06a6ae8a05bafebd8d551dfeafbee1e70d5a73b1a7ff1fa0057926b59b17f483

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
Size 2.8MB
Sample260928-l385vsab76
SHA256 06a6ae8a05bafebd8d551dfeafbee1e70d5a73b1a7ff1fa0057926b59b17f483
MD5 ff2c27efa72f34ada539a7c58c608856
SHA1 3f161bfa36db970fc552cc0f8dbd4aa18455f7e7
SHA512 559e9ab6e38a0edde32ec848e33430ac11eb25ce92df1324f6f99d3e3d272cae5bc992427076371a759bd40badefcbe2f7ddf24d0d85dcfa1b47c1aeaf30a1a0
SSDEEP 49152:prxRP9sg+BBVGL+JmA9n/TDbXNKd9arSj8RoTCCzA9n/TDbXNKd:p3MnVGYfb9s9JTUfb9s
TLSH
T111D5CF0267F94179F2F37BB19EB893645A77BD75AD39C50E22C0215E09B4A80DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4776	elevation_service.exe
5800	elevation_service.exe
5656	maintenanceservice.exe
820	OSE.EXE
8	PerceptionSimulationService.exe
4740	perfhost.exe
900	ReFsDedupSvc.exe
4296	SensorDataService.exe
2204	ssh-agent.exe
4972	AgentService.exe
2100	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3dc1329d31e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000009442-458.dat	upx
behavioral2/files/0x00010000000093ac-457.dat	upx
behavioral2/files/0x0001000000009952-459.dat	upx
behavioral2/files/0x0001000000009cfe-462.dat	upx
behavioral2/files/0x0001000000009cd6-461.dat	upx
behavioral2/files/0x000100000001b99a-460.dat	upx
behavioral2/files/0x0001000000006215-466.dat	upx
behavioral2/files/0x0001000000009b92-465.dat	upx
behavioral2/files/0x00020000000198e5-520.dat	upx
behavioral2/files/0x00020000000198e4-518.dat	upx
behavioral2/files/0x0003000000019857-517.dat	upx
behavioral2/files/0x0004000000018a67-516.dat	upx
behavioral2/files/0x0012000000018a66-514.dat	upx
behavioral2/files/0x000300000001898b-513.dat	upx
behavioral2/files/0x0003000000018989-512.dat	upx
behavioral2/files/0x0003000000018987-511.dat	upx
behavioral2/files/0x0003000000018985-510.dat	upx
behavioral2/files/0x0003000000018983-509.dat	upx
behavioral2/files/0x0003000000018981-508.dat	upx
behavioral2/files/0x0003000000018949-507.dat	upx
behavioral2/files/0x00030000000184c5-492.dat	upx
behavioral2/files/0x000100000001ae4c-490.dat	upx
behavioral2/files/0x000100000001af01-489.dat	upx
behavioral2/files/0x0002000000019c92-486.dat	upx
behavioral2/files/0x0002000000019c5c-483.dat	upx
behavioral2/files/0x0002000000019c4d-482.dat	upx
behavioral2/files/0x000200000001b304-481.dat	upx
behavioral2/files/0x000100000000627a-477.dat	upx
behavioral2/files/0x000100000000bd44-476.dat	upx
behavioral2/files/0x0001000000006223-475.dat	upx
behavioral2/files/0x000100000000a319-474.dat	upx
behavioral2/files/0x000100000000a304-473.dat	upx
behavioral2/files/0x000100000000a2c1-472.dat	upx
behavioral2/files/0x00010000000093eb-471.dat	upx
behavioral2/files/0x000100000000a1d4-470.dat	upx
behavioral2/files/0x000100000000a0ce-469.dat	upx
behavioral2/files/0x000100000000ba34-468.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bd1b2d9304fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b6720dc304fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054034cda304fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000832fd512314fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080f9d4d6304fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000108a09d7304fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed27fdd9304fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe
4776	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
Token: SeAssignPrimaryTokenPrivilege	4972	AgentService.exe
Token: 33	2100	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2100	SearchIndexer.exe
Token: SeBackupPrivilege	900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	900	ReFsDedupSvc.exe
Token: SeBackupPrivilege	900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	900	ReFsDedupSvc.exe
Token: SeBackupPrivilege	900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	900	ReFsDedupSvc.exe
Token: SeBackupPrivilege	900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	900	ReFsDedupSvc.exe
Token: SeBackupPrivilege	900	ReFsDedupSvc.exe
Token: SeRestorePrivilege	900	ReFsDedupSvc.exe
Token: SeDebugPrivilege	400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4776	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
400	2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2888	2100	SearchIndexer.exe	103
PID 2100 wrote to memory of 2128	2100	SearchIndexer.exe	104
PID 2100 wrote to memory of 1588	2100	SearchIndexer.exe	105
PID 2100 wrote to memory of 1736	2100	SearchIndexer.exe	106
PID 2100 wrote to memory of 3032	2100	SearchIndexer.exe	110
PID 2100 wrote to memory of 2008	2100	SearchIndexer.exe	111
PID 2100 wrote to memory of 1204	2100	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_ff2c27efa72f34ada539a7c58c608856_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5800

