286cae44f9f2c4c54521f457b95cf1531e
SHA512 2ec312a30e83201964f8e6120d5a3a69f03bd19dce506ebb6c828981fc00bf8b91a4331fe8d64cc8e0791887a13d05e4b604c04f2d4c92d834910ed000d79ce3
SSDEEP 24576:rfwvzk9RX6wkyAInBMvjRA+iqMIjmJ8c+hE:+MnYISv1PiqMymJ/+hE
TLSH
T17785CF29EBDC04E5E177923C99B7460AF2B178691B31C2CF125A53AE0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1e710edcafcabd50ede61c6b2c0d7a119be61e0b820a3039eba0b2a68c3b6b2d
MD5 ab9f95a394bc6bc53b826bb55190ed72
SHA1 47e587bf89eac400c11ae0ce8b8741f9fc75cc4b
SHA512 c41d2653d67317a973dc4bbd5e49aecade9e009d3b12c50b4603220c647447d46e8f32f1c736fb4c3b6be7ffbbb34029dc42683600b051479c3db89ddc2916ca
SSDEEP 49152:aYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zv1PiqMymJ/+q:FySzPLtPiqk9+
TLSH
T106066C56A1A801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8df3a40e2d18ec171bc0e3b963c52648c6b57f7474f3433349a09ef805b6a4e3
MD5 7a636a18692a7a497f4f1012f80c5c61
SHA1 e6e953eec007cfc735900dcb6e8a22d8d182cc96
SHA512 b59ab658bd76994c0c9ba9917f86ce3ddf4655629c1e183a8727f32257b10aff0725944219f8035651ed734ae2de38e51bb143d977907f02fd0522a192b86d25
SSDEEP 24576:n47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYCBMvjRA+iqMIjmJ8c+hE:n47JUQjqirIhCnDHUPfF/jv1PiqMymJJ
TLSH
T1F065AE1EA3EC01E5E1BA927885154A5AEA71742E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 aedb9f59f449234a99aedfd4e47413592c8d66a0f10146349f917f665f93e3f9
MD5 87449f7c3726df61b3e17eb438898ad4
SHA1 d9a7f3720ab6381c5511eb24504df5730b1b3f72
SHA512 3e7cff20a760020ddbf2be5c1f22f058341c136afae682074a66ec64fc63c6372e047ea579a99e83c454861b45202e4e353ce4dc5094592f0c41927b7bf9e8b6
SSDEEP 12288:6psfqrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:TTBMvjRA+iqMIjmJ8c+hE
TLSH
T14655F11AC29802D8D56E6239CB964641F3237C2993E1D3CB66D0F57E1F3A6D05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 100B
SHA256 0ed11d356e7f1b224da94b99c5493bf3c18e203f5da13a427592f19bbc183c2b
MD5 e563fb0914086201b75fc61655d45d3f
SHA1 7b00f3754da22091283d439740c56e7f73e9adce
SHA512 55316f2aea9eec1de6adf0687b8f297060e73cd524a81c68dc70548ee43f34d8b673a20a3d33aadc7a71103b439be92a7af1768134981a5034a520d461e8388e
TLSH
T150B0120333D10428F8102511CC784431633670D4700AC00D8080008E08F4A0052123BB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 1KB
SHA256 215e5ed582498a78cc721fa172f3ead1d118ed3e34c77ae0c6c121ee26f3ccfc
MD5 8e15976845fc7675786e7b7b80021543
SHA1 3650a21609ca63dca7ed37f2c3d476a58cc1db9f
SHA512 59323a2b49be98af34b4f4b52ed6365b80b9b3c8cde0d438d781acc30c48ca7511ecb98db5518a725e35ccdfe26559dc23553c17ad2b76ead7854a54b715e1fb
TLSH
T1E1318D872AE90160F4B35F54EFF994735B363CE26C18D86C50D4124E5CF1A50E1B27A7
MD5 SHA1 SHA512 TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 27d2631c70c7400fabe83f61f1fbd7f3bc93ac5a4fed4ef69644d7debd0eeb46
MD5 adc4a7fea7ac69a28893ce4538dd3e17
SHA1 60a8f3a1482f97ea72e079cce173c0a463767f05
SHA512 91ca0c52fb8f763829705f90f4317a9f4366b79c41f1d9987a724d568dc4f7df7abf16b628a2c1c83d86b61883bee25be2e290b869884df87f62b0d2da43942f
SSDEEP 12288:PMnzhcGU3fdIbGMIOmzDk83wXRZf+u9cNH06TRSaDl8ByH:PMzh3UPdtzDk18ccO6NSelrH
TLSH
T18D352901B66BC75FC5AD40325E73D2CCAB707D02EE055B0772C8972FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 d6fa2c839ed39f04555b78c63bf801acad3b06ded37db6f43b0546292560aee9
MD5 709c2c2f8a4db24ff4e2092fd143fe90
SHA1 776268fd1e16ceaf05203a2c8741307320166832
SHA512 77d0687219fb830d8ad6bcebdd23e2606960f23d6bfcde51c7c60161e39722362d513cdc790ee8225bb42d1223f483029cc3640600f9a343c05eb24736e2729f
SSDEEP 12288:FP/KNi2xKXOWNNqEzZezZqgZBgh5tqSKF5GmM2C:FP/KfvY/UbNM2C
TLSH
T1E965D6819137A38FD1FB6072072A5B4CAB64EC06B7055F27B3C8453AD86B725B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ipmUpdaterStart[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VOACOWIT\ipmUpdaterStart[1].htm
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp13DA.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp13DA.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp4435.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp4435.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpCC5.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpCC5.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpEDB2.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpEDB2.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b678b8cd744edbe.bin

