355e1022343a593ca596ac9a356b3c3bf231beb2d091012d7db5f59ab59d8240

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 2.3MB
Sample260929-2fnteazxaz
SHA256 355e1022343a593ca596ac9a356b3c3bf231beb2d091012d7db5f59ab59d8240
MD5 714ddb833a7908c6c2d22e55d35f7966
SHA1 212a5757fe6f651875d70e3b4212f8b04e83daa8
SHA512 14bfabe433e1a939597bb9bdb86b6346b686f413db5da58c238b1837688b7fafb660c32b181abedf1da8d47b45b32429563c38423fbf8dcaa6b0ad96a2dc0e45
SSDEEP 49152:7rxRP9sg+EqVks+JjA9n/TDbXNKdkIpNbohqUwLi:73MhVk6fb9s7NUcUwLi
TLSH
T196B5AE0267F94179F2F37BB1AEB893645A77BC71AD39C50E22C1215E09B4A40DA72733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4640	elevation_service.exe
2136	maintenanceservice.exe
4716	OSE.EXE
4184	PerceptionSimulationService.exe
3240	perfhost.exe
3704	ReFsDedupSvc.exe
3016	SensorDataService.exe
2796	ssh-agent.exe
2256	AgentService.exe
2012	SearchIndexer.exe
2440	elevation_service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 52 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
	\??\F:\	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	OSE.EXE
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9d2820943a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2896-0-0x0000000000400000-0x0000000000BB6000-memory.dmp	upx
behavioral2/memory/2896-62-0x0000000000400000-0x0000000000BB6000-memory.dmp	upx
behavioral2/files/0x000100000000934f-454.dat	upx
behavioral2/files/0x00010000000093de-455.dat	upx
behavioral2/files/0x0001000000009952-456.dat	upx
behavioral2/files/0x0001000000009cfe-460.dat	upx
behavioral2/files/0x000100000000a0ce-466.dat	upx
behavioral2/files/0x000100000000627a-474.dat	upx
behavioral2/memory/2896-475-0x0000000000400000-0x0000000000BB6000-memory.dmp	upx
behavioral2/files/0x000300000001897c-477.dat	upx
behavioral2/files/0x000300000001897a-476.dat	upx
behavioral2/files/0x000100000000bd44-473.dat	upx
behavioral2/files/0x0001000000006223-472.dat	upx
behavioral2/files/0x000100000001b93c-458.dat	upx
behavioral2/files/0x000100000000a319-471.dat	upx
behavioral2/files/0x000100000000a304-470.dat	upx
behavioral2/files/0x000100000000a2c1-469.dat	upx
behavioral2/files/0x0001000000009396-468.dat	upx
behavioral2/files/0x000100000000a1d4-467.dat	upx
behavioral2/files/0x000100000000ba34-465.dat	upx
behavioral2/files/0x0001000000006215-463.dat	upx
behavioral2/files/0x0001000000009b92-462.dat	upx
behavioral2/files/0x0001000000009cd6-459.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	OSE.EXE

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc8984616250dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085c9f3616250dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fd6e3996250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce56bd996250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086bafc5d6250dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091fab5606250dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ddf9a9616250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	2256	AgentService.exe
Token: 33	2012	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2012	SearchIndexer.exe
Token: SeBackupPrivilege	3704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3704	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4640	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2896	2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4624	2012	SearchIndexer.exe	101