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5656

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:820

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:8

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4296

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2204

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2008
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7d0eb6444bdd848e0a2fc0b19623002537e65ca0fa185fe84672124ca6ade633
MD5 15ddcb3260fd88bb4e7b9e913a428eb9
SHA1 0dc0f5229fc524e4494144d9971a4bc72da31506
SHA512 f67380da3f36d53fb64b1ff8a132f3aece6927c0c66f0ede87a46316b179085b49f671327a56a0bdb0aeaa873af4da35481732b117f463e4926f3f3ea6333fdc
SSDEEP 49152:Ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnwA9n/TDbXNKd:q3q6HjB4fb9s
TLSH
T175D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 a086b7ea7bac9457f4b4c6642e5cfe1cd462f0a5f53a42a1d5767d8ea298e658
MD5 82dd1311b344be9066e7e96f313bf661
SHA1 d1f0411abd25d6943da283d0ce4126c8089ed237
SHA512 6f6a16cb398969de176e684081208d81d5bf33c984bd7c417e8866d624c59db3feae800620b0d69b6b8b4bfacea515f438d3e4badbe4d58fde03f8679239b8ef
SSDEEP 24576:AXYfDtczArUeA9n/TM4NZYeNm+9MhUwd:3tc6A9n/TDbXNKd
TLSH
T1BD85012967E408F9DD67827CC8A28505EA73BC454760E7DF03A499291F333D85E3EB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 22ded2b112cfb9a6e5d0ebaa39ae54f4fc8068676f6e08282e59c617b001c78d
MD5 8de9e42a34f7540c3be9a98595a9d5f0
SHA1 967f404b1cd225f6810de8dd4095e4e6ea1dc37d
SHA512 3b2af39e162497cde242e6eb7c13d2d590582ab252cacbbffdef6b2965cca3bdf8ad3a6f66ef40d602717c1bf8b06b45b05158c00bf45a74904504062cbccbc2
SSDEEP 24576:WXY6DtczArUeA9n/TM4NZYeNm+9MhUwdZbaKngL2jdshRTdG1YxITqvfPkbIcbjK:qtc6A9n/TDbXNKdBarSj8RoTCCW
TLSH
T145C51229A7D409F8DD6B427CC9A29905EA737C498354E78F03E49A291F333D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.7MB
SHA256 2b4f7c16be4adcdeaaeb2a8e16923ddce83ebf29afa15825b4235b31d3daa36b
MD5 aeadf420e3cfc7c7cb2e2f7f3fda87e0
SHA1 084061cc01d52cc160db167570b6d410db9e3381
SHA512 1622c6e231fa9de87827050acbb26653bdfa70b47c41f6aab5aacc8dc09989c2664205b08ba31f1956910738bfc2c8d2a72ba9a296121c612a43120ccf01f9b1
SSDEEP 24576:M0meOvU0RbxbrMeUeA9n/TM4NZYeNm+9MhUwdlaKngL2jdshRTdG1YxITqvfPkbk:M/vU0t19A9n/TDbXNKdlarSj8RoTCCW
TLSH
T1D6D5D016F6B48731D073C1B9C5D2A68EED72348657308ACB4286D77C2E277E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.2MB
SHA256 a51d3b799ddb9bee63a12ee73760dec6a82315f9e74bbd9492672e58e0bef2e7
MD5 67477c1e1a39eb654e3c521ee4827208
SHA1 3142bb361721a9567115522dac4aef703e466b58
SHA512 85fd2683c4ec9f79dae4afb7de841989e8091f680556a1d43526ddeebc4e47e1f90308e8509eeb447c54f4b1de3516886db7ecaeabf524fe1b1ad3c80e6efea6
SSDEEP 49152:8/ezSC6vUzPv/HjypA9n/TDbXNKdJarSj8RoTCCW:4ezSC6v2X/H1fb9sJJTy
TLSH
T10DB5AE25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.0MB
SHA256 92f08a2fee6ee627a00c97fa65c3c4265cb086336fb4eeaec8fdcb1bb7c74ff9
MD5 af790b83427b39b45b1a7e26a829f375
SHA1 7925e068ee876bceda14097e6769d04efc2658be
SHA512 0f9443eb53553937ee3c93810379b348961f8d84309e9c635f3fe02756830f62167e175021b05ec2e4136e70a2f496266c6baa0252d11e945ee740b7f1dfd48c
SSDEEP 49152:8ATQoYXl+uA9n/TDbXNKdyarSj8RoTCCW:XDY1+Xfb9syJTy
TLSH
T1D2A5D066F6B48331D073C0BAC5D2AA8EEE7234455B318ACB0246D76C2E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.2MB
SHA256 83e26fa6692e266d0a9422b1c93b8b123d1c2919e813fde570e169f6e0f2a2ae
MD5 ed708a5690a579c618c6ed05909dcfd3
SHA1 36bfd2a2d1e8c2e6fe1ef0467e6b5b6474319a5d
SHA512 dc7a4c26aaf6a31aeabef77f7ac60702b20295d8b16e180d6bc2a77ab84c6c1cc256f625591353357fec1579d129f2f2cad97281123f26da2a72c61152c654da
SSDEEP 24576:3aCUeA9n/TM4NZYeNm+9MhUwdJ2aKngL2jdshRTdG1YxITqvfPkbIcbjLm:BA9n/TDbXNKdQarSj8RoTCCW
TLSH
T11AB53397CFC84AB0C74B2B742AEABE0C2CD37F4DE44B874C89A07A5D59396D1C939449
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 2.4MB
SHA256 a7dc6a58b06877c8a994de9be72ba73a88d36d78a4d2bca061d58fc42150b00c
MD5 4484dbfd028049cf67beb7e061dd5257
SHA1 e7c11d6bde1e0b005ef8da2d63919b9f678ae47d
SHA512 7ad8334c9646de3aab5fd209b784edd8d708ba603bc11b3be839edbeed6ae44e3d03d3705540051a76a4fefc8f7eeedaa659fed1727ef11f7a7af12836809968
SSDEEP 24576:4JIUnUeA9n/TM4NZYeNm+9MhUwd+aKngL2jdshRTdG1YxITqvfPkbIcbjLm:4JIUbA9n/TDbXNKd+arSj8RoTCCW
TLSH
T160C5017BEE68ECE1C27E5DB85A91C700ABB278704B5293CBC174820EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 5.9MB
SHA256 2649b1fe77457201af2c3ca4cbbe13778ec7be217ec70e1950176e995e8c768e
MD5 289a73db495b90b8df824dba164db636
SHA1 8a5bdf82e5b9ac7e3a429065606b6e5375120dbd
SHA512 2803ab705d9510d0003232f5b1c1949111a981de7638c0e06d285027f70f529eae427488ccf1f681b4fb14eed7f49e4195eadb2b9ab98afe5aade223b48b136b
SSDEEP 98304:XQvGAdlCEL8c/hRNS5CLfb9sbJTlfb9s:AvyEYc/h3S8n9qJB9
TLSH
T1AB56AE656BF880F5E1A7E138897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 3.1MB
SHA256 b4cd68c823f15268976b3571a5d84ffa37c8bc8d713d9641f9e0b52c6c8754e6
MD5 6b9e704fc8e45786d336637a21ed8d15
SHA1 eafcdd3a2161aa212e1a8b95c1a4fbb1e28c9326
