e8ea64b10cd837ae77489eb82f0063738a407e9f9b365ad4cab88402a5960870

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.7MB
Sample260804-hvcvxayvfs
SHA256 e8ea64b10cd837ae77489eb82f0063738a407e9f9b365ad4cab88402a5960870
MD5 6304f4f3b83eae4869a14a5e5cbd2420
SHA1 6db14fd258941643f08eeec26fba14144130b313
SHA512 10e46718b5578c2e8a3ed29f8bbef16a7a4c8c02c7a0fc618d82105dcff17d1c148a19541d0497d6c47d15da4dbe198fa5f0a4fec186b36e4a9807a492fd0329
SSDEEP 49152:HNZCWOLT49XGQ6m6K2MtENUv1PiqMymJ/+hE:twnLTiGQHFtPiqk9+
TLSH
T103855B1667F94128F1F33B71EEB992645A77BC71AD3AC50E6280125E0DB4E90DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4912	elevation_service.exe
3404	elevation_service.exe
5304	maintenanceservice.exe
5128	OSE.EXE
4820	PerceptionSimulationService.exe
836	perfhost.exe
2060	ReFsDedupSvc.exe
2456	SensorDataService.exe
1092	ssh-agent.exe
4664	AgentService.exe
5672	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\36bcfdc4e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000148a105cdf23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f14aa79bdf23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0b7d09bdf23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fddc9c58df23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033fa0559df23dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ee73715adf23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1bed258df23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	2060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2060	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4664	AgentService.exe
Token: 33	5672	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5672	SearchIndexer.exe
Token: SeDebugPrivilege	3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4912	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3376	2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 1992	5672	SearchIndexer.exe	102
PID 5672 wrote to memory of 5804	5672	SearchIndexer.exe	103
PID 5672 wrote to memory of 4372	5672	SearchIndexer.exe	104
PID 5672 wrote to memory of 4104	5672	SearchIndexer.exe	105
PID 5672 wrote to memory of 3508	5672	SearchIndexer.exe	109
PID 5672 wrote to memory of 3360	5672	SearchIndexer.exe	110
PID 5672 wrote to memory of 3036	5672	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6304f4f3b83eae4869a14a5e5cbd2420_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5304

