caec509844fc679a3b78cbf986ba93e4cf4b86aaa508dac00e0301d40ae37131

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
Size 3.9MB
Sample260810-3vm14a1fqe
SHA256 caec509844fc679a3b78cbf986ba93e4cf4b86aaa508dac00e0301d40ae37131
MD5 6a4ad728d351435a61cb520f1fe9f307
SHA1 b9ef57b8d99213145d16e3caf9f027f0d8ed086c
SHA512 a07c49651791103285130f00269a7a8b2491fde1c06c8f60c42f6c1c8187beb04fe6187211f44b0cca6dce7ea279af0e7216c45b38aeb1587fc6eb0af6b12111
SSDEEP 49152:oKCJkTfkuFOGwtf3b8OsRTaFwI/iluG2ned5cFSixAa70u/rfz85WK+nzQPm6Ygv:6kTfK6YgAn
TLSH
T172169EA262C6606AC11A50B7D9607A307FDA5C38F706DEF210992A3F35F3D60B339759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3036	elevation_service.exe
5004	elevation_service.exe
5668	maintenanceservice.exe
5104	OSE.EXE
4824	PerceptionSimulationService.exe
5140	perfhost.exe
6092	ReFsDedupSvc.exe
5700	SensorDataService.exe
3128	ssh-agent.exe
2756	AgentService.exe
2424	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e723fb68238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8cc9b072329dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbf164092329dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcada0092329dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005b86a6092329dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccda95082329dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	2756	AgentService.exe
Token: SeBackupPrivilege	6092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6092	ReFsDedupSvc.exe
Token: 33	2424	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeDebugPrivilege	6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3036	elevation_service.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
6000	2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 5568	2424	SearchIndexer.exe	100
PID 2424 wrote to memory of 4860	2424	SearchIndexer.exe	101
PID 2424 wrote to memory of 1644	2424	SearchIndexer.exe	102
PID 2424 wrote to memory of 916	2424	SearchIndexer.exe	103
PID 2424 wrote to memory of 1688	2424	SearchIndexer.exe	107
PID 2424 wrote to memory of 6068	2424	SearchIndexer.exe	108
PID 2424 wrote to memory of 5936	2424	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6a4ad728d351435a61cb520f1fe9f307_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5004