PID 2012 wrote to memory of 1616	2012	SearchIndexer.exe	102
PID 2012 wrote to memory of 2596	2012	SearchIndexer.exe	103
PID 2012 wrote to memory of 1440	2012	SearchIndexer.exe	104
PID 2012 wrote to memory of 2764	2012	SearchIndexer.exe	108
PID 2012 wrote to memory of 3052	2012	SearchIndexer.exe	109
PID 2012 wrote to memory of 5000	2012	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_714ddb833a7908c6c2d22e55d35f7966_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2136

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4716

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4184

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3240

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3016

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4624
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2760 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3052
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2760 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1d48ab7e628eff850027303ea9051193cbf14c3465d921430f3b5d7b84aa432b
MD5 89b356af03684a39a0c2a6c72fbb8d1a
SHA1 b76dcb028f52a9fa2f7ac9e551bc54537cb32e2e
SHA512 9ec03ea7381731a68bf1ec1e7067a9bca57b6047e8e4c48a3ecf18c195227f0b51e229b7e343962f7bc053f4ed0a6858f5c1ee011b2d25b8fba5433c9348d1f2
SSDEEP 49152:Xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxntA9n/TDbXNKd:F3q6HjBPfb9s
TLSH
T19DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 06751eff39763a5a0c8af002e27662bac68a7ec6125635e26b76eb68150ccbcc
MD5 a8c9c28b0db185c38f06d7333bc792cc
SHA1 95531447a5d08b8532fb41675e3d2baf8d2c0e6c
SHA512 6c493ed6a3a2511f68db8bfab1c8a151be97ca560173f4cd234a39fcefaa4a6199c5a463184f67273ea77e992b577ae0ccc00f738c449acb605d955e796ad9ab
SSDEEP 49152:Twc7A9n/TDbXNKdvIpNbohqUwLiOA9n/TDbXNKd:TUfb9s4NUcUwLi3fb9s
TLSH
T1D9E5231427F408F9CE5741BDC8A1D604EA727C899760E75F03E8A6251F333995E3EB8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 01976a77a655048f206160dc6e794ceb62a291c831e6b6d13528e6320aaf2045
MD5 0b9727d745ac2aea5bc28f3b70304ede
SHA1 cc0d82ef96db84807b2bb470b5a685586f58d7f7
SHA512 f626b6eb2ad1af971456a35ecb1366bc4af48cb1d5508658ef4ab137f22af919dae9d65cccfd9edceadde7a933c772ed4355beb57905e3a321b554cb52489c6c
SSDEEP 24576:YXYfDtczAAUeA9n/TM4NZYeNm+9MhUwd:Ptc7A9n/TDbXNKd
TLSH
T19D85012967E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333C85E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 715f708940949417d30f4ad76456014e2e19811df3965636bfe54aebaaaf8e85
MD5 2cac909824c9081f2c7a7c6e7cecbe14
SHA1 188c63cdf742b983ffed854d94f766acc7c49db8
SHA512 eb66634696b2d69f0e61e03c01a059f97ed18322eb7d3b1e9901b6a50779b99400d703f26abcaa40782f7f516de56a051acc220dbe04c31bcd43c0677590d942
SSDEEP 12288:7mw5HEjsChNzBFgl0WDm+CXBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2de:awuSOW2UeA9n/TM4NZYeNm+9MhUwd
TLSH
T17585F14637E80CF9DAA742398597D635EBF2BC062A25C71F0760C61B5F37251AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 3421849e0b6eb8e565ae3cc504c3914c1b28549ef3bac2e02d65da89a93bca38
MD5 a076fd5b29f2dc95a8d46ba273711b7c
SHA1 6aa018ee2ffb13840d0c679539521e2629b58c19
SHA512 0e1e8548a6c489c622d1a6ba50fb1df77fb8d9ee91008b37d8897be28bf38a01c9a04a92a153841086ba90acbbdb7d09683217f999774f05d4fef4479280eaca
SSDEEP 49152:Ov+taZ3usBWOBr4tEGp0bqx0z+n217aau1glmIpNbohqUwLi:qu6JmTxd2dRNUcUwLi
TLSH
T166E5AD13F1DA01E8D06AD478974A9233F962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 2.2MB