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5128

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4820

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:836

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2456

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1092

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1992
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2736 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2736 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 64aa7b0e709d5a5477be6d4706f9c78e134bf5e400beaa3ffc50f1818e07ac3b
MD5 d1d76c3dd9d89ca388ba8f7f26eeb670
SHA1 f26e5c7023a1af5dc9cdcfcfadb4b3a327c1b5f1
SHA512 2ed76b579f48f8e98561d8c3e42d61b15ee13fb306b245ff92a5b9cb86818005b84395504d3751689b2521f27898264d1744f8b10624c78d92499f0b9a9760f2
SSDEEP 49152:wb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnnv1PiqMymJ/+hE:a3q6mjBytPiqk9+
TLSH
T198D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 fefb73797ea36362c77519338c89b4d1886cf1b6aed6ca81d88655506d514d1d
MD5 35ba44a65cae18f2feb63f39e989b517
SHA1 5be69d0640abdab4be2e47aaace72c4a89d051a3
SHA512 41b70077ea9eaa870d605330f184c1a48a5346c7da62bb6a870f1aed0286303f4ed303ce5821c67f68aa69a4e2917facdd969deadd01de808ffb4650a95c60bf
SSDEEP 12288:R1XLsswWkxy2lRq2czAKrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzIT:fXYfDtczAzBMvjRA+iqMIjmJ8c+hE
TLSH
T12165013863E409F9ED67923CCCA28512E773B8554760E78B03A4996A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0e26d5c192136651753b2a2a98be225ba2dbc4fee2fdbc62e97f37ebd0847cf1
MD5 fbc6795edf9f2825f53e4a2bc4928892
SHA1 19ea85f57b76af049ea69564673525f099030ef0
SHA512 8e22078785f16cd6d43be632db0fe6cc1f750ab44116c3bb38aa01e99d4eb0f32d69e9d7abf1e7182028a3f23d4f1f684c741441af22b7214fc0eb6959736882
SSDEEP 24576:z0Le5ji0hmxhrMgBMvjRA+iqMIjmJ8c+hE:zPji0AzQv1PiqMymJ/+hE
TLSH
T10E85AE26F5748331D073C0B9C5D2A69AE972308657308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 33b60d056e9785482319a9753799b24f59cf7e24b0d2d4dc1eb6676949874c18
MD5 6d99392b47b8cd15946e7e6bbae4d465
SHA1 f1489852e0f2deb38e2ba83dad531e67e11ae7f1
SHA512 898d8353d71cb1ae892431cedf079b6d031842f8b8556646f5c24c14b1e213c70bdf4568baf6ec6090fdbfbf95f282f726f63ad7df70be5ff3f5a5570edb003a
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWj6q8wyueBMvjRA+iqMIjmJ8c+hE:n/ezSC6vUzPv+Hjy8v1PiqMymJ/+hE
TLSH
T1A9755D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 336d6aeb6f49c54fdf0b6a4ae898412cec9be23e5064569788c204e9b6c70889
MD5 13e19de5cbdd8bedd67c938953974036
SHA1 e7cc51303f3f1a475a8ff555d52779985b79a0a3
SHA512 637b868af98fb1058d55b90d817ae37c7bd1e7b5f9667977070442e5f64eb22fbfa34d725e4b3fd6d5890a99eccc1ac05754ef15aba66af8011aa8338d15c1bd
SSDEEP 24576:UVbqPb88hv/l+BXBMvjRA+iqMIjmJ8c+hE:UVO88hXl+wv1PiqMymJ/+hE
TLSH
T148559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 de7b44283edd4392e286072fdb7bfeabd9af862bcb52fcf17bffd47b61fda28e
MD5 ce16df64980ac866b6930457560f8a7c
SHA1 b8142ed4576eaff8311e0e2f6833316f701691cd
SHA512 4a09f548b67bd64a51e0e0639d8a59536645b864404178caa9d7773398713ca3f8acc8ce4226245172be3b66be4489c920c4b6a0c4cdbfa01d1cf1968e292867
SSDEEP 12288:zGNrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:zGUBMvjRA+iqMIjmJ8c+hE
TLSH
T14C45233600A80A85FF733F3C6DEB57A3C285EC7DB550A203B51676DB563C1E4A88A617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 fee62d6de05e5643eb5eb642376f1b34c1a5d66228095bf900228929eed710ce
MD5 2be7dbb26fc37446be42ed287c644488
SHA1 67f61acf59612434b019b617bda2a6be324cded2
SHA512 73117f4b50b8cb108412d051d20c44b6c756c93088db62a598a42bb19a1b7c9ceee50e742620758cea6bbbaceb3a520440ca16e6e62a47c6b18d438069a6f42a
SSDEEP 12288:peBNUbTVO86U2rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:pJIUvBMvjRA+iqMIjmJ8c+hE
TLSH
T10A65DF3BAE28FCD2C67A5D785A918700D77278304F62A3CBE165834EDE235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 06c31abc290d7a6b3252e30dfa904c22bfc6661515ee35c856cae0cc0a42a44d
MD5 ade600600363f325ab86c9ca8c8e4a8c
SHA1 059d4f10b1ef5c3707edc4cb63bc1b853ce9d35a
SHA512 e832248c9ceb5eb244a04210a14155b3918eca4d91d251ad33deec224ddc6b93e6866ad6cf04aaea2c31db7ad65cd9c2a201396687d779c269786562b6b61cf5
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THJ:MQvGAdlCEL8c/WRNw5CVtPiqk9+
TLSH
T16F266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0c4d6b91b64e0dc9bffd1ff063d84623aefe56186d86703f28b3ffda29ea8c7c
MD5 58e4310cf4f6f69586cfe0c74b6ed960
SHA1 5dcce27c873558fe539b52415498da9c6ffa6410
SHA512 16841d0ee7c3d667a2579276ccbb415deff5b8b0ab138cbc577d946f537de859f9d06898607ebd1db4114eeca6edf542add60089cb8cfb4e7972f27327c24250