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5140

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6092

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5700

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3128

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5568
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 504887d766715de059310ccd228fbed84547dc4a96bf9d69c2baedf20535662a
MD5 09508c55395a22e217d9d9efb4ab8160
SHA1 7853209ff155730854b5137e1d5271859e8b1bad
SHA512 0f0632cea71a57d8b806cb3966b7057943d6caccd61fa35049f966cdacfe3e7f2bfbd2e67786f80234adb3403477929d47ba2c093b91334a284b42861c1b7eb6
SSDEEP 49152:4b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnkzQPm6YgA0uG:S3q6sjBv6YgAn
TLSH
T196D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 52edef6051efd8a95012c9d86bbac42b9eb3f02b8f58ebcddd7f9de21731de71
MD5 805a59492c0c549bca19b1eeb7f4de95
SHA1 e7a6fa23ec4e467cba64f848e84113e04356fb0b
SHA512 6b3af1de4e1aacb4c2df622cee28ef8f11bf7d10bbaa3c884d2aa858698313c64a6ab9f3dda4a619c840421b9c36ad82221d93ab5383aa3b8ba91414680eec38
SSDEEP 12288:U1XLsswWkxy2lRq2czANRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:yXYfDtczAjzQPI9hAH8CzQgAqvuG
TLSH
T14A750129B3D409F9ED6B827DCCA28951EA73785047A0E7DB03B489654F332C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 fc2f0b6c63193e5ef3a892971b0f2b4935c77129be87da9605b562c5ed2b28f5
MD5 ac9dee085d832831e421ab3d38bda7ef
SHA1 4626c482310ab482c897121b241979becc119a40
SHA512 7729f2ac2ceb321cc11d3993af2fd07483da0fce22643772b85372a47acd08faef77bbdc880432825a1cfacdf3fce6656a691902e258748bdfb770ec59fc2c00
SSDEEP 24576:/0Le5ji0hmxsrMszQPI9hAH8CzQgAqvuG:/Pji0AK5zQPm6YgA0uG
TLSH
T13A95AE16F6748371D073C0B9C5D2A69AED7230811B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6db30a1c21ebb1a58924baca33b2813837c0ba2652d63fcca752409b5124ba71
MD5 61d52ca7c14707f589bcd1900b189521
SHA1 c19b0e14a6859d4e77c340c46b3d2995217dbce1
SHA512 54543cfcaa56dd94e4c0757c9dfe3377304c04cb0fb9bbd2725927891613ee3cf92238fea8b62c6fbfeb17c89780ec4123cb1933c3435edbf20f3175bcb24e60
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWn6q8wyu2zQPI9hAH8CzQgAqvuG:B/ezSC6vUzPveHjyNzQPm6YgA0uG
TLSH
T19F756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4eb8f3a1afefdb3a015602b402f574e9adc8ef2b84f152742e940ff434bf05bf
MD5 7a3207e1af637e1542f65a32a03c97c6
SHA1 4e1a8217a6917d69dccd8f272b60fc22eabf2a05
SHA512 3352761ab7f6d3708ad5f4a96d36e071516b970d43379db231995b545c85742f7da183e05128f3845c2163874f4e943feadc8867e213a9a6c692c65e382181c8
SSDEEP 24576:VVbqPb88hv/l+YvzQPI9hAH8CzQgAqvuG:VVO88hXl+OzQPm6YgA0uG
TLSH
T174559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 a5df266ee8ff052c1b9451904b25d28ec063d1d0f6f832dff260ed140ca23ff7
MD5 c6b5277d91f5b5d90bc65b4bb6ceb282
SHA1 170a88c18e91367b26ab86cc34e1cf0578a17eff
SHA512 fbc62dba54c9c95fd36af18ae33b2e2e4c7b95a1733b926192539b15249f254acc42e042d690425e7e6e46ea6090b11e561313ae7c390c0bf5f0bf5584bf1657
SSDEEP 12288:zfGRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:zf4zQPI9hAH8CzQgAqvuG
TLSH
T111552347E59805F5DF5F0B72586B5FE2087D8DB03BC0A76B02326DA68E7F0C4E946292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 b9f2930562b8b91a9ce5bbf11d43663b4286ad1f5235d286f579015a4cbc126e
MD5 52780c33192b1670acb57e3a57d8cbf2
SHA1 07a48cf7d215405767836d4f52d8d5826f3bea69
SHA512 acf61bfc96a8b019036af76a8beef21166d545d2b9a42a85390840d617ee7a928841537f501a2117aaec2430d50905fc0f687ef373ecccb2a90bbb72ec65b19e
SSDEEP 12288:reBNUbTVO86UBRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:rJIUXzQPI9hAH8CzQgAqvuG
TLSH
T15875CF3BEE28FCE2C67E4DB95A918740977278704B51A3CBD135820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ce8d83f0707937b86f6ff3686aebac3399c94334e2283ccbcc748749b2ea3aac
MD5 ac9a9b80e9cf919f3e35a11267f60c1e
SHA1 24aa3ba7eee38f9cd6e770e8b49866415f778aad
SHA512 69bab570c4655ec62f4aae8249f617dc9fa5c8e4ea78db9b6552635f01d16f77e9b772e16e730c660ca59090e33b20750fa7b79c80dd0882a360b503182123f4
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:oQvGAdlCEL8c/DRNw5CI6YgAn
TLSH
T1B9267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 07c7c92e74d4589b77eb9ac916250647edcdb6a86dcd0b027e45f2de29324b18
MD5 45573aee5e920e6596a2b3e5251b47dc
SHA1 0124bffa40f6137b3d545fead716828c53ef7e9d
SHA512 0d7cb2d30aab262e221a966627891d1f450932ffdf2884cd1634c2755193b1f17593d9f0be9752dbb31ffd82e91d2fb2fcbcefed15133a2fc0f661434a97e6cc
SSDEEP 12288:zAwSfxL/2Dc3FDLLmt0LDQewsAj/RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKole:swewsAjJzQPI9hAH8CzQgAqvuG
TLSH
T1EB85E031FA74E436C77F0DB21B36CB16187DA9204B912AC3E3B84D9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f8d221130f0a5011cb9931d952e552cf650869562197c63049ab5acc11d0df97