SHA256 fff2c0d0da5eaca95ed1eb7a061557376d89f7c525ede57914fad0f2aed330e6
MD5 44adf88ca53895089eda110011c788c9
SHA1 16c50333e9e1c5f59fc1a9cff74626ba1f125510
SHA512 37a0156bb753261d5b5bb7e593eef02e6b49fe3d94a819b7e8fde0300083bae765ec40fddb8cdb17d058135c27780d266441e8ac74efd2a595aa19acfbccc63f
SSDEEP 24576:xUUeA9n/TM4NZYeNm+9MhUwdwa7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:AA9n/TDbXNKdzIpNbohqUwLi
TLSH
T119B533811F3808F1C34629FE86D5BB1868E07DCEB606525D8B9EF6116F3426A57378CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 2.2MB
SHA256 64ccd6aafd70a720bfd00f4aab2863a63b751315f08dc7914493a1075dfe5503
MD5 865f5cc57385daf7565d6aaa421d7750
SHA1 eae5c3389ec7926e378dce5bea04fc2bb2e9aa8a
SHA512 b7cc9a97c671622ef5e3e959b69a0dcdaa17bd7a295573074b47f1f5ce7493d787ea28fa6b6eb222236344f1f934bd8a561c7245ea244ccac80e38c49b0f9fe8
SSDEEP 24576:RUeA9n/TM4NZYeNm+9MhUwdRa7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:dA9n/TDbXNKdiIpNbohqUwLi
TLSH
T1E2B533411B7804F1C74769FEC9A5B718B8F07CCAB621931F8B49B6561F3036A973298E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a4cc489edbcbacbbb0ffd432668f999c0f2eb3ee1ab84e5db4ea0811daebf6f2
MD5 723a71f2c2e12fa65ba7d21581bdc591
SHA1 3cab77a72633ffd675fdc140e77a4fd049b7371f
SHA512 618d50b858ce96c030d010ae54f4fa97b51eb5e56e7f58b9d609389cea6a3593202b150eba2038a6146da1d4c40daf7b82e6af1b41c1ebb6ebfc73e603af97ac
SSDEEP 12288:QBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d7:QBUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E96523824FFC09F5C74A0AB581A57B0CCD91BD4FF686439E471E722A5B345C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 9d44b10f4b427ec256c5eba4f59bd34be97245aeb85e5368b1ec1e8641e41787
MD5 6996d69b9544a30fdc7673f715f638a0
SHA1 d19bba4f7e32aba5f001c257ee131b188487e4ad
SHA512 9be61af610a5b0c1021c8d4ef69688629b56b3d7bbbfbf746e52bf516fd8f1a75e5dc1d39b85fd626cc15bc667418effd74adc757a3acc1f50e7496ba315a8f5
SSDEEP 12288:gyPz5L8KBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dV:RzyKUeA9n/TM4NZYeNm+9MhUwd
TLSH
T14875024767B420F9C2664239C8A21B05F772BC3A57608BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 1e1a4f7319b307e6c366507c40687d89719a082a01b0a9aa0580370ab9a04d66
MD5 18f5f1cb7b2528795376a2e05c0c5fde
SHA1 8d48724f5dbbbd8a1d96b47f9e2abcb5343ca838
SHA512 ad3f024d0b3f6f1e20185e19c6e1c79dbf2a556c8ec606faacdac02f94248e56096344c5f10f3ae757f885f8b5f59aa541ca35919db123c4038a0bc54307b2bc
SSDEEP 24576:CTdaLl3z0zDkUeA9n/TM4NZYeNm+9MhUwd:CTwLljrA9n/TDbXNKd
TLSH
T15D850295B3A00CF8DD67423EC8659A05D6B27C5A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 4be997e5d554771ada718080eb55844491e362baf078a57cdfd6f0de540c104d
MD5 d2dd770f42302fbfcaed611f661f021b
SHA1 9273903d07f411c019d5d8de12b398e84a76bcf4
SHA512 b0174e8958f60f06ae399688b36438205bac45ac4995af3fc67cff2f01288460811c7d86106ebd15b099eebc48ed2e042723ad2f0cce691e79dd0803ef877df8
SSDEEP 24576:935d9CHKy7GZIUeA9n/TM4NZYeNm+9MhUwd:d5d9CHKyasA9n/TDbXNKd
TLSH
T1DE95CF90F3E814E8F1B79A35C9765501DAB67C5A5B31CA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 ea2f802517be066de0756039ec1b3bbdaa2440316c413dad0e32fddd48937be1
MD5 8fcc01de6e4a41ac465bbe65a8e121e5
SHA1 3afbd392af87d1aeedc38e824799c6a6536dec0e
SHA512 04117ccad7656b4e113c16da444fbba82335b862eb129e8bce3d15b0073e2ca245f588ae6f02b7ec4196634ddb430801de413107674ea26c9d180413cb54e190