SSDEEP 12288:cAwSfxL/2Dc3mDLLmt0LDQewsAjUrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2FuQ:BfewsAjNBMvjRA+iqMIjmJ8c+hE
TLSH
T12175F031FA74D432C7BB0DB61B36C716542CB9204B612AC3F3A89E9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 afd6cebeb97bbe60c5fdfbad1589da3c131a789b85b40669575a4676a257d1b0
MD5 49a72d8a0f1b703468e981e049a5fbe9
SHA1 9392e5de8cafb5bd07c05d057dca61907f0371c3
SHA512 24f52485bff608e2da0ec0b9dc144eae3d7a8bef2646a12e2df0b7464cde925ca3a02569ed3a11b3c03626dac3444201f4cd558b1726ad915b5911760010b425
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHkaT9+:WUEtQevvqc2W1cpV20I32kaM
TLSH
T17D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9b3c67b0cda7c298c7c3a82beabed7f2158cb4b18fab6d9929556a8ea1edd340
MD5 90ee890006f7b59e7502fcb6910f30b7
SHA1 3764aba47775a1733860726d8d29ce366a61267f
SHA512 9683762df8361b9d0b7adf7c7e7cd9bcde83a3f5c1a717de89e42661deff05cb558292394546ccd3c9e145313363a48cdba28b43bf2c6fa1305c12d3e777bf6e
SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/zAv1PiqMymJ/+hE:9oqtVjnmRtPiqk9+
TLSH
T103D58E1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 539761bbc4b25a36ab1dae3018aca3766a19fe4350f4439cab33d2d7513619de
MD5 8e328a52b7e3ff28547b7206d556eb2d
SHA1 4a0436b32e0f089ea1276b5b8a2e3090609be725
SHA512 569cc31a62175ce897a676e99abd49b1b359629e677176e9bc81e773548a2256c9af5a5905f0c4cc637aa783c4ce043176ac251acf887017f5b2b3fbfa4f3540
SSDEEP 24576:tAhGL6IFoiwtA5l7S536BMvjRA+iqMIjmJ8c+hE:tAM5Foiq5hv1PiqMymJ/+hE
TLSH
T13F35AD81E7F945D4F5B3AA7899B68171EA76BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 40816c2d72f618ee10f9865a95b63beedb823ed02d99a4747acf29887f79812f
MD5 190cbf3d98379b994a4db764cb9e05c4
SHA1 a252b3ae742e713f8c21899b0c8c42a95cd863dd
SHA512 47edca7dc0df1a624672b1eaab0dc1f1bf6a905341443dee0cae002af4f2c98959f0d88abe291cbf64c02823a285bb67c99113422faac186ead8ebfc4d502dfd
SSDEEP 12288:nmw5HEjsChNEBFgl0WDm+C/rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:mwuROWJBMvjRA+iqMIjmJ8c+hE
TLSH
T1BD65F11A32A80CF9E96356388597C236E7F2BC163A21D71F1760C65B5F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b615db0932d61064b319dcba19b76bc848287654646b0114e55d06218c783dd6
MD5 3ac0e89e9956f82f7e5102170c40bbfd
SHA1 23f6cf4c36cc7597287bcaf5d79964aede0fa804
SHA512 a8f0b8dfb67bcde81100b1f68e588077e845c31e8d1aa6707ad996adaf14070d101ed09a313058e8f3d61f57236f03ccf03bce39d4dfba0d075df20cf47abc72
SSDEEP 12288:fyZ1IykrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:aZuYBMvjRA+iqMIjmJ8c+hE
TLSH
T19D55122A22E811F5E673173CDCE64742D362B86A733183CF262552AB1F37AD11D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0a6ceae8fea53e4637d39303ad287374990d0bec42e20e445cbe96ffaa4ff3b8
MD5 602fb3dd71c3112f943a7553767fec22
SHA1 50d15c66a117f9ffc209505ff3d4ea95875292a4
SHA512 c12215e777bfbf097118827430117b1d284defd91a1a85df2d0305d678d5bcaa3d4820f138dbfb361d935258731a41896d7113dfee9bffdb9c14d99c09e8965e
SSDEEP 98304:TQRQyi36YOcPDLvw2gAf+PN32tPiqk9+:CQyiKanX+PNmaT9+
TLSH
T173667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6edff0a3ad4be81c4e4afcb4434b171d61e09b2991e9fe817427f8c3b0419407
MD5 abdd7f62e23827ef782f78d118e9432e
SHA1 e95cd82f85b20a91cca7b8b5e0ad4629420da00b
SHA512 64ac4d59f281196f214cba116ac538492c0424d0ae630eeeb85459620b2691621a7d1b1dbcad03bd6de042560630286e1fd0fefb71988fdb023d69614939d95e
SSDEEP 98304:iQRQyi36YOcPDLvw2gAf+PN32tPiqk9+:5QyiKanX+PNmaT9+
TLSH
T19D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a49fa4342332166928e2558308c17cbdd376f8327680e9874ad93154e19377a1
MD5 be0c160a71c056dbabec4ceffe5a7f4b
SHA1 27dc3221220e2b9a023e45bceaa669f84c7d05ca
SHA512 8df4696b29f15a9c5e0b53876e51722813333f2df7b901425ef799baf49426cb2cdce25003c3fcdf22503ba459835fac1e64847c59f58021f1dc1535e7fc3151
SSDEEP 49152:968Qg55nhkeWu7PNU3/Qv1PiqMymJ/+hE:7thTRc/QtPiqk9+
TLSH
T11BB55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a9bbd56657957c65d9d0b3dcfb8029a6d6a66a03752ae9b7df8c51a481796038
MD5 e5852be9baa2984d4de9856c1585443d
SHA1 bbf5951d13af0619d64d61d033777315ae174925
SHA512 ec6eceb6f7114a40ba864459673912cd310cd8757cc8ce0573c55c79c355f9d5c305f8e66925e7c0e212a2caab193dfff83cf1b17386fc9fbeb3a227154dee57
SSDEEP 98304:Vy5112gYy5azzVvU69nLKnhZztPiqk9+:4LIHRWhjaT9+
TLSH
T15D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ab2dfb4f91d4061f22be3138625be7c15c442df74e5376e1e2b0bfa11023e1c3
MD5 2ae49ee3fc90c2b28f639d94dc31255a
SHA1 9e297144c343f8aff5eeff118fdf7c24aaab85a3
SHA512 1afe1b7b7ff4eaa73965b61e5b4d18450053e222d4fade1dcb7781ee3af5cf4ddef2235931d5464f8864b704b6cdfef190461b8af4c15ff05cf82b8cad6af51d