MD5 1a6beba73fc492cffe3b6aa7f4c07346
SHA1 0f91262265e4aa46ea2ca2fd83001879d77ca191
SHA512 8ff79e98ae01390a82d1bf63bf59b4878516ec096784a2c66185c76a2aa3bd13bc6aaa5222312a2f1554e8ae9da3dbceb6efbff9c8c4f44a67f877288e82172e
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH8p:CUEtQevvqc2W1cpV2tI328p
TLSH
T1E5474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 706b6befd8c300ffa45c8992d45b06362c6634374cc2d3159a20a5ea760446b1
MD5 1d92c199b9af76879adcc934edaa0701
SHA1 aa6ad7d0bc178fee8f8bd6a49f61383268dc375f
SHA512 7be1692f0d41330130d920886f85c64551cdc4a0f9dc2f24a51bfad09ea74d6c6f86b8dddd7aac9a062672aae3344bb22a707303385005339b49eb7d18e047d7
SSDEEP 49152:9CbRquA/m2yL5zTfFiV+XenmE3/zpzQPm6YgA0uG:6oquVjnmM6YgAn
TLSH
T168D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7a2dda062e8e0708326e22b08e47814c3bed8755a9fc38d79848cb3a89491f2c
MD5 b68f1ae7a53eed05b2ef4d4c291ca7cb
SHA1 3845fea1aee060073bffc5bafa56125e1337a05d
SHA512 008bb3de85b9e2d3fd7659884908de09997bd608d363890ef43e736198ff8d3c57c7db2ae079d23d532cd2e547bc8b8b55a2cdec3b98ed0cef4aeeeaf0590ef6
SSDEEP 24576:/AhGL3IFoiwtA5l7S53azQPI9hAH8CzQgAqvuG:/AMUFoiq5KzQPm6YgA0uG
TLSH
T1EC359D81E7F945D4F5B3ABB899B68571EA76BCA55E30D20F2120D11F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 a046e71edc66be78d1ec6c67594051b0dc576306e7ef15ca091bc176ed35afd1
MD5 8644e0995c8ab13d37f169b5ab4318dc
SHA1 2b1730a9262a2388d1086240f8a5286e1917802f
SHA512 eebc662b504eb3395cda2031f98bf8a2bb9259e8d3c61bb8b42973a3f3a8a47d787d74890ead48af1afc3f7144e16f55037205ce0260e20aee8ea4f155ac0b5f
SSDEEP 12288:Kmw5HEjsChN5BFgl0WDm+CQRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:DwucOWtzQPI9hAH8CzQgAqvuG
TLSH
T14975F14A72E80CF9EA6B46398557C632E7F2BC112B21D71F0360C65B5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 9678cb83958fa34e385721f5c74557ed3776b77a8fafbf6b39543b86638cf8c5
MD5 7c34a06073b55919143bc51410ce1590
SHA1 4643be954a7f55a04b1288671c604575e52515da
SHA512 bed451aa83f448f483657b8de5337cba7e3fd828d3d48ce5b4f76d952677976f829ccae48dcc3fe0bfa3958dfc61635b56b1c22fe6792612cf59c7571ef62df0
SSDEEP 12288:i6Z1IyvRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:jZu0zQPI9hAH8CzQgAqvuG
TLSH
T11C65128A72E821F9D6AB4379CCF64B8187767861377193CF023106A65F37AC56D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 03a41b5f16cb2a3711e96c42c44dab1d1ea628912273c15aa34bb9acd58a087f
MD5 a12cbd3ec2a722fe4e3cc155eb4ed791
SHA1 77ac84233083d6be1b767cb70aa3d131ae190ad2
SHA512 d062ff6c8620c0abf057404a93cc98808523c18cda2ecc6884f76fc6d9329b41f36cfa1ab8ab82f8ef1f9d2742c63fae79a8b2863345f22fe63183cc7c719916
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UO:IQRQyi36YOcPbLvw2gAf+PN376YgAn
TLSH
T10A666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f5a36a97eb176e3bca4a8c7b30ef36d47a79db50134158156e1dbd3cbf3065c0
MD5 dbf83d9e78ad8ca17a4ec9d790c21318
SHA1 3fa9be28722e2e2c701d6f27f9c0fbbbbf221e4f
SHA512 e065eb420801c67025b8ab340775c0d3aff552b63059a0f45c22c1d0561a574773df1a7d36822928d33128aa773e8954d3a08ff0e34390853185651e9160d845
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UO:4QRQyi36YOcPbLvw2gAf+PN376YgAn
TLSH
T1FA666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 beae0dfa1726a57c3ce34ead0fd6397d9a0d02e8c5166c06cd439d202b715eb0
MD5 a3c2ad6a713eab2dab8feedb2c39947c
SHA1 bde68a8a88eb8f12e39938f75b1c29044b455af3
SHA512 fc9154c57e8b9daa8bed5a819de2605b6fbaf07bde2f976ed5278bd6b928a47d977b43f1e4b503d9f8aa81e887fe84c018d8d2a2ccbd1a169ff1ae046f4f1e09
SSDEEP 24576:FwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0kzQPI9hAH8CzQgv:h68Qg55nhceWu7PNU3/5zQPm6YgA0uG
TLSH
T1A0B54933B2F600A9C44DE1769F4A872196D27C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b4c878337c9f8aaaf5e7da6b705ca32e25b837a2e318ac3d81a5d502c4a7a477
MD5 e2a2d33b8532ea8023f257b1e27701af
SHA1 65a9bc6d55be2d337d9b0bb264ee9b20be4b1dd7
SHA512 c008db275a84bfaf73d7ad6833668cdda42ab68287415ebfd0ae9a2314ca606a588245cc0612607d01c7b30659fa3c37afe8cccc619130d6a5229b052a445bcb
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99:ty5112gYy5azzVvt69nLKnhZS6YgAn
TLSH
T1C1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3bc1f2f4dff4dd460014f19eed3910b5364691cc7e61d7caf5e413e66a06ce2b
MD5 0126b41eb4ab8b4c97c1cc4e5d84f874
SHA1 f88f90cce361f3113c90af149f11c149c498d38b
SHA512 30191fecf034d45b9d8cae632537ed3a6a013348eb302ade03c646491ae28c7ec4f32cec82284de3640125a80e34ecac3d981984b9ff3c3f071194d802566004
SSDEEP 49152:zB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glTzQPm6YgA0uG:Fu6Jmdxd2dj6YgAn
TLSH
T13AD59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5d5d50c253a8956133ac2bcc9f341aad89154efd4141df6e37733e3a611847cc
MD5 821845622f94bc18546a2074e7ff1c5c
SHA1 b2f58ebf95d301d7aec064eadd454f7a21e2b5b4