SHA512 f95d93574cd14e7b56ca9e30f5dff196cf0e71924c5eb126c30e80ca5491315e6852581bbac8f222b6b1512146492cda1d2843adfb3f819d34de6fc0ed569bdf
SSDEEP 49152:1ljtA9n/TDbXNKddarSj8RoTCCkA9n/TDbXNKd:Kfb9sdJTlfb9s
TLSH
T1E1E51271EFB8C432C37F0EB51B76DB0918697E108B520AC7D3A86E9D59342D25736A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.7MB
SHA256 e699174318c0e5d39600e050372a0bd727750eba14e6fabbc209c12c99c02af6
MD5 5eb81ad25a9151fa47f67e12afbd0287
SHA1 e9b32e4449f53f32771cb7974ddf47fd17c3bd3a
SHA512 f60c1dbb1a11f4193f4c9cecb4d5bf85c28c6153f31854fbc51baba566ade8ecd48ff2c1f3a79a2a00068e5a75881aa054ddaea396f703ff2c297d65497517a6
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyErddPlbuJHE9dJ+:gUEtQevvqc2W1cpV2Erv2Qc
TLSH
T119475B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 3.4MB
SHA256 0adcce3f372550f78344e0273c3bb77052f3ee2131f51ff0201b1ec2990747b7
MD5 25ecd5b2f56a6c3cf57e0e7f8c0ade08
SHA1 996cf38d25d95e9f3c2300f6047b11aab507f978
SHA512 f7b59cfe7aa4b985464c8509fd9bc270d97b5f9cec0d991599d8fcc0d16d0f9113f232e3a8d7397a7822f015ccb56fd3ea52e7f82bf214ce85b2f3acc1cd2a88
SSDEEP 49152:EsbRquA/m2yL5zUfFiV+XenmE3/zNA9n/TDbXNKd0arSj8RoTCCW:/oqlVjnmvfb9s0JTy
TLSH
T199F5AE0976B8C2E4D1F6C77886A2CA47F37178154B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.8MB
SHA256 01674ced6110bd8251ce426d53c264bcf70a4d525f6fcae94475eb922c1c087f
MD5 66fcbc15753b6d186a80d3989fecd43f
SHA1 d4b15c7e66e7ddeb136e7372c118a48168b9d26a
SHA512 93b411837ba7644055b704137690b72d9b5817a663592590a5ed2675b14e70c9eca33119cceb42ee26bbc3aa5ae4c3f67384b210a7b974e1dbaf40f57247c83b
SSDEEP 49152:oAMgFoiq5GA9n/TDbXNKddarSj8RoTCCW:FqRfb9sdJTy
TLSH
T14B95D081EBF945D4F5B3ABB899B69560E973BCAA5E31C20F1150D11F1E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 f3bb36e273ca6e6396871e91f6884e459c269d60d9d65d37be9efda2cc5dbed2
MD5 4b291ad8bb9fb8b79cc9acf26ef1accf
SHA1 8a2fddc70ccc4a16eb628a3864e8d0c3880a2ada
SHA512 723fbd6213a06b3ff74a49c9c68b0a88fce9e59d626deef7c9f96f04918448f048ee8fb37186fcb2696b1e4bed0dc886f674596e986ce762235ec6f46c9e2ccc
SSDEEP 12288:Nmw5HEjsChNzBFgl0WDm+CoBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dT:owuSOWNUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1F985F14637E80CF9DAA742398597D535EBF2BC062A25C71F0760C61B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 2.8MB
SHA256 fdff05fc37f7e12349b74c91cef2b5081546cf2ac6345c7a0dc789170ba754af
MD5 31db2c43484d34383118874c4193fe57
SHA1 ae1cf6d34a3b1388f185a7d1909f1387598586c9
SHA512 3b92f96d6ec1e4a3c8fec5816ddf64207bdf9c112ae66c5cd142ba02d95f99e3df2216c3e980f945d6c9383ddbb3e2fec0dc842b40d62a1fb66323627f4af841
SSDEEP 49152:GA9n/TDbXNKdearSj8RoTCCkA9n/TDbXNKd:ffb9seJTlfb9s
TLSH
T122D523871BE805F4C34B177889E5AB0C9FA37D4EA35A83CF4654762D1F366C28E39609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 7.9MB
SHA256 eaaca2636bb2c53bad990b04df203c2a070c7932e5fc67bba141e3f2ab2844e6
MD5 0e37ce1b4b1e33617f0049522994e10d
SHA1 2eb8c3418a1f279b95869113010ccc2359d2e33c
SHA512 7f9f69a0d89119c001711aca97094e01ebb0bb6ada8f297575acbdda30537424a61bdd99bd0a1f9fe56c9e1a5487cfd84bb8f37a6230d05534cd282b896fd55a
SSDEEP 98304:RQRQyi36YOcPELvw2gAf+PN3Ufb9sRJTlfb9s:IQyiKaGX+PN+9wJB9
TLSH
T192869D03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 7.9MB
SHA256 b12d3e246d4199cbffdf81c7f31b2de6bb1af673b93a031c98a0d83041c393cf
MD5 0e98dfbfcf47307b02623dd337e2783f
SHA1 109b61847d621d8ef9036125d4b175503db60343
SHA512 e3e7451a630f06ba46c223e2c2279158c0fc7b7644ff1e63a3552b9a467ae4a66d0fa588a71b7ab582f86b31183154b173ce28ce6f724758f1e1b248157a5bc7
SSDEEP 98304:5QRQyi36YOcPELvw2gAf+PN3Ufb9sAJTlfb9s:wQyiKaGX+PN+9RJB9
TLSH
T18B869D03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.6MB
SHA256 6008d0f47b90e87fbf7e19792b6ede51685ad46a33928a2d78dec88fe61c4b6c
MD5 c65aa8e4d21e3b6cf8e73efa3c2b5e8f
SHA1 459b6c23eb8c3f838b3e44d319f80bebabff6b38
SHA512 b3f4994cd770e90e6a6c40e82cff90ab7ae1349bfeaa682b3413ae0618fba44330740328b2a6e8f7e36941c4bbf0279184189bd2eab248febe4c8581b0f32c4d
SSDEEP 49152:Q68Qg55nhSeWu7PNU3/9A9n/TDbXNKdQarSj8RoTCCkA9n/TDbXNKd:KthVRc/Ofb9sQJTlfb9s
TLSH
T11006AD33B2F600A9C44DE1769F4A972196D27C75CFE1D3DB8501721A1BB2AD07B3A70A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.3MB
SHA256 d917f2d1d4fd0fb6cc9ffb42616ecd5b7d5004b9b47ace0297a6794f374abf46
MD5 e1f1bab53f67c2de3ce5d9e6d3f1c61a
SHA1 18276edd3cedf58ab5c28940e5adb4dbc271c896
SHA512 677685e7eecc6d5fdc25885f71f4657eb0e1a7a08fc1a41b0a9ec75f1242823d83928ad0e807df1202c7595c0513126b5ed88c22fea1f972e62760009b4fa1e0
SSDEEP 98304:4y5112gYy5azzVvf69nLKnhZpfb9syJTlfb9s:RLIHSWhz9bJB9
TLSH
T13946BD13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b59bcae9a14a33576e7ebfeeb1dc38331cc23eabc0415b718fe950e0d359eb28
MD5 f0cf52f3485cce6e176d3e2fd43ef421
SHA1 63186ad61163bec14d18c5a740a6f47910719403
SHA512 53edbec3ae568e873f2569fcf5b087de747cc4bc50b4bdb17426ca1b6e0f824f4eab4f5518a890a3b9f04774bcadbfcf60dc4f209ecc73b74921e9d840977c5c
SSDEEP 49152:1B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl/A9n/TDbXNKd:7u6JmVxd2d8fb9s