SSDEEP 49152:SB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl+v1PiqMymJ/+hE:gu6JmIxd2d+tPiqk9+
TLSH
T117D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9fd764c033729111f8f017a6f4e05166e3aec459a172041a58e9f69e33f0a14c
MD5 e674505abc16d51cb138330bad27b1f3
SHA1 b47fef74d64d339720951c69b5d04b15e136d956
SHA512 3c0d878335c0f421a1619105e2b3483384e9fce36f92fe99f47441f7f91c566772f266f3fb1be163c59165d0c7467e7b07bf0ac16fe826502ac69f5b42358e9b
SSDEEP 49152:Z1hpsNoJpF1A67U44CwH7R4xKv1PiqMymJ/+hE:ZmifPqRRtPiqk9+
TLSH
T13EB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 866e88027c88ea23ab3b8d3d24bb18a9f4d64edcacdb8f3759883ba6d019ea73
MD5 d056acc5b460832bb340152d98e01140
SHA1 384b66d3f51bf434fcb7a8705411aa3ea0cb8167
SHA512 4ae821e18e818c08758779ae054da6f3702d0165b710b3c061966bad8cdca821ab787bd580743f2f404ab5f7bb7e89a189239a100d431e616607eed83f7b0257
SSDEEP 49152:3SuZQIY0Be2KkRVtOnks6NMHq3v1PiqMymJ/+hE:t5dKqi613tPiqk9+
TLSH
T129C5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 08c20eb64734dfd4e0bd6e4db88494b937b79c2ed634bf029fef7bc0ad9cd742
MD5 cbe846db915bd8dce5bcbcdeeffd43a0
SHA1 606dc410ba985429b462c03544335c587d1bead9
SHA512 2dde1dd3dc2fdbd08508a1cb687d1f78db27d17c3931bacef06402e9901427bc2cc390f85516b133869d4ecf852038f8c8693314efa7ec2d26b91855e2b4f575
SSDEEP 49152:XhtSn8EApI0figjgiDn0AP5wOv1PiqMymJ/+hE:GX2iWphNtPiqk9+
TLSH
T17F95BE13F2D901E8D06AD178C7468632EA62BC160B35B6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1fe4828b16bd1931d75051bdd386943ae1e2ec79151e8d3ded8caf90fbd91083
MD5 66bb4cbada3323d544efb0e21dc3ceae
SHA1 577b8fc51f0ff93b2e2600ef272a612f5c7f8a7d
SHA512 d58076aa9769c5f3cf86a8d226b94f6e3b1a33c605002dad6962ee599eb5b108e89f912e28cdf87c0f1bcd7c92ce11960845051f4f11ab5123e593fb59edcf0e
SSDEEP 12288:JVrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:JsBMvjRA+iqMIjmJ8c+hE
TLSH
T1AE45233A00AD0F86FF323B3C99E71392C285AC7EF651A203761E719B573D1E0284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 61bdf2c2400148b891bc557c5afcfa0a9fb505244d6d48b3cb02ee096a2e87b6
MD5 5b72e30ccd6e3d8f618bdb8be87deec3
SHA1 380cd2bbe403ab41d86eb1b8459b5ad39f2a9b7f
SHA512 ce4a936bd09d6bbaeadaef6f37ad13338caf549201a87e34ef04284259b697a3ce8a3ca5371c4301a50b47fd693250d73262f91cd348d70200dc75b8e1bfb29d
SSDEEP 12288:0IrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:0xBMvjRA+iqMIjmJ8c+hE
TLSH
T1E945233A00A90F86FF323B3C99D75392C244EC7EF651A207761E719B573D1E4284EA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 959099522c54a61d371e76eca5678be172da3ed1605f12d5032ed4b91a8676ea
MD5 46d11a526c3c9362125c243bfe96c9f2
SHA1 bccbfac374f626f8425fe16f8ec271044adfe604
SHA512 ab9d5f9ed48331b035e62c0cfecf470c40d68caee55585d735b820e192a0358ba318d3272f9406c71cc99004e5dce6900d5c65ba594196e60b3c1d86468a8ab9
SSDEEP 12288:S+rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:SHBMvjRA+iqMIjmJ8c+hE
TLSH
T12245233A00AD0F86FF323B3C99D75392C284EC7EF651A207B61A719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9bea5b9b0c33be4fdc73fd0a403fa548322a0e0c698a7b41534c736178881483
MD5 002d783689962d68b5aa79516aaab15c
SHA1 5c2307a305041309981528574cafb0b6816539e8
SHA512 2914e16a40325075a88a262f28931bf74ac4b53f37f6f4ffee2aa462c3541c41da2b0f8df93dbca104e8260f8367b479404372f1410d2965a1ad1d8161f77de1
SSDEEP 12288:tV7rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:CBMvjRA+iqMIjmJ8c+hE
TLSH
T12D45233601A906C5FD32AB3CD9A75352C395FC6EF732A30FB605259B0B392E02869F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8eb77fe8d76f6e2d814c30d675dee8750c8879153d9aec5c3bd5a753a3dd582c
MD5 6838a3d79cad2d8559bd5e4f85c9ad0e
SHA1 b29678eb27abe8ce366c14c141d35fe4c79d4faf
SHA512 93c1a53ef59bbb55ca8d728b674772b945dbf0dc936c77c5e09fd505e0065e4abeea5d6e039c0d57448a2df73c22ed2d72081a275f7e752aab888ce2c1d2e22a
SSDEEP 12288:kTrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:kiBMvjRA+iqMIjmJ8c+hE
TLSH
T17045233A00AD0F86FE323B3C99D753A2C244AC7EF651A207761E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1a6f603aacf0a1fe860ef9b58984b75b477750cf1545f3482ecf1ac3f68dd5d8
MD5 8e8c65cba5a8cd439fd304738c21848e
SHA1 0c89b5b95a9a979e8303929a0068aa29699d9919
SHA512 0a5da1208151d89939150e4af7a4b98956062c91b5c74e5866bf54c414e5c1d1e958c63954b3d5b4446f7d9873e0744344fb4f237b00f505624d06fe950ef8f1
SSDEEP 12288:bcrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:blBMvjRA+iqMIjmJ8c+hE
TLSH
T1DB45233A00AD0F86FF323B3C99D753A2C245EC7EF651A207761A719B533D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 da9164eabf2ecdad753ba351ee8f9e5b1fee3e7ccca20b724db68aaecf9fcf59
MD5 fb065cf4fc2bdb97a3dc00466e21fb3d
SHA1 f5fd790d7783994b8033d21ab66d3a2c0b399960