SHA512 8dce6b053f87220098cb38c14394b89b143e950812e443e1af95fff5b741d00b10185427486ca666367e3dab3b51db5b8f5c18f5af6b8098cdbc1a10f6cb0f5d
SSDEEP 49152:81hpsNoJpF1A63U44CwH7R4x3zQPm6YgA0uG:8mifPWRM6YgAn
TLSH
T132B5BE13F2D801E8D06ED17887569632EA72BC450B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6809b2124165f75f351efc411302667e26b91a0c89f659d4f22d32dc837570ae
MD5 559baf97642c0cdd132f199996a93894
SHA1 24b2234bc53d94750c9c0ac1bf72423a4f18a852
SHA512 73fb14d81d1c77ab918775c92bbf48f82369535a9a5c896f35b7fd3510894fba3b705053bc040829623431b59bf49a592c700ffc1011d87516386b049dfa8ac4
SSDEEP 49152:MSuZQIY0Be2KcRVtOnks6NMHq0zQPm6YgA0uG:u5dKii61O6YgAn
TLSH
T1A1C5BE03F2E901E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 52659286115e0145c8e18fddd79293dfa60cc683cc0f4306f55ddfbc07c2028d
MD5 a140e45fdafb81f31bd33a77bdc7e5e6
SHA1 da9393615d5693c40327748ef9feb8122ba79e44
SHA512 0083e5daee01d23a67785142c99178981a9e06c67d066f124a1d827a4d786b165119adfda7145543a791b16567c8f9b3f088dd09e9c12a2c6a9f9f5a8a5603c6
SSDEEP 49152:HhtSn8EApI0fig3giDn0AP5wjzQPm6YgA0uG:WX2imphg6YgAn
TLSH
T1F195BE13F2D901E8D05ED178C7568632E962BC150B38BAEF0A50B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 17a01c935c07455db6a3c1ef600016476e03fa0a5827eedc8d1e6025b5bbe334
MD5 bcd348eb89598c9576dd94c1e1004e28
SHA1 403d4557dd1b374f9a90c1462678660dee481df2
SHA512 1afcdb19a6e55a2c7a3996053b5af428c97ae3a1fc4969791dfb24642577a7614546143835bf0e240084cc840c5fd822c0ae68c7d5be1afc964e34a057a02378
SSDEEP 12288:HuRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:HAzQPI9hAH8CzQgAqvuG
TLSH
T1B355234AF5E80AE5DF4F0BB248675FD2086D5DB47BC1A37B123318628F7F5C8690A291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 45e771749cce638bfb3d7ed3872854d14d08eec9dc62ab43b9d47a08d2b52570
MD5 19100ad405cca9eb7874d280234f2a46
SHA1 b0f91042c8b2be641f5183ad3a7725a931c499fe
SHA512 fb9e520a5186af7201b23437ee19dacb84a495088eafb9b9210d7946be3ecb37aab974b11e5f4f0ae0d08363d1ad16b358b8d291cb222c86ff877bd53929137f
SSDEEP 12288:aLRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:alzQPI9hAH8CzQgAqvuG
TLSH
T1BF55234AF4A80AE5DF4F4BB248675FD1086D9DB43BC1A37B123318628F7F5D8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 9a3f0b9cf77bf49480061f812f79978d212fa68934dba4ad3d2ddaa4480e44b0
MD5 8803a1b3a93a538d9c37db47efcda27a
SHA1 380e42546da2e6b533c9a19759956465de91cac2
SHA512 fb832fa21e3254b3230943082ea3ab7b707ca6a5ac845f7461f53379852765041eb221c33b49c14838b85117a6610aea2b2e2c6c99074211a2fa293ff3d9c3df
SSDEEP 12288:2pRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:2fzQPI9hAH8CzQgAqvuG
TLSH
T1E155234AF5A80AE5DF4F0BB648675FD1086D5DB43BC1A3AB123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 ca95949430c33517ac24f0a8b82bbd651a2dbcf7b285189f78d56ad8efcfe04a
MD5 0c766136b26edf27110c5a8bb863a369
SHA1 1937ee605d5b20c4f5e307f2a7ea2e28c627784a
SHA512 277b68dc6597075854ba61588b51605fbbceac7675c53f338cd7d07c40a517bfb0e78345f8cdc5ad68f3e9d3c93fd0417f0feb569c924f0356862fdd6a1b9707
SSDEEP 12288:mVERQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:RzQPI9hAH8CzQgAqvuG
TLSH
T189652346B6A802E5DE5F87B688374FD144BDBCB47791A3AF032208A64F7B2C4BD15790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 07312fe80e1e3052ef49cc6caed4d0825354b2ef9b4d5fd924a5a39e88aaaabe
MD5 61a06146c0ccc8ea18cc5a2ce66cae52
SHA1 6247dc529a048960cb40e4b1aa02fec275ebed68
SHA512 0f01a79595c6694969722bbaf86bf7780ef3338151d724db7b6d6995160609fc904729922042144b6aee15735af383f42f584d5ac87848917b7d7070ef3c73ad
SSDEEP 12288:WcRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:WyzQPI9hAH8CzQgAqvuG
TLSH
T17355234AF5A80AE5DF4F0BB648675FD1086D5DB43BC1A3BB123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 12e84acd59cf6c49b121149f3a26160d11607bda6d5f329171ef6970dc0705e0
MD5 eb69f567f126b0baf4aadb3703e2c534
SHA1 82497de07963f9630179bef1bb7f4e19e7b3bc8d
SHA512 563fe8c11b475eea41db65a17210536f147a1b35ec1fcc14e3b7ffd185aa35e61148a5db775a71d3455b38607e15dd90a85e12147799de05a08dea0b9d27d499
SSDEEP 12288:InRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:IRzQPI9hAH8CzQgAqvuG
TLSH
T15355234AF4A80AE5DF4F4BB248675FD1086D5DB43BC1A37B123318628F7F5D8690A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 0fce5d51accffb26c0b4746b8f2704eab411971095d16e7cbe350889cfdb3fc3
MD5 f37f0bf3d3d89d11569c8c89b5858065
SHA1 18f019264a5e4fbe9abbfddf834fcdc59797e6cf
SHA512 f093607ad27a2030c3b1029326e50f7398f23f3f1aeb846c663c6e5830341f3ae797d89835d104e8ef1a1d3cbd97b019c38bc8f1d2e5b944b4fb56413357fba7
SSDEEP 12288:XDRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:XdzQPI9hAH8CzQgAqvuG
TLSH
T1EF55234AF4980AE5DF4F0BB648275FE1086D5DB47BC1A36B123358628F7F498790A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 465abc163f252101010c997ac0b9d8c730b6abf02182d8df4b8a2fceb18ed519