TLSH
T145D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.5MB
SHA256 06961ba850ac50add9fe0110c4a07cb7dbe414a6af7a9b5848a5110808874f81
MD5 79458ddfc4828c56ba23e46d83659952
SHA1 a677704d38a996256cd37bcbdd89ce19fa09dd72
SHA512 f85d1d6448799b332bb747185df6ff77a84456b06ae95fc3e0c3d9243eb20e5cded8e5a7233f554a31357afb82062b21f62dcd0e23e2ceabcd53347f7b6a8309
SSDEEP 49152:31hpsNoJpF1A6tU44CwH7R4x7A9n/TDbXNKdDarSj8RoTCCkA9n/TDbXNKd:3mifPgRvfb9sDJTlfb9s
TLSH
T10CF5E013F2D801E8C05ED17887569632EA62BC4A0B25B6DF0A90B7961F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 3.7MB
SHA256 a21f0b7a3d88cbdd30e0c9a30e304eaa32f68046c7f1e0e82c54d4c502242589
MD5 d8aa7cd824e127a9c445d0700961f45b
SHA1 a5132a5726eedd947891660436cb63a6a0cc351a
SHA512 23264802b49b07ddc7abd1b6ba18b6c11a317fbe7a834402c3080a3260481984d26230d2d1493a734ca2ba6440b605febe65361a24f30657112876bca23e22bc
SSDEEP 49152:LSuZQIY0Be2KWRVtOnks6NMHqgA9n/TDbXNKdYarSj8RoTCCkA9n/TDbXNKd:Z5dKEi61Ffb9sYJTlfb9s
TLSH
T10306E003F2E941E8E0BED67487769626EA72BC464B34A6DF064072591E37FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.3MB
SHA256 2c4e9f88a65e4b066960b9f7dff406d2b5d03def4b27f7b6d22c609f7f6c66ce
MD5 c1913c45391798815fc49e58f8f97036
SHA1 00d1a404e086d5477314291202fa642ac80e4095
SHA512 617413c2f84e3d05c70ec9efc24188f9a28df543a9cfef19c06e79fb1df604d7413971f586737b294f59d86d2aca245d7705eef473e9a8afe6b076b7d5950864
SSDEEP 49152:JhtSn8EApI0figmgiDn0AP5wvA9n/TDbXNKdQarSj8RoTCCkA9n/TDbXNKd:4X2i/phjfb9sQJTlfb9s
TLSH
T149F5F013F2D901E8D05ED178C7568632E962BC064B39A6EF0A90B7561F3BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 2.2MB
SHA256 e5cc619f4bed6e882ad9fa53627cd714fe0475fcc1d29e82487ead52cb29bc48
MD5 e50e963feb517b9298ef9f6a06b913eb
SHA1 1a2c81070601e56055b8ad2c03d09a72d28026c2
SHA512 ac5a5b49e786bcb1730f777df910bcfa855ccf01412ebfa1e6530f567181e4208452fac98612f60626f7b902d2a860e76f196b513f9e709ae1f8f040338dcf44
SSDEEP 24576:h6UeA9n/TM4NZYeNm+9MhUwdVaKngL2jdshRTdG1YxITqvfPkbIcbjLm:yA9n/TDbXNKdVarSj8RoTCCW
TLSH
T1D9B533978FC84FB0C74A2BB42AE6BE0C2CD37F4EE54B434C8A94751D5A397D15A2948C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 2.2MB
SHA256 d6170797a965cd63c8f59af896509e52200e6d08d4fd139b79d87de0c0098e75
MD5 e2ec587bc969ee18bb0953e41c2dd1e3
SHA1 14c32893a983eb1ceb327b497c47506a9fb92516
SHA512 9c167c82a3df800a477860e3d7a208e9ed2abb43312e939019088c749053fe39123d1ad0c5d81041d7491b8ffa87724c1d6962d71c39c5f220f8940d3617a257
SSDEEP 24576:C1UeA9n/TM4NZYeNm+9MhUwdyaKngL2jdshRTdG1YxITqvfPkbIcbjLm:WA9n/TDbXNKdyarSj8RoTCCW
TLSH
T174B53397CFD84FB0C74A2BB42AE6BE0C2CD37F4EE54B434C8A94751D5A397D24A29448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 2.2MB
SHA256 f308adbc8059933de9e3d6d7310a493a5b93d21d72a984e738aea12ba214ebea
MD5 dee79abd88cfcaa43da6a2d693e28b8f
SHA1 2e7e6ac6903b27235f134cc0e02a399abe6a4172
SHA512 73cfb57d43514d41f598f493143b5b7bb282d14cd55059368b6710f0dab729d232096d7c26a4468b90d314d76b3afd573c644fb7e4c5ac1cd0bbb75f69de35dc
SSDEEP 24576:L/UeA9n/TM4NZYeNm+9MhUwdSaKngL2jdshRTdG1YxITqvfPkbIcbjLm:3A9n/TDbXNKdSarSj8RoTCCW
TLSH
T171B53397CFC84FB0C74A2BB42AE6BE0C2CD37F4EE54B834C8A94751D5A397D14629488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 2.2MB
SHA256 ce2a970c0b664ec196e14afb19820e84ab969ce4be21b11f09e415affc8978f9
MD5 fa55e220a4470066729c4616799f5714
SHA1 1a2a7847b08b151f7dc12fdc263529fa65bc2ef5
SHA512 b043398cea9fe79cae895e1f298e1cc9854c855ad393d5662d3e261704d24c9b541f3654fceaa17a33f9caaa997f5844512db4a7e48b6676b6711f950b919617
SSDEEP 24576:OUeA9n/TM4NZYeNm+9MhUwdHaKngL2jdshRTdG1YxITqvfPkbIcbjLm:4A9n/TDbXNKdHarSj8RoTCCW
TLSH
T1D6B533978FDC0AF0C64B6B7459B6BA0C6CF37F8DE50B834E8A90291D1E353D19938948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 2.2MB
SHA256 c6d1b4d435ff0f82d91fb8fd806588838409098a782175ddf692d37b045872f9
MD5 6d4dea671b600e47f17c99bcca22c5fb
SHA1 b02e786143ce425d782202af040d54df884a0e44
SHA512 d4236830cd24d92aa4ca382163ac2f650485731f77032dc3453e0f0f76c24d660547047e986e787ec1bc4acd75c2c80910107bf68b3b6d23f053161f2b5faf47
SSDEEP 24576:R8UeA9n/TM4NZYeNm+9MhUwdGaKngL2jdshRTdG1YxITqvfPkbIcbjLm:QA9n/TDbXNKdGarSj8RoTCCW
TLSH
T1D3B53397CFC84BB0C74A2BB42AA6BE0C2CD37F8EE54B434C8A94751D5A397D5463948C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 2.2MB
SHA256 d76ea6eb7a73e3af5ec18dea81cd0f96f07343a62868545e46b95b1391c99b84
MD5 6c84c6596d5325751baa13114bc03471
SHA1 19f2306cd0d4ba1dc8c93c4f4919a0e560761294
SHA512 09f1ee04e69e8c934ed49fe134f3d7c42ca8252271d8f5875d0eda2ade0f22036ddcc2e6821e1d7a90e77be84e973ac196fb962b9d19fe63b3399a99c6505c3d
SSDEEP 24576:N5UeA9n/TM4NZYeNm+9MhUwdNaKngL2jdshRTdG1YxITqvfPkbIcbjLm:LA9n/TDbXNKdNarSj8RoTCCW
TLSH
T179B53397CFC84FB0C74A2BB42AE6BA0C2CD37F8EE54B834C8A94751D5A397D1562944C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 2.2MB
SHA256 8f234548acd939f1d37fe5d9c7012c227d6eeb3d10244f96766020bd0278de32
MD5 a9db4b973413416eef24f6aaacbbb322
SHA1 767bccd0cfd0c403cdbd6f08c5a14b6f20123c00