SHA512 3e7d02902868f4d7775297d737a1841776468e04ee3b0d9af858441361859ea07126678f24e5480b3d2a336cbf1f7861e93d4b53be497f8d21d2f3bb5e7d3ba2
SSDEEP 12288:vgrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:v5BMvjRA+iqMIjmJ8c+hE
TLSH
T18945233A00A90F46FF323B3C99D653A2C245FC7EF651A207B61E719B533D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c60f7a197b1b780e8775b3782bea7ec9a54deeb1f330282779c57555978ffd9c
MD5 3a5e0d459c4edb1a338e6a49522ae72a
SHA1 ad2a57ddbdf731d0c5142cd8efbe528a5fe1f678
SHA512 183913391a5f78d3b372e05ec6d8344878515ca070fcb922a7cf19bea25c5dadebd601249d8f40bc1ef831a98cf1c3510e7d3d18bf7ea3e6f5f3ea7d40e0614b
SSDEEP 12288:8iZwbDzzFEoS2cPvyorGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8ti:fZM3zFVSORBMvjRA+iqMIjmJ8c+hE
TLSH
T18065016573900CF8ED63423ECD558A16D2B2BC6A5770C60F13A8366B5F373A11C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a9a170e11ae513c1f0e14753e985a823e1eed121db56082ead21bb2b750a84f5
MD5 75807e25ff9dbd6ff8b6411cd0b0a6f7
SHA1 69ec153463f05b1bf42cf1e885847599c0467339
SHA512 b9410b11b752c042e23caaa35d7c44c0d2c77cd813a6cb12eefb3f7f3b7f3ace0384443e846e2c679cd85781acac65f8a5b1a9828155c571436cf99eaa56e6c5
SSDEEP 12288:yxrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:yoBMvjRA+iqMIjmJ8c+hE
TLSH
T12545233A00A90F86FF323B3C99D753A2C244EC7EF651A207B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7f3c0c081a93076a178c23a74eef3c76883b835f3304a60e51ae8f334ec8512b
MD5 11088da9c6a4703b075ed6603fcae884
SHA1 0cb9c06698c1e177ca1bcd926fc2c2617a9da04e
SHA512 19818e9742c459c784817ead2e0efc29dc86e05b16b33b323afecc9656f8d7e8f43bdb728f6282e11f7baa98a2f9483c5c24b4ce5a29b68fa2cfea4c8daa2a23
SSDEEP 12288:IdrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:IkBMvjRA+iqMIjmJ8c+hE
TLSH
T10045233A00A90F86FF323B3C99D753A2C244ED7EF651A207761E719B533D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 16b01941ec9200a39970f31abd8d25da371cc03eb145b5663a8dd9a87c38f3b4
MD5 62467216d1688eb9c231bbcb5f7b19d5
SHA1 ac17df35f48a630e609ef3ae3b6ffe3af1c70ae2
SHA512 54c4e1aee53bc155df1c98b5180894c68cbf3986c613b7b00b6e2c14363342160508b7146c38e39b80ac47fbe0b18d934696fc804deb9e34da6926e4406659c1
SSDEEP 12288:dyPz5L8krGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:UzydBMvjRA+iqMIjmJ8c+hE
TLSH
T13255021722A521F9E5335238CCA21B52E371B83657209B5F676457BB2F372E06D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fc876f587768b745bae3725e7e45b482f8ac9a3f2d939efd75a17463439059ad
MD5 1ff7e1f9d9971de714cd2a7ea9af7158
SHA1 a7fdbb1f6d40e4e6fe5bf6641432ff64e40966e1
SHA512 8b11d244afe36ce460783e73bef5af557417d63eae55f12a9b7074799b73cca15cb004d46fdb0e835560184ad4498a2dc794db1963cf2109317acf50accb3828
SSDEEP 12288:6xrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:6oBMvjRA+iqMIjmJ8c+hE
TLSH
T10845233A00A90F86FF323B3C99D753A2C244EC7EF651A207B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 59655f495abac82b3b218606029f380fd4196ba402c4c38978b8785b926ce29b
MD5 6416206c0d72a7fd781d9a06175cc9bb
SHA1 595cb03ef0f9dc895ca78b61c1ae51bd97b79da9
SHA512 cc7cc652b941cb299a12548412241ebf2f99337e6b1ec6f50a522ce250f040adaaee0cdd32752adfdb77a35ef507a4ec968bcbc9017dfbccf14feae353bf2c3b
SSDEEP 12288:CxrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:CoBMvjRA+iqMIjmJ8c+hE
TLSH
T1F645233A00A90F86FF323B3C99D757A2C244EC7EF651A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4a794ffd6c444396f29df479420483a15f17944ba2d15062f04a222cde1a84eb
MD5 e86317fa1bc4a26f5f34a842eded646d
SHA1 ad8fd1de3627c351518d477864c7d132fe0a6358
SHA512 26b53da0209904beca950110753cf9b896add0a16d3f50d3ae06850b186cdfd8eed266e0809e71589e1d1aeca659b699f20ecc2ca66e5293f63429f05f501dd8
SSDEEP 12288:HyPz5L8krGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:qzydBMvjRA+iqMIjmJ8c+hE
TLSH
T16E55021722A521F9E5335238C8A21B52F372B83657209B5F276457BB2F372E05D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f0f06234df9b9d02628ccd743a30dd3b980dd1019b99ce31e3ddec30e9f5151a
MD5 2f6aa5e60e787e6edd7ef219d2b5dc25
SHA1 51e156b0482b3e0e44413ad007d719dc4ebdd6f2
SHA512 d186d9955271f57cb55491781c5fed6a974200044fc8bb8c8d729f5423c3295fa7257c439b5653212b137f383e1536746371b820b6d7ee6a576e3dc0b4431eb7
SSDEEP 12288:XCd91WYoaLHF3z0z04PDvhurGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:ST8aLl3z0zD3BMvjRA+iqMIjmJ8c+hE
TLSH
T1A965026573900CF8ED63423ECD568A16D2B2BC6A1770C61F13A8366B5F373A11C2EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 db9edc85ff82905f36bf32f2c7be49f81c492fa781825bd10fe35c3051fc7554
MD5 f970704471528610cb2b25b076daa9cc
SHA1 8b876a7af8b0500fa07823c49c420b9fe6935e4f
SHA512 06b2893b6e40f94d622182bb2f9f652e8a9a9994a9424566367309a96ebe8df5e76b837d00906868480a37ddc3fa70340e2e889e9a6d55837ffda177df861244