Path C:\Users\Admin\AppData\Roaming\5b678b8cd744edbe.bin
Size 12KB
SHA256 4f0c768cd1c2ec939399f8695c2b09a612bd73b956c7435c603d2901f9e75f16
MD5 568f561a1b82bf0ecbbbfc95e8b61f28
SHA1 8e40561d52be1635441b50e2a345d4ec7d3c147f
SHA512 af4172f950e1cbe1e010a172e6336ab6ce1349c61e7a1a6838b928f4201fee8b30aaec188ec4d9113bad1d02876e6e0f16e80bb9d91560e1ddc4034057781fbf
SSDEEP 192:q4uLRTeqljdWLAW0NXm3vTnmC8Mvu6HiOxGH6jcKgwPiLCtprkkQ/OOPnbxDHcI4:q4qTeSxBC6c5+xmH5OPSD
TLSH
T16442B06229528C190F5F7A19459744D77BAC7F9EB3CF823B5A24DB700F2BB1503AB404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9a81c301b8d67240bf7a1e0589cea18347b5628c8384520ff3b13420fe263239
MD5 23f563e3bccea50b7c87185004e9b605
SHA1 c6f67131e8a4ce200855667b414e8eb54f9213b1
SHA512 b7a79ba9ec421ff1a0c14c0dc2df3989368318ca700e85cfef4dc5aef21bcf79acf7a6fd3d1101b2629dc1f7b7833972dc8053593b6fa6d174f2027117049486
SSDEEP 12288:0M7yrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:1LBMvjRA+iqMIjmJ8c+hE
TLSH
T13945233601AC0E46FE723B38599B9332D209FD7DBB10E183B50A72DB563D5D46C69B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2408d67d360de64b18cb3a00a403dfb5b847492a55f203ecbfa21e02d0e04625
MD5 d1c8906ae2c52b7527da4f184cdad7bc
SHA1 101fa711bdb22fe675be52b4c8f2b12e83e64107
SHA512 48195d7f0e14db39d8ca8c050d548f1e839ee80e2c93a8c5d6e98c430edab8389867dfde2f6a6c184a04790ca8de7a2faf7cbd3620a4a7301bf742b8414ceff2
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYRBMvjRA+iqMIjmJ8c+hE:Vgb4mBIBhGFJv1PiqMymJ/+hE
TLSH
T1F265AE1E22EC02F5E0F6E2B8DDAA4417D6B278161731D2CF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 8e372debe09ef70bbef5e38e50cf6918ee50edbfbd2c36af81945ce6634f6899
MD5 d00a7d0a73c6dbdcc94660e63215b7e8
SHA1 3b748f723bdd288239741777478b8d88f3c4dbc5
SHA512 ab549d58584209eb552a197cc81969aeaefa9c7c4229278f4530007aa031c26064da6a19f6ccd51fed38e59d6a7c867841e2c8e1710e6046211446ce1d3e44b4
SSDEEP 24576:wG88u8FpJqH1vzria7/mSBMvjRA+iqMIjmJ8c+hE:j7ZFPqVya7/8v1PiqMymJ/+hE
TLSH
T13785F12562E502F1D477D13889864663F6B2B8251360FBDF07AC8B561F23AE50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c87419af08bb647b3728897d51a064aca1906056c4b3f8f4b3590178ec65b99b
MD5 8b938db495dd613df7e8148cd55ec94f
SHA1 d1f4f258d6347353a867bfcda1ab76c499dc24d0
SHA512 a62f8c3e4e57b55569c2573d0327a619fe02695a5025d012886a8c3c0d0e4e38276fff4e621c30e421715fe30acb48d183af78a86c8d60f71102335e99187ece
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVv1PiqMymJ/+hE:2G05lO43batPiqk9+
TLSH
T15DD5CF6E62EC01F9D1BBD17CD9C6460BEBB23825033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dce6387b8e6b25aaaa0ec32a2bacdc22810c2b360d38b1be67d0ab467421463f
MD5 16c19f397377fd1ff1536a5e4ea30161
SHA1 47fb6968706daf87e515bd77bbf6b2ecb4323468
SHA512 49a95c3f59e0e57cc9d065501cfe029608bb41d259b15dc5f862f9a88c99ac53bc4d18eef9c63464d49d6a285fc350301705005884e4834d7ad8f0d47b2fa2e7
SSDEEP 24576:1fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnUBMvjRA+iqMIjmJ8c+hE:Va5POZ3lJt2pasx2+mtv1PiqMymJ/+hE
TLSH
T1BD65BF5EA2FC01D5E579D17CC583461AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 552ee13e1194b38ce90b4cbf25602b2a612ef03f5525621687150573ac1313da
MD5 759335f833201578dc72946cfc83b04d
SHA1 fa285950d7e1ca610e73bd27fd29c7a2cc523a83
SHA512 eb8d9ca3e844a7cdcd51b898e62672352771fe44a9f31db99cab60b1164d3b219532e2751b8aeacf02a59f7a31bb098ef93f228b3cca44873b8a9b04d07dc6e4
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkaBMvjRA+iqMIjmJ8c+hE:5Nc/zEOVHFcv1PiqMymJ/+hE
TLSH
T135857C2622E901E4F5B7E1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7d34cef620cfde68b5a2bff361eea98cae0a43ec724979e0342434144ccac662
MD5 34040c08087b5971ce0d94a63839caf7
SHA1 ed3631f02081973091343324dfe17f589dd1c73c
SHA512 a523ad2d66ef1fe783cdfd298ec7470169743a1b289ec1606cb79ed679424dae0d662d6ec47d0e3e3b91e6489133910de7642765fbee9406941753d62d5172c2
SSDEEP 24576:VzkNvNnaFeYhJNtmZBmIBMvjRA+iqMIjmJ8c+hE:VzMwBtOmnv1PiqMymJ/+hE
TLSH
T1D255AF2EB6F806E4E1FAC6B4CD238512E6727461173293CB5290C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a0f8ed2017a2e12827269af67e8f163633ab26a5045947b9ed1a016112b64d6f
MD5 6ed2231eea4715d7f2f29ae25ceeb326
SHA1 fcab8460d1352ce5e067deaa30cf1f8d4ed98bb8
SHA512 b9839ea8cae739f7aab306f4a0b8c0441d0170f340257f0d086b934c1818b5abb7801fdd6d26c71cc69fe518b4369776220e6221114f2692dcfd1b815dd6755b
SSDEEP 12288:SHvUrBFrEjwaQfrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:SPUr+NQeBMvjRA+iqMIjmJ8c+hE
TLSH