SHA512 b3be4a6d46b564bc893d7b9434995d3a62d98785bb5ba50cf2d6fe52ea33a4d907e431c83241d0d0073efe978d072bb0d2729ac7abc0dd30f8a91c65acf50b2d
SSDEEP 24576:udUeA9n/TM4NZYeNm+9MhUwd1aKngL2jdshRTdG1YxITqvfPkbIcbjLm:yA9n/TDbXNKd1arSj8RoTCCW
TLSH
T1A9B5339BCFC84FB0C74A2BB42AE6BA0C2CD37F8EE54B834C8A94751D5A397D1552944C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 3.0MB
SHA256 54d0d1fb15728bdabd3841840441e4758f92362abf81267fb602005b1d4e0a16
MD5 0cb359fe444a7dabe74de1929d5b3bf8
SHA1 95de3b7834b02abcee4e33311c29823d4cdb57b5
SHA512 f69c317386e535f9409142e9e65093009ad37b55200663f7b018c39b1149aae7957588c2e03dc4b98764fbe0c1ddf85aacd8e4fbd3ede2cbc8b3f740cdacb31a
SSDEEP 49152:JZM1z3lA9n/TDbXNKdQarSj8RoTCCkA9n/TDbXNKd:uz3mfb9sQJTlfb9s
TLSH
T13BE52296B7A40CF4CE57463E8965AE08D9F27C4E5660C70F03A4362A5F373E14D2EB89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 2.2MB
SHA256 d01cc0412014c8f249b6d72364942c25f442b50c77522e75d2856ca33ca1e88b
MD5 409e56ae79b8dcd50b19593017b887ea
SHA1 9b4fce86d050d00a34b3c7cad81500d9244e6f94
SHA512 77f46b60d8557c027f8bfed6093baf47600927bfcd429aab9ff919a756cadcfb9485e8d918661221b61faea01ef65e888cd49f8ab00d6c9863d1fbde145343fb
SSDEEP 24576:gmUeA9n/TM4NZYeNm+9MhUwdIaKngL2jdshRTdG1YxITqvfPkbIcbjLm:/A9n/TDbXNKdIarSj8RoTCCW
TLSH
T104B5339BCFC84FB0C74A2BB42AA6BE0C2CD37F8EE54B834C8994751D5A397D5492944C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 2.2MB
SHA256 150136f090e1fdaa7c968e0eb6592aaf3afaed59b43372094763c8a58bc4f1f0
MD5 86bce505b132ba45948f277d14a224ce
SHA1 1d4bffd5da31670a6f93b6dbb86a3ddfbda95efd
SHA512 8c1bb50aafc5af02f668a2d2b077b8f4419af9bb911748d60491d175e5dd91286ba3ad0248b98f88f0a85f52246576541c71e817ae3026d4665273d2b8fda842
SSDEEP 24576:0yUeA9n/TM4NZYeNm+9MhUwd4aKngL2jdshRTdG1YxITqvfPkbIcbjLm:LA9n/TDbXNKd4arSj8RoTCCW
TLSH
T1B6B5339BCFD84FF0C74A2BB42AA6BA0C2CD37F4EE54B834C8A94751D5A397D1462944C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 2.9MB
SHA256 f0887f4f8f2e50d3a598ec7d7a04212fbefbe2309da7cbac2e49bf7f2fde29a6
MD5 7f29f4c65e1c8298798b33180e97b2e8
SHA1 b376c8bf30b507ceab02ae14bfc4b79ee0f7aeba
SHA512 98010ccf20670b7776c667dd0596603b0d4ccf687f7482b0c66091c9cf51871d7836d03ee0eb90d026dfcc08dd2847cfe6dd555f395542cd7436bc06ac529cd4
SSDEEP 49152:wMA9n/TDbXNKd8arSj8RoTCCkA9n/TDbXNKd:w5fb9s8JTlfb9s
TLSH
T13FD523476BE805F4C21B177888A26E08FBB27D2E9705875E4794273A1F363D18E3EB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 2.2MB
SHA256 fe768c36a36b0b29cd00490cbda74835a45cdda1e9acbab937a0f665e9d57e45
MD5 7d4a03e9e6ff0a1b3d016853aef1abad
SHA1 45e5210017121657d561d8fabe9bc9828330c1bf
SHA512 fbe7ea9fa536a282c1fcc545d573467fef9330a42e28fc611d999784bb9926d332ff286ffc8ff250cac3aa56402accc8317b643fd3ddfb97afd911515bbc3377
SSDEEP 24576:ymUeA9n/TM4NZYeNm+9MhUwdhaKngL2jdshRTdG1YxITqvfPkbIcbjLm:5A9n/TDbXNKdharSj8RoTCCW
TLSH
T1ADB5339BCFC84FB0C74A2BB42AE6BE0C6CD37F8EE54B434C8994751D5A397D14629488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 1d7bc23cdedf2a1ea7d02cc234aa1e79e0efe78ea4d8a3b0ae17cff04d9c9c7f
MD5 54affbfb421efef1361082914096a2a4
SHA1 5a8eb0164e0c2c1c754de272972cc374c457a181
SHA512 6c8824581277a04138b3c2f65bc00d432c2819a5735c99b21370bc7ad4615ecdd67b9f652d5086817575bab9993b81291791a375c7672a9d72b5a726b3710f83
SSDEEP 24576:ZBwvik9RX6wkyAIiUeA9n/TM4NZYeNm+9MhUwdX8UaKngL2jdshRTdG1YxITqvfv:nMnYIcA9n/TDbXNKdX8UarSj8RoTCCW
TLSH
T181D5F12AEBD808E5E177923C99B7460AF6B2785D5B31C2CF029A536D0E37ED05E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 b55c7ac3cb6027ca04ffb87f39072a70af448e84fab7dbd9095715a95d55b234
MD5 32a237f237997607f396c757ede0ce5e
SHA1 1374fa7aa5357c032b0f4e8e3df10828fbba7e1b
SHA512 9a3a1261a53ce6abe433864bcced9c9053192c653070196456395a8be3d1b7c9f2e88e0fa9b0d0ab08463c0f6ca5b090f57467e334c6c44bcc52f4da2d4547d7
SSDEEP 49152:zY7PNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PA9n/TDbXNKdj:kySzP0fb9sRqJTy
TLSH
T1A5269E97A1A801D5C1B9C1B98B1BCC1BFAB1340903359BEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 f1d17f8272dd3a42fd58713c32a5a7e6523a7334d5a36a2b5b56c754a7f6239c
MD5 4950828c81a81d7aa94dcf2f8a87ec34
SHA1 be1f903e97830e444165d52273b6dc561344711b
SHA512 19fd7987fec54e833dcb9cd8512f15888131b17125a0d319bc2044c5b6ac5e1e9cecac5b491189d2f92cd99dc8be537844be22bb5a4f68e5ef3b81af06861f12
SSDEEP 49152:uN7JUQj7irIhCnDHUPfF//A9n/TDbXNKdEarSj8RoTCCW:AJ5glD0Pifb9sEJTy
TLSH
T1A0B5D01EA3EC01E5D1BA927885558A1AEA71782E5F32CACF1270437D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.3MB
SHA256 1dc0c4c5a9c2d8a941456ce966c6c0192eaa09edf07fc0cfbbf667123734e98a
MD5 abfe334410c0a7b2b4565fc0415ba80c
SHA1 5cdcee1435e75514db336cb0bff42bb28f28031c
SHA512 63c557248f629e65061edcc4131cfc1ec7588c399a13695a9dbe20c3211056811750dfd4cb206d97456fa966d7e036c01d99de987ad6d8de1005463fde6e4df7
SSDEEP 24576:r2UeA9n/TM4NZYeNm+9MhUwdVaKngL2jdshRTdG1YxITqvfPkbIcbjLm:UA9n/TDbXNKdVarSj8RoTCCW
TLSH
T17FB5224AC78802E8C15E2675CB969A08BB733D5D92D6C3CE46D0F53E1F3A6D09DE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a6c422a3762ac6fa52764b7f57fdc07b32be200f42b14d79721381e979201b3a