MD5 1662665eadb6943b99ca333f1b34a3e3
SHA1 cae493bcfbf31a69a72de3feba62c24631863ee4
SHA512 b6962ced4cf39426b3b0e1d8e1618614f362091f32566c2cd455342bc00250fb97b89eba53861bdd0932ce17c9fb49121c6312f48038257a348f72f677996047
SSDEEP 12288:PiZwbJzzFEoS2cPvyrRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:qZMNzFVSOFzQPI9hAH8CzQgAqvuG
TLSH
T172750195B39008F8DD67823ECC268E52D6B27C691BA0C61F03B436675F373911D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 c82afb38c46ebc81e4fa37e87a3a7bf97e4efc647df667e0fb120618d7bf9de6
MD5 4b0d6bbc3366d9e3a9a339f0cff2135f
SHA1 9e9361c902a5ab50500c29544fafaebd5c8f75c5
SHA512 990307c78541f6e7b7bfee98b0e83efa163e5cfedd3601ed1cd0293cc9e6d81c5a96585aeb6d0019d46ba88b4f3b0b0b9a33fc6b25e82e1ccc3bbdf58a551835
SSDEEP 12288:OCRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:OEzQPI9hAH8CzQgAqvuG
TLSH
T19755234BF5A80AE5DF4F0BB648675FD1086D9DB43BC1A3AB123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 5cdedd33040d813aba6aef299b22caf9d4f7d98b479fe7769aee9c1693cc9e49
MD5 232dc1fb2d009b5b3ab683ed18dd66b3
SHA1 c9da53f735eec9ee09ccb4543b5ad3b6f04ea591
SHA512 a8ffe8fe3abbd39250a7788270f2b8f9b987637a1aa4e10c780b3c720eea876a59bee4d588c906a8fe44b62018622ea44beeddca00aab228f4962ac59061e151
SSDEEP 12288:x2RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:xIzQPI9hAH8CzQgAqvuG
TLSH
T1A855234BF4980AE5DF0F07B648675FD1087D9DB43BC1A3AB123318628F7F5D8690A1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 80aee37ceaaaf1d5afe0aab0d2e88a5b15a7577feef2061a2717c478aaee13d0
MD5 6b459132ebe454704057c652be452ead
SHA1 a73859ab730d68e646cb46e04b7e03cf9bb3b9eb
SHA512 c2653e2aadf66f2d375ffcbfdda457eb7abecb789322cb4cfe288088fba83161dd97a4b66f7a451c2433454b6dbdf781d6114ed500f122874e73bbffdabc1fd5
SSDEEP 12288:VyPz5L8vRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:8zyZzQPI9hAH8CzQgAqvuG
TLSH
T1E8650247B2A421F9D56B8379C8631F82E776B87117609BAF136006761F372D0AE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 8cdd260100227d9c534c7eeaaa465d4dcba9a41449a91f96d5582ae2021245a5
MD5 10ae5d2671e6f08269aad72acea6b645
SHA1 5df4f7d3b963b7fe32f116e7ecabe03a1119ea83
SHA512 d8fad602d96510bc840916c3f2ebbbee5f5edfb0940248e8463b2615d8badabbe49cac4ab0bebd331492ddbb9a6b5a1ba4541e81f3b135024678e85136d7ced2
SSDEEP 12288:BCRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:BEzQPI9hAH8CzQgAqvuG
TLSH
T14A55234BF5A80AE5DF4F0BB648675FD1086D9DB43BC1A3AB123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 10ad74dd6ef40e12e928cb581fa1511bd57ddd90b4efe052603495b6effa397d
MD5 6321b45ce95d17278fff773ab5ee1640
SHA1 78704d6a8c13f1ecf56815a7568581c4727fc723
SHA512 ebe0812a9d5d1b9e92e5143683ef4845f7475e48cd799795d5b3dbb34ee96324aff682c54fcf5b8e4a686bd59e62501e382a2c541faf88f1a20d25d838738153
SSDEEP 12288:ZCRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:ZEzQPI9hAH8CzQgAqvuG
TLSH
T17A55234BF5A80AE5DF5F0BB648675FD1086D9DB43BC1A3AB123318618F7F4C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 2e62c92030df0dfb9f58b6ae3ef6aa8467854d466425d99d5fac62fc3d902951
MD5 975421dc383187497d6a5c07c2ea5606
SHA1 1a8e87b66886cd5ed9484e749f0dec075b8ca7a0
SHA512 e258c47e8f87eed358dbdc10632bd37550be5e26fa7ae7709b081d516923983be52208dba350b7315914a304372e3142715c561a9915bbbd8e54e859cd75096c
SSDEEP 12288:xyPz5L8vRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:gzyZzQPI9hAH8CzQgAqvuG
TLSH
T138650247B2A421F9D56B8379C8631F82E776B87117609BAF136006761F372D0AE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 2cb84f7b468c32538f3a37f377552bc16f3f9c9e7330930e3263afeb074be203
MD5 b566d75a0e1f9ad3f314ad3aa4126385
SHA1 5a16be0e6eb45a710e0ec785ef405c282a9eff35
SHA512 d3b6114c689615ccab01a7c88f2ad8ac6d0537c5cbc3ccc770ddcfd690c39889963cfdd0b93998c84a6c9b62facf13889c2a46b81ebca72c92a35a169bba1919
SSDEEP 12288:QCd9mWYoaLHF3z0z04PDvh5RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:JTvaLl3z0zDPzQPI9hAH8CzQgAqvuG
TLSH
T197750195B39018F8DD67823ECC268A52D5B27C691BA0C71F03B436675F373A01C2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 90797c8ad284ac26888223ac531fcb74dba915ed6e4714977aae889058082400
MD5 27932fcafe50c422b7bbadd681a95035
SHA1 974568e2583fc795595e14195bfe3ea2b41a1380
SHA512 565fcc56355f6940ec4e0d3f0794c6ce0e2ba04cfdc150761947b568e0cb435b79c09c543164acc52882322ec50f36997bf5e229d310b8277f4b4777f6da5598
SSDEEP 12288:ri4e7mRdTfgwCHKy7GLbbdIvIRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:r3bd9CHKy7GZLzQPI9hAH8CzQgAqvuG
TLSH
T18085CF90F3E414E8F1B78A358C764612DAB67CA91B71DE8F03A4255A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 b9667df70f75afe9cb9e6b1a5ff7dd7158e7bc0bd7fd1fa1497797987dc062f8