T1D665E12F21AC1CE5E676A17C89868719E771B8661712D2CF02A1817F4F37AE87C3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3b2c030a720d83849959b89f62a6adf2d9adf85cc91d7141afc3ca5a3dcf91c2
MD5 5229d37655ce539e7c1fc673756b95c0
SHA1 553ecfcf17145ec49bfe88f88ece35f116f02677
SHA512 d969cc1cdee5a922d295720ccd57df547f9c7535ff23d6e9b4875c201266f9b63f1fc111dc5ef21af8e355e23143d78cc9183a329fed3355d19cdea84cd8ef30
SSDEEP 24576:mD3FHshBIYQgAPBMvjRA+iqMIjmJ8c+hE:mDVHeBIAAKv1PiqMymJ/+hE
TLSH
T14875E13DE69C04E4E57BD17CDA638606E77138AD032266CB129491BA5F2BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1020-218-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1020-209-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1020-216-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1020-220-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1020-210-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1256-105-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1256-183-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1256-98-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1256-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1260-312-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1260-161-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/1260-166-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/1260-160-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2688-133-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2688-140-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2688-256-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2688-134-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3096-0-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/3096-2-0x00000000024B0000-0x0000000002517000-memory.dmp

Download

memory/3096-649-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/3096-6-0x00000000024B0000-0x0000000002517000-memory.dmp

Download

memory/3096-170-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/3096-7-0x00000000024B0000-0x0000000002517000-memory.dmp

Download

memory/3560-225-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3560-226-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3560-398-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3560-232-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3752-208-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3752-117-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3752-118-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3752-111-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3752-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4224-547-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/4224-700-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/4224-540-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/4224-597-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/4224-542-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/4564-185-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4564-364-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4564-191-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4564-382-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4564-379-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4564-184-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5052-129-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5052-122-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5052-143-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5052-145-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5052-123-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5580-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5580-178-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5580-171-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5580-433-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5580-172-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5580-431-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5688-148-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5688-156-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5688-150-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5688-282-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6024-204-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/6024-198-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/6024-196-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6024-372-0x0000000140000000-0x000000014027D000-memory.dmp

Download