SSDEEP 24576:A3rd9CHKy7GZLBMvjRA+iqMIjmJ8c+hE:Krd9CHKya4v1PiqMymJ/+hE
TLSH
T1CE75DF90B3E414E8F1B39A35CD764512CAB67C5A1B31DA8F13A8265A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 bcfd222963df38407204b1ea93efe3a0e6ba16aa89660876550b29437c48d8e2
MD5 454f348ce92b1dad3474dccccc49a78c
SHA1 31567e8cf65ca19e90a3d5173cd4d7d13c469aa7
SHA512 140cfe5c45f8b4748bcfce17676e774a8fc7dd87562a6b55fe423930497bf2d95dad7822efddeec9de3e773a30fbd8b894d7fc2c4f4d55bc3b7911e1068791a8
SSDEEP 12288:UerGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:UnBMvjRA+iqMIjmJ8c+hE
TLSH
T1D345233A00AD0F86FF223B3C99D75392C284EC7EF651A207B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 bb261cbc56f28cee2280b787ed14fd0b1f8b83bcefd3eb9ff8652d98a06fbef1
MD5 d4c7a0c00748e370b8a36c4f4ac16bce
SHA1 d5f77d4df46a2c88e2be0d75d5e75373a2a460b0
SHA512 b6deb84a247ec63e8507e4b8b145d40dc1789bf6e3146f1f77b1b9e5e99b0883482c36aa8929975261f8be2c0dba9f7049f5fc8c44ecfc9773de7cd4929f52a6
SSDEEP 12288:cErGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:c9BMvjRA+iqMIjmJ8c+hE
TLSH
T1D045233A00A90F96FF323B3C69E75792C244FC7EF661A203761A719B533D1E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 207b91ce6c5f5f273aeb70bd219471fa70ebc25f31cc2f5a6d656758aa8ba73a
MD5 313ef6367ba01304418d7b5c4debed02
SHA1 583ace211f56956795161af041624e4ed2f87dfc
SHA512 bf1a341fab47ed7bf29d78e5f5f73fe26a5dc9fbf4658dbf06fc5f8dac9b19aa856e4c0649ee978683773889ec7ebe94b3acab14659b934a1c5d122f40713763
SSDEEP 12288:t3rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:tmBMvjRA+iqMIjmJ8c+hE
TLSH
T14745233A00AD0F46FF323B3C99D753A2C284EC7EF651A203B61A719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 75cb757255481aea5f947b94419498605e99893f501ff0e96d7ff9a6625b1027
MD5 9321d5871392e44286e548f33bd3ef8b
SHA1 074b02cdf402585f2cbe9e97a0ae4f4e987ec3e2
SHA512 113f662ea3477594a3c2cab8419dc2830edb4a926c97d175d5178c37c9b0d6a7b9e8ae0a34f33efdfc8bd7b4b92d1adc1db6635ce61ff6e5f086b9e5f0321b54
SSDEEP 12288:/xrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:/oBMvjRA+iqMIjmJ8c+hE
TLSH
T19A45233A00A90F86FF323B3C99D75792C284EC7EF651A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 89228613f9fc055078236ca70f927a91588878545526e71a83fc43cba4faf23e
MD5 13a1cb4e79539f645d733b4cbef2a57e
SHA1 5e19a6b387b1876c799075eb129e25fa9a977336
SHA512 f077e2d320a5938203dd1271875559438e799234f922c9d9fd12340458500995b9621b87cd1121349f50fa98fc570d6e16f997f0a52ba2bd3fe3538152c50bce
SSDEEP 12288:0erGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:0nBMvjRA+iqMIjmJ8c+hE
TLSH
T12245233A00AD0F86FE323B3C99D753A2C284AC7FF651A207761E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 787d0d91198b0d6c7973516ca043fefef49ea8a893746aac597a79fd74d7e1d8
MD5 8f789f441af61c7e94cf122b6969cc62
SHA1 fd717bff46de9bb4e4b8002d552870c64bf40569
SHA512 a64f72440d9542431969d74971cd5390c29301766fa2819f067c2f425b516cb4d2f3dfc78c5491b7659c2d786c66be7d247f729a5dc38db6080e7e28d6d53f55
SSDEEP 12288:eprGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:eQBMvjRA+iqMIjmJ8c+hE
TLSH
T1BD45233A00A90F86FF323B3C99D753A2C244EC7EF652A207761A719B573D1E5284DA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1164a955816f7f10c74f9aebfadeb77c789c84911759b421a488e3427c09415b
MD5 a27908eaf757710774321474c2eab6e1
SHA1 59937e42bc537126b68f6a83715835ad4d2c7d8e
SHA512 9d39913d6f529fcee5d37c18f4e8e226f252a568f3f46ab54e15b0422ed90a000d84b7a296c1fbbeaf453c041a7ba6fc56f2cebc364f8d54cd7bd873d899a51d
SSDEEP 12288:STrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:SiBMvjRA+iqMIjmJ8c+hE
TLSH
T1EE45233A00AD0B86FF323B3C99D713A2C285AC7FF651A207761E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 919100fe2210b244a4c74da2158701ad966b6862a3ee1de324f3ef1c31951831
MD5 fc020a5416df83fd0b317b37c720a896
SHA1 670bacb9ed16a675430aaeaef2bb7487f961ae91
SHA512 2abd708b66859abb161e5ca68a7f5d16eabe7833f878c7367155ee1f944a2347efe4aa2d770387a96af93b2e5ffa90fcbc8c95ed54803c96476c15d6e354cd9d
SSDEEP 24576:ifwvzk9RX6wkyAI0BMvjRA+iqMIjmJ8c+hE:JMnYITv1PiqMymJ/+hE
TLSH
T1C485CF29EBDC04E5E177923C99B7460AF2B178691B31C2CF125A53AE0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b7e8ecd440c42ad64ed47a468cd4c37a20ca4ccb7c3aebab5408649bb1cbe79e
MD5 69bfd380777f1997e0437335b1de3493
SHA1 80711b4f84e8ed084636eb8c59efaaeaada68f41
SHA512 050e4e499defaeabcd820cbf67c0e9a13cc7bbf4c1723cd95df0812710e31f5b7a913071144e88b0cd2f438304a1e36cc2ed5e69e9610599557b0bb40036bf0e
SSDEEP 49152:4YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uv1PiqMymJ/+q:3ySzPWtPiqk9+
TLSH