MD5 d93b1a3613986f3cd69a63c2a635a9c1
SHA1 0a1178e96b90b1fcacbacdd0adb80f5ed0058c02
SHA512 3f4e9ace043b373318c6f8eeb29d69b2cf07fc16f4a8434bc9e49002d42d9a9f3cc3b69be77f9c3c92d54e7831f804e72b6b77bf25732640c96a62d7836a2230
SSDEEP 12288:NJRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:N/zQPI9hAH8CzQgAqvuG
TLSH
T15F55234AF5A80AE5DF4F0BB648275FD1086D5DB43BC1A3BB123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 3bc95f1210c2c46eeef492ed12a4c911f44bd352f3094d9f5b9e76d1a617fe20
MD5 adf48d9ea97c04269656ffec61eff9fa
SHA1 d5e9f3a18f2ff230cd280738348e660b1de34499
SHA512 6b0529b0d5f88f5198cde859f11cf064c3d9b862716bae9863d250df0dcdbaf22faa40dd6059fe274c74f240c63e7e8007cb606e977c83f17a5448e16f9bdf04
SSDEEP 12288:8PRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:85zQPI9hAH8CzQgAqvuG
TLSH
T1A455234AF5A80AF5DF5F0BB348675FD1086D5DB43BC1A36B133318628F7F48869062A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 b93a63569dd637d865934efadee75dd0eeed5058395c9dce6ccda9bc7c151401
MD5 7afe3b484684d3c928f7a38071b9717b
SHA1 92753a1e0ddc68297d889bf69156c02631912b6b
SHA512 9fbbedef4ca2e0b6285e29027a2fb64a4f8058477da60575efbd35a50833e5c4bac4ea67b843460c98f2a5f6293c730a6d1d9a86991ed3653bf3a98291964dcd
SSDEEP 12288:4IRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:4uzQPI9hAH8CzQgAqvuG
TLSH
T14155234BF4A80AE5DF5F0BB648675FD1086D5DB43BC1A3AB123318628F7F4D8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 7215c7bb2d75fa8025b8480634675696bf122ddb0ad5f57eaad5f2dd975b73b4
MD5 2dc68583a8f77edd71fd877f34f6ed24
SHA1 55458dafda6468cc4228cf20c2f5e28c5ba4105b
SHA512 35cfd67d58cfc08831dd8e83af7c0d45f2121ef925bf462aec42c30e345b25539f9494ebc491db4005554c790a298b0a3eb09e04a6c8e2bacccdc437412e81c9
SSDEEP 12288:qCRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:qEzQPI9hAH8CzQgAqvuG
TLSH
T12755234BF5A80AE5DF4F0BB648675FD1086D9DB43BC1A3AB123318618F7F4C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 a994db2ee6e6ff4bfdfb4e4bb09457e3242f7d8c526ccbccb103cfe8b51f8fba
MD5 212420f8751fddc965b0eb0bf56540c1
SHA1 16c9c020063623b35d2f32b27b7ce7ace4c7670b
SHA512 7a63c32d63cb13f0905be9cbec0651cd5e52a8d2f33fdf708f368f97eb0d29948fef36b70f66580b234c07c4654b0313e1d83c166d32c5e7b02db91ed6afa292
SSDEEP 12288:CJRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:C/zQPI9hAH8CzQgAqvuG
TLSH
T18F55234AF4A80AE5DF4F0BB648675FD1086D5DB43BC1A3BB123318628F7F5D8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 3bc679494d2ccf9a73e4be63c0e9dc5bfa9325fc9d1a7d6cae11c39d0331d73e
MD5 f96b90ca158ac8ffcdfe4b5730645fca
SHA1 c50920cbabd396b38146514da94dc6687b10c76f
SHA512 7fbde625c5d84497dd8b233e921b762ec6cc113cd2c4ecf61eaea2113a00e641b31b2cb7794dd5fd9ed258a87ab073cc873b1a715db8c4afed11a835b795713d
SSDEEP 12288:+aRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:+czQPI9hAH8CzQgAqvuG
TLSH
T16E55234AF4A80AE5DF4F4BB748675FE1086D5DB43BC1A36B133318628F7F5C8690A1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 2ca0d0dd8abef19d0550e65eb7c8cae42928dc9c94edb6cb0d5ad535529de067
MD5 15b8b2552d66aa0c19a1f9e494a9a1eb
SHA1 07329b5102c64f389ed62aaf90eebd1b1fc2e008
SHA512 5c39ae968752f5f6b15e1ea37807ec9d4b9cf1c3b7dfee182f3a7df8d52b7723168873a73cd6e5211db18f5cdadb135960211f7815b19c3af894975ae1f778ba
SSDEEP 12288:WcRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:WyzQPI9hAH8CzQgAqvuG
TLSH
T17D55234AF4A80AE5DF4F0BB648675FD1087D5DB43BC1A3AB123318628F7F5D8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 e62f5e6f2308ff31fb05e3e41dcc2ab561b97cf7ab605741f0941d708b13d464
MD5 a2d9da7f1c7837607b19b450796a741c
SHA1 75d9cbb800f379019f36c614b6109871ae6b9a8d
SHA512 c635dcfeee9ba043fdbba0949f209d93d1336d1e2d22b72b17048cd2ab10e702b8ac15adf285ee5fa2fccf4ae96e994bbd15e98312a9c28a61842320648976d9
SSDEEP 24576:qfwvhk9RX6wkyAIYzQPI9hAH8CzQgAqvuG:/MnYIYzQPm6YgA0uG
TLSH
T18285CF29EBDC04E5E177923C89B7464AF6B178691B31C2CF025A53AD0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7b418f4e189c9f9dfb7f5af60309a02ee4b415a98307427fd4bafa45e76b25ae
MD5 1d79ad938b51721dbbbeac16ad531cc4
SHA1 c3697eeaa634b4b6645f3a508230f453d3d053cf
SHA512 a81290e0d6efe7f7497738a41aaaddd4cd1f93141c55e641d177f09e01b9c24bf796c8129409f8849277e4c9f0606dde614d07980c8a0d97b9db3894621f593b
SSDEEP 49152:ZYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0DzQPm6YgA0uG:0ySzPb6YgAn
TLSH
T10C066C56A1A801D5C1B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d7cf04cba9cc106a26c8fdb4370458ab243ce6fb78706c663c343c7588c0e218
MD5 afca8ac7a9096c69c2ea8b9d6097df84
SHA1 02f96aab5717c2bb98f7757b305855eff77527ac
SHA512 87186db0073b88d87872a72dc898123b6fddadae52083f075f13143d8e6cacfe95157d6611e4518508e2abccff901ff6a17e755639fc83aaa2445ca35586d789