SSDEEP 12288:R0BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2de:R0UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1716523824FFC09F5C7490AB581A67B0CCDA2BD4FF686439E470E712A5B345C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 3b99f411ca8927ab6b931631338c84c31cc30a596e8494d72a29cb25f6f5b6a7
MD5 42e1eb53c96d8bfe1facd048e678c73d
SHA1 590eb7347f8b90d233c6ae500671722ccfe87d72
SHA512 d567d222790a258c423e1304297e4b7e3d7f82a75a39c75896d92964fae9f37308f7a6c6567ecb3bb5db5bbe76434edf929e3e7aa790668063d4dc6821af879c
SSDEEP 12288:yqBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dz:yqUeA9n/TM4NZYeNm+9MhUwd
TLSH
T18F6523824FFC09F5C74A06B580AA7B0CCD91BE4FF696439E471E712A5B385C6CA1648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 4c30f49f7101cd036ff40c4fe38c8901cecec93a52f339132dd579e2829af308
MD5 ada0274fc4c75d2d8c3f2f4bd92c27d8
SHA1 3871fff99c647b16f5c62570ecd0abf2dc82d60a
SHA512 a5822d6def3b03a3b40caf1416e349d65dd73550a6a0ae9a42d7216dd6f32f49c168de4b035572263937f32427ff758718ee5180fe82de247345d797ea7050fc
SSDEEP 12288:HPBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dN:HPUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1616523824FFC09F5C74906B581A57B0CCDA1BD4FF686839E471E722A5B385C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 b0eadb7a1527a1d7746552de3445501f899e9139f0f61b285523fcbb9fb8d232
MD5 1d62da6909c95382204e23f83d450d94
SHA1 10738ed543092b508be167a7552788c317361399
SHA512 d333823dee6419462a28f52fb41fd85edf8e897679773ff320dbaced16cd18d89ffa0820c6ed92e0102790c5078f4edd4ec9f16e7310a0b3a33ad34ffdf79291
SSDEEP 12288:4BBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d9:4BUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1F96523824FFC09F5C74A06B581A57B0CCD92BD4FF686439E471E722A5B385C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 1267c5a7f366461d0c4e3b4933cc5ac0de1dbb55ff78b2d8b555217466c13fec
MD5 de125afb2fa110a833fb8350ac19e772
SHA1 00a83e288620a92094d926e3b7656d7ea5dc0cd1
SHA512 fc3a0f117e347c551fb89fe85cfa9fcbd4775c9e124c7d853c07abc9bdde93ca5fea64f2b966534f0ea3b2cb0a85e1e57185d7722a826ae47152ac48e300b5ac
SSDEEP 12288:R0BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dZ:R0UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1F06523824FFC09F5C7490AB580A67B0CCDA2BD4FF686439E471E712A5B345C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 47fd93e0e4e9b7ced6b7f7703ac12efba93f19001f3956e568eeaee8df046487
MD5 5d52928d4990aeca207a57458ec37667
SHA1 e20148ac69c268cdbb29e40acb642f29d4c5a098
SHA512 ec1d3c409d11033f6ad7ffccdca9db4de6be5b432405d4bff77cbbdc5d5ae3b0ed5e5f55caba8d61b463071e39d6a2c152c136588601b5c41c5e097d27168752
SSDEEP 12288:7ZBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2df:7ZUeA9n/TM4NZYeNm+9MhUwd
TLSH
T18F6523824FFC09F5C74A06B581A57B0CCD91BE4FF686839E471E722A5F385C6CA1648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 e236772fcb59c04898c4e1388969ee13f11846899e95416d920c4328b209a4f6
MD5 9a564448281cf251e77524b2dc86342f
SHA1 e8ea44cc3be3217dfab22e868e7e4bb117c92d40
SHA512 61a01edab5e1813e422b58dda079bfb0ad33a3eb43a89099684b07f2209d48770cff80e4ea19d24b6c10690fc7b4f912df1f3271e5ce414c243f7fe42c84c796
SSDEEP 12288:ELBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dq:ELUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E86523824FFC09F5C7490AB581A67B0CCDA2BD4FF686439E471D712A5B345C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 0f3086e346d97af4ce12303f5c9a047988ca8df80b70f0f91ce45e9014e39f1f
MD5 2628ff20767eb58963c00635d3f8bd91
SHA1 0b2db2f95a7bdc69b72b2f3b1c00ede16f01b1a6