T138066C56A1A801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c56f6684bff603efa7a4fe467aa59976c14565cb550a4e1d3167a6b222f8ce5e
MD5 f958b3d2146f71851d9ba726881f0d1f
SHA1 b4aa70984e7a6d422049b5c85d77da078a52f4c4
SHA512 585795d4e3541889d83a467fe249bd55ca3917608dc38e4cca07f8b433a55fef3c8167bad348bfb21e47bb32fcdbdb225d354c9646e45bf31f6443c9a0f6b364
SSDEEP 24576:b47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYhBMvjRA+iqMIjmJ8c+hE:b47JUQjqirIhCnDHUPfF/+v1PiqMymJJ
TLSH
T18065AE1EA3EC01E5E1BA927885154A5AEA71742E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ec5b9c4a987079bc47bd7152cbeeed0aef24d321f80e2be268f625961efae738
MD5 d474325d57ced43f01bc1b54ea89a8bd
SHA1 a588647bfd60bf74ccc5ebd74be313a72f29d2e5
SHA512 c7479e46370c04f509b4e1cb241b97ec2b1f875993c25ea552e7020fe2877ad47d90c7bbde0e040925a806bbd6d205c61f99e94c840bbaf4d83bbc2ed5ad2059
SSDEEP 12288:9psfhrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:OYBMvjRA+iqMIjmJ8c+hE
TLSH
T10D55F11AC29802D8D56E6239CB964641F3637C2993E1D3CB62D0F57E1F3A6D05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e46a088ac51f48686e232e3e378b12a79b0990ed497c8671feb372708c103af4
MD5 7aac2bc304620bd673e1e5021f79cfd8
SHA1 cbf5b381b6e9f3c6dc4bceef6fc2cbdaba66562f
SHA512 fb7ed47dacf790d555a28b32f3542f3c5bad6a1102a26f0389ecffdd33285297af0989ba6012b3851f976e7e51f77c22de8b06bf31155a31e73f1aad522ddbb9
SSDEEP 12288:YM7ZrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:5ABMvjRA+iqMIjmJ8c+hE
TLSH
T1AE45233601AC0E46FE723B38599B9332D249FD7DBB10E183B50A72DB56395D06C79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 254522cee6b985ece519dd61f2612e8d88a45fb3175e9aad692f92d3a2f9adc9
MD5 115986547cc1971c876ed68693e00c8f
SHA1 31d1d246f2c678e1b4c953c355b246d1d93e24ec
SHA512 2285335af6c8e65a8744061408812636f34846c24a97b366f1a83a82ad27a2bfc0f7d884dff0ed14a7b16bc2fc36218c59f38af3f7eb636089804a4d72559aea
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYeBMvjRA+iqMIjmJ8c+hE:xgb4mBIBhGFkv1PiqMymJ/+hE
TLSH
T18165AE1E22EC02F5E0F6E2B8DDAA4417D6B278161731D2CF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9fb376204fbe2920490f1e69321a941778c7499136c3808941bed403f93e0ada
MD5 faeee1ccf1782c66710dd904d4137d68
SHA1 c216122ab6b8251c05ba78af5ecd3aa6914ce57d
SHA512 7addc8dd2f01797804a24bb6c187a0cfbeb704860627e8528d11ae462536bc13f93bb4dccc0d374913d9a071353352412ec5b0868dc7c43feb1b54fe3cc4ba4f
SSDEEP 24576:VG88u8FpJqH1vzria7/mRBMvjRA+iqMIjmJ8c+hE:Y7ZFPqVya7/9v1PiqMymJ/+hE
TLSH
T19F85F12566E102F1D477D13889864663F6B2B8251360FBDF07AC8B561F23AE50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 21631fa682fa5217dc5536ae7fa826d6f39ee9e031969ce1495b23d01ab660c6
MD5 b1c6a8ae2c5a351b189b7d484886d29b
SHA1 3330e4d6bf27485f104e7156fc272974885416d9
SHA512 d2aa656a33bdb432ea9f743735c2c8f0c1cdb08e058b4b3d741862d30c4a4f3f815d6e61fd42551648d618f836c145cca352458491d631612cbb2138c8386d31
SSDEEP 12288:QHvUrBFrEjwaQsrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:QPUr+NQ1BMvjRA+iqMIjmJ8c+hE
TLSH
T17A65E12F21AC1CE5E676A17C89868719E771B8661712D2CF02A1817F4F37AE87C3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 521dbca5662d7cdf9ccbac5ea48101cf421fa6c3421252a257f6987b227e0f45
MD5 8ec36e23168791665adb0bd4455aa24f
SHA1 7b632f23b151ae3eff449d1b2dadf90b8dedcf15
SHA512 1930c1bd7738084f6e80a6cf2fbcf4a62d3af14889f69f44e96e06ada95b1c53358df759421e52bfedc8484db4eb8fb5524074a890aff8c9bd014dcad6a5edc0
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjov1PiqMymJ/+hE:RG05lO43bLtPiqk9+
TLSH
T162D5CF6E62EC01F9D1BBD17CD9C6460BEBB23825033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a4e1180086b516acdcb6f55edcf6178ac8f2b737865245795d21b94cfbd182fc
MD5 1429fedea283ec35c4c2c5c418bd5ca1
SHA1 c110723b3524155b5102d7bf70d32fd7f6182b03
SHA512 db3a5ae9b7edecf5b2a7c2e698f6da6766cce4940288d98df69031555900d6bcf5351268cf91d42829892ff22f6037acbb705a99a21ae554ada9af15e994cb25
SSDEEP 24576:ifa5POZ3dpyWVM50JicR2hG0lasx2+47eidnTBMvjRA+iqMIjmJ8c+hE:qa5POZ3lJt2pasx2+mQv1PiqMymJ/+hE
TLSH
T1AA65BF5EA2FC01D5E579D17CC583461AE5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2eba038d03f7c8c87789e3b478d9bfdd37fe4c85795f6a84bb0d7f2204708145
MD5 8070f03ea5e368f8981a0a0828389824
SHA1 d7501e1e2163f224538c8db0a4f99a02ba05bfc6
SHA512 b470cd5b928acf1beaf58280d9298a0d788126c7bdce90e84996fadfaa2520f179e14f016c60033f858309964d2aea58a3bd430049d0605d5131c1705799766c
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkpBMvjRA+iqMIjmJ8c+hE:JNc/zEOVHFdv1PiqMymJ/+hE
TLSH
T1FC858C2622E901E4F5B7E1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1233572fd59224cbbcadf95ecaea9cdccc6ae4bc721b020cac66a1c854d8c5a0
MD5 e41fc5eeaea788ceb83e7f70fe24491c