MD5 12bd2e477a4f8c7c18574fe1898207d4
SHA1 94a101c0c8e67abd5983cc9fdb195b8508c4e938
SHA512 d37c46f237f4c6c1b961dbc6963d436dc147b047875166b2d8040c207c5996b173729a4176091ee25c1641b22d73ccd4ad5b564c41934d1e4113d0308ef7389f
SSDEEP 12288:BjdTaT1fKU3f0ZAyQo4AKWPjs0FrvhSZ4fJIVENX+3ZNKYtrO3raTTx5:BjsSUP0ZiXAKWrsAomstGYtCGHL
TLSH
T1C93517007666CB4FC66980321E72D2CCAB707D45EE44AF0373C98B3F9576659BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 5bc5c1efdb3225c7c8701607abfd8ea8b778ce3821a8f913ac9014620070a6c1
MD5 df7a7787f70919124e258d463cf128b7
SHA1 87c2546a0ed1496348eaaaa541a2a8e8cffccfce
SHA512 a1fc852a94d29d1ca12d1452589e479802e9bd69227fce3f063b36bd0d4a77822c9d59275b7c83f26845305b1e3adf53066e38b6c60c2a78ae37222ebb02f1cd
SSDEEP 12288:jKoqTuTzWP2dFG1f2WNL9dCwIpcJjgdsA56NA:jKok+K2W59dCwzbNA
TLSH
T1867509405137D78FC1B7603243265B8C6BB4AC0BB7496F22B7C9497AD86AB15B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 9b1ec965ea89b5c2ea3602983388d3a877d8191db687928f2d96ed1ebf00c5d8
MD5 45f1f13c2be05e67855673eae9306fb0
SHA1 2f6584c63beaf2df8324cbf629ebd543488494f8
SHA512 9f3d1851fb7ea0f977a0ec1ccbff20bc79f443820187978032a7ef50eba71bf70aa52482e77518c9b8b3134daed0bf5da2daefeef4604fb237ad9a8c3d97d495
SSDEEP 12288:IO7+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dyd:z+UeA9n/TM4NZYeNm+9MhUwdU
TLSH
T1E46523824BFC0DF5C75E16B440AAB7089E56FE5DEB4083DF8209722A6A345C6CE3654F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 24feaf52fdd816ca214119205ffb2dae91caa7b8f25f386bceca578a649e6a19
MD5 11eb32a99a74c728c4934e2f6da1ec45
SHA1 e75b7cc064d8c044b3bfbcfdcadf1f4a772dbcb5
SHA512 957a11e5cc97fb5df5db01546f5fb854a9a35323a6d1c5d819406dae6ca87ee0631d0a500af11fccf06939483b15e59df3b6d7d1c742b74b1427669d11aa4c22
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYIUeA9n/TM4NZYeNm+9MhUwd:7gb4mBIBhGFBA9n/TDbXNKd
TLSH
T18B65AE1E22EC02F5E1F9D2B88DAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 ef9de63ba46e881dee223f65bd63c02c3ac48ceb3fd179d064c8eae1c8575eab
MD5 292220552e63a2556850f5d8b0f98b7d
SHA1 7e6a29b6e3b479e13b76f5add80a0142b4e34fdf
SHA512 be144a0927bc8f7cc01d13aac300e2d526098719fcca3f6c356d825fce3811216d93087da2dafe81cb7fa58fe362fc53abb2e6d6d6c7734047d7d971bb608e04
SSDEEP 24576:qGFaKngL2jdshRTdG1YxITqvfPkbIcbjLm:qGFarSj8RoTCCW
TLSH
T11B05237EE7C56694C43B977829B6A84A3CF33758970A46DF88E0957C5F697E0223CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 e83c4ff12a963fd4bf67bbc22e75ea76773e1746a3ab6dddb598ebb425d893af
MD5 22e1bebdd54a3e8ffa86af0e097efc51
SHA1 b5e37c2ae006dde99dcbd2b5c7b36ce62dae2373
SHA512 50a727e73452fe2d46a678f33eeca1bbac09e509594e2241d0860512459e0370cf4d000668f8270db8752733dbf0abd9b770bfb95fd1895f3d458c1b680805a5
SSDEEP 24576:fG88u8FpJqH1hzria7/mVUeA9n/TM4NZYeNm+9MhUwd:u7ZFPqVoa7/yA9n/TDbXNKd
TLSH
T14B95016567E401F0C47BD13889824667F6B2B8251364EBDF07AC8B561F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 48feece01090c9f251c41bb7adc8fa8b3cb48a4124323bf94c78678573b5c6ff
MD5 bc15df614d8ad1643d88e99286b14b72
SHA1 d13bc802b1932a9b17994e3b409b326b779cfc1a
SHA512 d7ec5a1ab686a9657891d6532f9ebd81a73414020109304b42c70a8819daf5b03db3320e8c33adf780961306a62ced9569aa369be23581334bc35a8c64227207
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFA9n/TDbXNKd:yG05lO43bBfb9s
TLSH
T112D5C06A62EC01F9D1BBD17CD9C64A0BEBB23815033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 066d492d44d293f0a05994785949ebe083c36e4fbfc88dbc441830d0c471ad22
MD5 02da37f26cba4fa77738a193421a3ad6
SHA1 0d9946741aeb9e8806decd8ce1f4c87881b021e1
SHA512 f1f73aad18de69e1e0707bdd6ceec89e8d4a5856da97711ba659befed319d7ab2c8dd6baeb09726c667f75a86311a782114a0dadbf82b83b6a6caff6e816f07e
SSDEEP 24576:/fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnLUeA9n/TM4NZYeNm+9MhUwd:Ha5POZ3+Jt2pasx2+m9A9n/TDbXNKd
TLSH
T14265AF5EA7FC01D5D5B9D17DC583460AE5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5252e04ea0850cee8217334514aee7e05250123bb52ce9a0f099d2ee2ec0cf46
MD5 af9ab48e49c8065582600c2ba85b3d11
SHA1 f65d25a3275a25adeed26bb3e8c144a03862862a
SHA512 9e51a438f01184574c814003534c5bcf6e1e0244f6a4e617dc195226d214ef7bf6c8d4cc34e2561f564f09d498cd83e9d39a5e93097b8504ed4b8cc92b296756
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FktUeA9n/TM4NZYeNm+9MhUwd:gNc/zEOVHFSA9n/TDbXNKd
TLSH
T170858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 b39ba9f528eb17350b3044e32d94d9875dcb2ffe97006e01b04bc0c41279cfe1
MD5 d24b12d9f2efbd483d55eacf0633c3e1
SHA1 24a4539d8a7f608059206a48ee4f2e9381d831b9
SHA512 0b0b364cf50eb0632d4921a55c6e8dec057a5ddaae44ca247854370f30e1a557fb01dd9769d35b693ca20e6d15e00cf0ad9cc1e76c2bf5d5bee833622b291d82
SSDEEP 24576:G6DIzaKngL2jdshRTdG1YxITqvfPkbIcbjLm:G6DIzarSj8RoTCCW
TLSH
T15B25126D63AA01F4D06BE13D96934506E5B2B67487034ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 25a6e84a90ccf39c7b05a8ceb211685dcc5385281673859e1dea878e04fbb90d
MD5 bc091ae6ce99058e4b312c652fefb6bc