SSDEEP 24576:b47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYVzQPI9hAH8CzQgAqvuG:b47JUQjTirIhCnDHUPfF/TzQPm6YgA0V
TLSH
T19E65AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3b8cbb93d3f8bbdbd4d2c5f30cd53183c380e2bd4e7d2c1e81d5058ef4e8a172
MD5 1f620a68af93ab1aee776d5ffd6cc2e9
SHA1 c5ac2a9b140da47f8ad46f15cc6678a70567b260
SHA512 730e5c834984bba33b2832d4eb722d1258111b1e56be5cfb89163696f091ac76d7560564d8cb19640dc2311c5fdfe74ac2475a941a94df1a3f31a666ead1f381
SSDEEP 12288:nPsfSRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:20zQPI9hAH8CzQgAqvuG
TLSH
T10F65F10AE29802E8C56E5276CB564A81B3377C6457E1E3CB13D0F47E0F7A590ADEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 3de0ad74fa81755d123023e9c6fbc94959c0b3dc278983f6789129d6726d2063
MD5 235531d490a48818079e2ce11ce1cd6e
SHA1 dea4e75e558377d6e886aec6274f74507b97516f
SHA512 fb2ebd3150cb9f993b08ee68c04c367c9f414f9cfccde06a2a3666c1e3902dfb1d1d8c20c4916ea77eb53cb0b0afde5148d1eda877bf97ae61495fd0c5f83e8e
SSDEEP 12288:Qjt73y5Id2j36PLIGk8Nky0CBbc8xbsIStXaRMbbaQM:QB31q0RZBo8VrIXaRMHPM
TLSH
T148452850766AD75FC6A940325E32D2CCAB707D05EE056F0373C88B3FC576568BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 cda9626cc34678208bdabf0c175f03ade8fd642a467084e2d48360e57aefc193
MD5 2fac31094963e39f6f934765663573ff
SHA1 c390f3c63f4451bc2e23eee0f2befe84fccb7f79
SHA512 6ad0a8fbfa67d01f53324a00ec8be0f489e8672eb42624645dce26f9adaac17a6f4f60caa6794b9aba7b575caadb87256a8f4bf76f067d92da6519385e6ff32a
SSDEEP 6144:HsJvNsGsWsdQ1AJsPwsQK5s4sTkRvKDexHzs3sfsesYsSs5sKS6sWusuHsPYsLQ2:dU2KekRw/tnL/dGFlIp
TLSH
T11665F981A537E38FD1F76072072A5B4CB764EC16B7055F26B3C8053AC86AB25B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 2f1d05cb287f90f2b5d15375a01d3e6ab61057f437dfbb35c0205bdb4afbd9fd
MD5 0e748b884162d76fa0d36f8a6deea587
SHA1 715322a959f64e299a1797b22814fd9c75fb0490
SHA512 7fd6a5997f437c35a91db801163c6567adf2c32a02e7784ca197794c794fffd7c62426d25e5d62e11b2c48bc903f8f60ac4389b1a405ca1e2c3bb6bf092073d2
SSDEEP 12288:ho7qRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:+MzQPI9hAH8CzQgAqvuG
TLSH
T155552347F6DC0AE5DE6F07B1482B9FE1142DADB43F80E3E7122219A18E7F5C4AD25252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e80b760af2d229717205fe5dee5d308507faf0165bf43db5f6167c0542084006
MD5 2dbbe434820b04db3b72e0ae143bea37
SHA1 5b95bc45bc463df8f4dce7562721dfb9efa23a5b
SHA512 de084321c4dac59ee5e3d20978bc79ed6a2245a99bd7bb1f8e9eb78bd5aa8f84880c6c0292a2ef4bb2ddf7d03b19e9999670d904d5a5d9631915815685ddc398
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bY2zQPI9hAH8CzQgAqvuG:Ugb4mBIBhGFVzQPm6YgA0uG
TLSH
T10865AE1E22EC02F5E0FAD2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 518b92806be666d4018810a237fcb8498120b9ba7ad5b59ffc88027bd63ffec5
MD5 fd37087dbec9e001f30d351b844988ca
SHA1 7de3288a9386d47d34a3a647247cc44287b2dfe3
SHA512 7e2430491cc5471e79bd9d2b179eef03241ae6877c98d2e533c6a090e3b443ff492b3e4e07838b93ac5b966ca14757cd8d92224cbe062ab681cd3126ee047b2b
SSDEEP 24576:wG88u8FpJqH1Hzria7/mFzQPI9hAH8CzQgAqvuG:j7ZFPqVaa7/OzQPm6YgA0uG
TLSH
T1EE95F165B6E001F0D47BD13889474BA3F6B2B8251364FBDF07A88A511F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 89ee5820cce0dcfa861d610516c1d055c688636e2d1697724bffeae00047044e
MD5 b164ac92ab747c46edc98e60077fd431
SHA1 b4e44919d9e4a1ca08aa4f2af50e648ebe1be117
SHA512 ad4007869d0d9915d207bbd89423dda930451476ef0454212007bd95cefffb96200e25aa67b470fc31167c1acce901b7c2c19cbf2bb1ee2c7890eebe7b5b97cd
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRzQPm6YgA0uG:2G05lO43bK6YgAn
TLSH
T139D5C06E62EC11F9D1BBC17CD9C64A0BEBB23825032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2cb986ad2e157871229c367954ef8298a0dc2c33c6098f26ae5ef6eb1cd047c9
MD5 4386c37696f2771557ef1f96e296e7a1
SHA1 808d7798859d7ea4ee97c31ab92e15d1af06df2e
SHA512 14ee741b2b027c3a06a9454a3a8b3085a0e81422f95603cfec95153691befbd81da762410531c83fd852c5b4c348ab572b17ef8c068c1f5c15855c3d5097df8e
SSDEEP 24576:Mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnDzQPI9hAH8CzQgAqvuG:Ua5POZ3BJt2pasx2+m5zQPm6YgA0uG
TLSH
T1C165BF5EA6FC01D5D5B9D17DC5838A1AE5B1342153319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fa8cbca5e17e76743fef4d1f94cabb2ded4326b5ed54a32be1f7c5cdcbf8485e
MD5 819337c410e6c874afdff9de87065abb
SHA1 660a2ac91a8d8f1c84970cee44e3b8dd1e20357a
SHA512 66eb62845540d1d96c8c2ab2ca4a56f21d8a75316d5fba848b24db6f117f421480b30ef6a9406a79703046c4ff9bc1490e8804e40afee229da8c1771d7199324
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkNzQPI9hAH8CzQgAqvuG:INc/zEOVHFuzQPm6YgA0uG
TLSH
T11C858C1623E901E4F5BBE1BE89779A46FA717865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 765dda7c32a7c4824ecda36cd841bb58c50bc0339d290c7cb0151bad5049c724
MD5 1504318412c25e899d5852a501e8c28e
SHA1 5d2c140a0bf58ffcd8477fca8b1c28587f110bc5