SHA1 481d2c00fa0c0f6b5874c8d824b1f05b12b0da36
SHA512 c66797e5649f2a97b6f2f0cbb41a45f65820669883e5b4bbb437e26d7ea119eceff268d11a10cae7d900d71d5198dc29735a6467b0f8902a46d880cc2f7caca8
SSDEEP 24576:qzkNvNnaFeYhJNtmZBm/BMvjRA+iqMIjmJ8c+hE:qzMwBtOm6v1PiqMymJ/+hE
TLSH
T12D55AF2EB6F806E4E1FAC6B4CD238512E6727461173293CB5290C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5d0330eed9fe2e6abe619cfa6f5d91623dcae45200953931f32c9f9a6488c87f
MD5 6664ffe2f36204658302c31ac7f0f866
SHA1 e295ff84375113de88914e2ac990305dc3d753b5
SHA512 065f38bb363f2030c6447fb3d010cdffdf3e8afb8a259adff110c3e229ebd3c3a7818906bc77b3f3591332357e7915e5ea915ffcb7c9d53949a640c1dad444de
SSDEEP 24576:jD3FHshBIYQgAMBMvjRA+iqMIjmJ8c+hE:jDVHeBIAAbv1PiqMymJ/+hE
TLSH
T10C75E13DE69C04E4E57BD17CDA638606E37178AD032266CB129491BA5F2BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/836-167-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/836-355-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/836-161-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/836-166-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1092-204-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1092-198-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1092-397-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1092-205-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2060-172-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2060-413-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2060-415-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2060-178-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2060-179-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2060-367-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2456-185-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2456-382-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2456-398-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2456-400-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2456-191-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2456-184-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3376-2-0x0000000000D10000-0x0000000000D77000-memory.dmp

Download

memory/3376-0-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/3376-171-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/3376-8-0x0000000000D10000-0x0000000000D77000-memory.dmp

Download

memory/3376-6-0x0000000000D10000-0x0000000000D77000-memory.dmp

Download

memory/3404-111-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3404-118-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3404-209-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3404-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3404-119-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4372-404-0x0000022BDDE10000-0x0000022BDDFDA000-memory.dmp

Download

memory/4372-481-0x0000022BDDE10000-0x0000022BDDFDA000-memory.dmp

Download

memory/4664-211-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4664-217-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4664-219-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4664-210-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4664-221-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4820-151-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4820-149-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4820-157-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4820-322-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4912-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4912-197-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4912-106-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4912-105-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4912-99-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5128-145-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5128-138-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5128-139-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5128-291-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5304-136-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5304-124-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5304-130-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5304-123-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5304-134-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5672-227-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5672-234-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5672-228-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5672-401-0x0000000140000000-0x0000000140172000-memory.dmp

Download