SHA1 5dd5db7aace36ad11b0e9d5db9f8b12d7c034f86
SHA512 07c8856da6addd02697f252125a7ad40cf6786390784e319bfd0977f92babc31517705687e4de6e97dc9734f755bccfa9092e1524b116d3596bb29c63f3851cb
SSDEEP 24576:4tybaKngL2jdshRTdG1YxITqvfPkbIcbjLm:4tMarSj8RoTCCW
TLSH
T1F915231A97C456D4E97A27786EB385882D727E249B0783CF89E0E63D2F777D06934B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 b277179d3400242ff5de4337218ebf5f558619226ea08b17e0df5c5ff4d0a276
MD5 99baab517bdca364afb90cf98a84d526
SHA1 153140a2bebc6aaaf1092e12900e418248e5ec68
SHA512 9d4fb2d573c1a3b0485f664909de7ff4bb644e0633e5a2cdfec1ce174013bad32c6fe184a8342092bee6945f31434ffcf2d92bbee3efa87f0a7b7f28c08a2337
SSDEEP 24576:g+aKngL2jdshRTdG1YxITqvfPkbIcbjLm:g+arSj8RoTCCW
TLSH
T1100523BEDBC45BA0D51A7B743AA6A94D38B3376C970B46CF8CE0597C4E7A7D01638900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 0378d89a8f9acefd1084b2d7012b67508c07d89fd3fc412195117e0984ba6787
MD5 0afc549eb54f81d2f67b01afa53ae031
SHA1 9070fe0e3204edd1488c8d651da0a4f9e25508a5
SHA512 2e5b565734523653561ea469f2967cd61af3230cb8c18b5e817e43f404c56ff3e2a2d0d2dfbbad89e2ee8f7acd30159c0f875abbc9a584638ae0d70d351f8d86
SSDEEP 24576:WeghLoTfaidZfaKngL2jdshRTdG1YxITqvfPkbIcbjLm:RgmTrZfarSj8RoTCCW
TLSH
T16D65AE1DA7EA06CAE2B2D675D8725483D633B4315772C6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 b7ea4836e16b8d4ae9a3e90c1ddb077ac0e3c8b05d1da823a71f8ff9e38d6589
MD5 992c8d2f96d9125387dbda93bd3a5c9d
SHA1 b0377b1ad55293640594c91c6ecf0b62b25c8a4b
SHA512 751cdedd5b5c71159aaedf3c1342b39b8503fb13bcc2bbadaa45ab2b862dbaa253ac1134c6d74e8e0424cac8c011ad6df222a34f54e387585d4a2d4d3e650d30
SSDEEP 49152:xgb4mBIBhGFBA9n/TDbXNKdu9arSj8RoTCCW:xtjfb9su9JTy
TLSH
T1EFA5D01E22EC02F5E1FAE3B89DA64407D6B278165732D2DF0151422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 358cc1b30219c27a70d42412d4905c18924470bc5d1b64e4f758268505000905
MD5 37ed04b0e3a3d35032daa746d5db9a62
SHA1 55e4a44443b807c82a940cb373acf6ec8d8e92a0
SHA512 c111c9ef71a4b47b372143a1396a67e1afc8ce8e8d535bba327c156093403d203488a4cac3b2dc73b7104e80f73f8f67903c311ab0e69b7c55281d83a85029f2
SSDEEP 24576:fDkNvNnaFeYhJNtmZBmXUeA9n/TM4NZYeNm+9MhUwdPaKngL2jdshRTdG1YxITqv:fDMwBtOmLA9n/TDbXNKdParSj8RoTCCW
TLSH
T100A5D16EABF846E4D1FEC6B49D238516EA727851173293CF4290C13E0E279D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 d054364052aa9829e9b7f7027a81aedaca29acfaeb599f695308b4f042e8794c
MD5 3c2b5e2603fc674a71e746023db1bcf8
SHA1 fd8eccb14129e3af455388d6a3742a39f0bad3d5
SHA512 29c1d59270130ecef096a99f980cccd7f7043970db107b6e1c00e1a928c3608b58d867cefef583fb4bc5f9cd919f1db818aa001c6b1b7dbd10ec6def2522f739
SSDEEP 12288:NHvUrBFrEjwaQpBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:NPUr+NQpUeA9n/TM4NZYeNm+9MhUwd
TLSH
T18E85E11F26EC0CE5E67AA17D8586870DE772B8561312D2CF0290817E4F37ED8AD3AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 ec91d04c9c3ab6149acf35d02afb9ab2c90fd3d3ec904f281dff0eee47f02069
MD5 6291e43ff2839370b76cb29b19c19b39
SHA1 4d435bbff2d75a3e56190b3b9e40f32a97698a8a
SHA512 e354a052cbe0b1bc4d8d9cdd2c8926dec4252121aa402ca1671fb6367423545fda92d9fc4a06983551272a095a68067c75b5da63b4f81c753bc0bebd0db6a9b0
SSDEEP 49152:/DVHeBIAAUA9n/TDbXNKd0arSj8RoTCCW:vfb9s0JTy
TLSH
T116C5027EDB9C04E4D57BD2BC96639A06E67238AD032256CF01D491B91F2BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 503481740d55094a0cd5b6579ec1d749955ef7acd4a1186e66c30934d1f97364
MD5 804b5395e0dbe7d6debb7aeb87ec2d18
SHA1 cc341b39bd47499a56782ce8b062bef0b7a85cad
SHA512 74cc5e0289de93c196084e24f1fe8c42286db63414d90baf9e28cbc68847d7ab7ca1704f4734e3b7b3f0db7a9af28935a37adb8cf3c86c89b25f7398cc1004c5
SSDEEP 24576:TJnJPbzB4SwaKngL2jdshRTdG1YxITqvfPkbIcbjLm:TJnJv6SwarSj8RoTCCW
TLSH
T1C235F13DD29810E8E4B7C2B4815A1B5ABE71387C2F1669CB59B4D5343F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 f0e7b668242c3e7f97d32b469e1ff25bd5a9f127102efea4f4a97d873855fcd1
MD5 4d3f24a755429bd9171b5c2170d08020
SHA1 fe088fc60e25cb08d6038de739d09256c6e742bb
SHA512 5b02f256e4b86fb227f3d22d3e22cfeb1b59c2a58316f8d1b2b548a12fa145cd91c9e647713d351adfdfb2baaef06428ed544c49c0e1d6d4d8a9407048b74e0c
SSDEEP 24576:n4aKngL2jdshRTdG1YxITqvfPkbIcbjLm:n4arSj8RoTCCW
TLSH
T1950523AFDBC48B94E5663B743AA6A84D3CA33B5C974B47CFC8E0159C19AA7D1263C440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 7f5ee8a31e38c9f2aca74eac72420c57853180c90cb8f4113835c6b686fd43ff
MD5 6289f60867cbecc1094a6763cb164a8e
SHA1 c645bce37417e700a3ca315fbe4256d70c786485
SHA512 f5bb00c5d3c3a7cfe57bf20da233b38461172a443a61ea880efea4f09f9664f96c50040b6d021434e30f5bee1e65eeca2b2cf5ec3ab158cd641ad2ce3b3b487d
SSDEEP 24576:u6UqjpMaKngL2jdshRTdG1YxITqvfPkbIcbjLm:u6UBarSj8RoTCCW
TLSH
T15015236E97C419F4E03A1334AAB6C10918B27E7A035B86DF65E4967E4F36BC0953EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 f351283c2bda9082a7bc547b90348f1a0b00ff6ee185961ba845854fa5cdcd2c
MD5 0dbe94057e4002507505ef39fda78d86
SHA1 faddbdf2b0073c7b0d1e2c3eed791a0a24736c3a
SHA512 95c7787b2732213842ac37d8ecd10057705f8c53f09de255efb22bb374818c1f6481eeaeef443a86219edde6bba014cfb104c9855b258f383d0a91202d3de27e