SHA512 f19aefee3fc41127e409287587d9d2b9574be18c6790b7f519ce0cd39b1013af137ba3289bab5626132aa54337437f74b205ada08797fc5c681137f1336d2a9b
SSDEEP 24576:xTkNvNnaFeYhJNtmZBmnzQPI9hAH8CzQgAqvuG:xTMwBtOmnzQPm6YgA0uG
TLSH
T10555AF6EB6F806E4D1FEC6B58D238512EA727461173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 82daef17d9a566f1703f303fe0393939eb7f7ae1ad19aa20a3ad800a77f49ac9
MD5 aa00b2e3d87c08190bd4343233d82690
SHA1 e2eb0df197bb94a571e0e6f72a93970454436660
SHA512 fb6d921cca5ebcb523621937b33bb1cc5fb7a2b16bf5a055b36c02868950b301bf9d13d265350bb67d26ce4d7bf3a4cc510596f4914c59c78c56290697901fcc
SSDEEP 12288:4HvUrBFrEjwaQXRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:4PUr+NQhzQPI9hAH8CzQgAqvuG
TLSH
T19075F11F62EC18E5E67AA17D89828759E771B8621311E2CF02A1817E4F77DD8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 87f9bc8a60b1e6ffd97d555d4f621859982b44b25624a239a1a26c38fd2490bc
MD5 09ddb0e3844c6f66eccc1ee2f6ba6c4c
SHA1 ecc204adea0d8917ce1e36528bf8bd73dbce6dd5
SHA512 6740e8c8b278201a5ccfae11a05d73b87f1896ef6c9e700d77728f5a02dcf428290f1cc5b14ade9f99bca21e09b78015ccd79a8d7be40c6cbad7ac3e9b8bf3f4
SSDEEP 24576:FD3FHshBIYQgAgzQPI9hAH8CzQgAqvuG:FDVHeBIAAgzQPm6YgA0uG
TLSH
T1E185E27EE69C04E4D57BC2BCC9638A06E67138B8032166DB029481B65F6BEE47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2424-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2424-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2424-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2424-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2756-126-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2756-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2756-120-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2756-131-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2756-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3036-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3036-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3036-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3036-118-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3128-113-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3128-106-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3128-306-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3128-107-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4824-72-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4824-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4824-64-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4824-274-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5004-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5004-159-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5004-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5004-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5104-60-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5104-53-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/5104-54-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5104-231-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/5140-289-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5140-76-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5668-39-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/5668-49-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/5668-38-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/5668-45-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/5668-51-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/5700-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5700-99-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5700-307-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5700-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5700-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5700-93-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/6000-7-0x00000000027C0000-0x0000000002826000-memory.dmp

Download

memory/6000-5-0x00000000027C0000-0x0000000002826000-memory.dmp

Download

memory/6000-0-0x0000000000400000-0x00000000007EA000-memory.dmp

Download

memory/6000-6-0x00000000027C0000-0x0000000002826000-memory.dmp

Download

memory/6000-91-0x0000000000400000-0x00000000007EA000-memory.dmp

Download

memory/6000-4-0x00000000027C0000-0x0000000002826000-memory.dmp

Download

memory/6092-322-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6092-79-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6092-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6092-80-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6092-86-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6092-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download