SSDEEP 24576:TCLHGL0MoeVtFumTijCmlKQWDkytkaKngL2jdshRTdG1YxITqvfPkbIcbjLm:TCLHGeeV5ijCmlDWDkXarSj8RoTCCW
TLSH
T102A57C05E7EB4284E8F3CAF5CA2694169A327C549B34F7DF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 c16006f295958c7a30527a95703243579631e4fea16199c5a9a3754da55ccc89
MD5 6d5cab3328dac044949786d39c8a7e04
SHA1 c5090d027105c04bb2a0bf93708be581acc06bda
SHA512 ca5189470c11821aff27aae2bdd66f8da1ff6496ba740bcdc7c27f31228e3c9df206d38d117978413a913daf13f8df9c747e9681dbdd8adb866e38d25f03a986
SSDEEP 24576:orcmRMaKngL2jdshRTdG1YxITqvfPkbIcbjLm:KcmRMarSj8RoTCCW
TLSH
T1F625015EB7AE00E5E1BB923C89828549FAB37534530257CF46E0877D4E67AE97D38B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 5039af0eddf5804984127a57404ef92436e89a07aafa3937377b0a26f10613f8
MD5 23302f6e21bb70af00ec2dce8f327f55
SHA1 a4dc809e65758fe1c73dfdcba2b777e3bf2ae7d9
SHA512 a524bcb43cb95ebe6eff9ccfbcab14d544b582b9e2e229a4bcdc16da02fa2ab2dd03c1523fc6902c85c7f9398954c42fa5879811fe1c536489fdda36c13efc1e
SSDEEP 49152:ADL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3L0arSj8RoTCCW:N3Upow8sBZJTy
TLSH
T170B59C3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-74-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/8-230-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/8-76-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/8-82-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/400-464-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/400-15-0x0000000002DE0000-0x0000000002F7A000-memory.dmp

Download

memory/400-73-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/400-6-0x0000000002760000-0x00000000027C7000-memory.dmp

Download

memory/400-9-0x0000000003100000-0x0000000003185000-memory.dmp

Download

memory/400-7-0x0000000002760000-0x00000000027C7000-memory.dmp

Download

memory/400-1-0x0000000002760000-0x00000000027C7000-memory.dmp

Download

memory/400-0-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/400-171-0x0000000004490000-0x00000000044F7000-memory.dmp

Download

memory/400-17-0x0000000003100000-0x0000000003185000-memory.dmp

Download

memory/400-176-0x0000000004490000-0x00000000044F7000-memory.dmp

Download

memory/820-204-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/820-62-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/820-63-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/820-69-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/900-90-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/900-96-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/900-354-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/900-281-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/900-356-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/900-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2100-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2100-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2100-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2100-345-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2204-120-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2204-119-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2204-126-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2204-316-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4296-102-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4296-330-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4296-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4296-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4296-108-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4296-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4740-86-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4740-254-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4776-31-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4776-118-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4776-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4776-23-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4972-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4972-138-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4972-132-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4972-140-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4972-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5656-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5656-53-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5656-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5656-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5656-60-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5800-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5800-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5800-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5800-42-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5800-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download