SHA512 5cf185665f7b46e1147011b85575956935f230b900abe8b39e4cf689b9abda08fd558a73fad2b0ee84562250dc0f8c480e5eba248cee422ba1b724ec1255a3ed
SSDEEP 12288:a8BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d6:a8UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1AF6523824FFC09F5C7490AB581A57B0CCDA1BE4FF686839E470E722A5F345C6CA1648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 2d63880c0abc055ab15b90350b49691d5993a60059f6b5eeea126c945952177a
MD5 f0d8038672ef125c818323fda4b1446b
SHA1 eb3aae14202a33ee68f86818c68c2613b7fc1f90
SHA512 93832b0b17dea490f902ade515230c6c1614ef46ce85d525d3f123ab766da6cedf062e70ab60c5520d919dbc3fca1dd40d7d0f69ab6bf2941c3bcb4730d17548
SSDEEP 12288:0LBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dn:0LUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1DD6523824FFC09F5C74A0AB581A67B0CCD92BD4FF686439E470D712A5B385C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 1.4MB
SHA256 2def0ee8bb9d8cfac584b8fb283f2a4fcd7eb5fd5e042423048500ff009e4246
MD5 64a8c299dcae4cec0b9bd23feb53e73d
SHA1 f4cd87014c9850383d5bf7a0d1c9e0f2f8ed08af
SHA512 fc5d23aa88e78d7ab0f4f8194694baf665cffa34cfa92864e9f3fc7cec6547b9ded0ede496158e6e99fa2ff69704bc14b71b7aebe5278d386f937cdede076cb8
SSDEEP 12288:HnBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d7:HnUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1096523824FFC09F5C74A0AB580A57B0CCD92BD4FF685439E471D722A5B345C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 1.4MB
SHA256 9815c8f1afa6af86b2db0b764f8be368f5666dd4a0f7b8e199f24fe49ab74ce8
MD5 6ee22366506e22cecc5dbf04316858b3
SHA1 a71779169b97eaeedb9f319e40fbae2f420776a0
SHA512 447d4784141be4f3c7ff408c04d3bb110867dd5b7c58bbdc7fbebeef72020125d86696c6c7f861a537279433e6593f1a98492499b77754b10182b5918ca51670
SSDEEP 12288:mmBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2df:mmUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1276523824FFC09F5C74A06B581A57B0CCD91BE4FF686839E471E722A5B345C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 1.4MB
SHA256 de1e145c83ba6fde13227beed1bc861da3ab6704044aa25146253b96c8848374
MD5 ac109e1204503b1f03d3a9a0b6cdc101
SHA1 aa172ca87a8c5f36b2a72cd916e967752bf537b7
SHA512 41b7b4678881d073dcfc6bd65916654a81efc8c734942b8f1ea41faddda6950e7d8872322a887688f8d660bf7e5ddbe968d5eedbf713cf1e89c82f167d58d364
SSDEEP 12288:5CBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d/:5CUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D86523824FFC09F5C74A06B581E57B0CCD91BE4EF686439E871E722A5F345C6CA1648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 1.4MB
SHA256 e7f0bf75f36518a829ba99370803a79f6bb9134ade4c94e240ca10fa02644eb6
MD5 21cadb2c3f0bb29541e2ab7938d7243f
SHA1 e05916df367d06f34262b7f9be6ea490c4994449
SHA512 4b7f4a0188d2edbf5d7131988550ea6c7fb47cb6a794dd58b115d89c4a8544a908ca24d04b212c4d853781876bdeff2b3abc65f8a4001e4f13749aa0a1b77fe9
SSDEEP 12288:CxBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dI:CxUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1266523824FFC09F5C74A0AB581A67B0CCDA2BD4FF685439E471E712A5B345C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 1.4MB
SHA256 06b56e70ddc93b0956d2a4679605bd5688b6f200c250e60870647622ca4dc15a
MD5 21867d9658a1a2ff7a05659c7a01b4e6
SHA1 d2edf9cb60217ef610790961a05e7bbedd03b95d
SHA512 7bd7b97d2da9aa355702fb29802759b54c0f9a28cb533ab7ec27d2ea2ba09e09f64a5af924e07def5d1b5f7d3b78cd2d78894307064304f8f87214dd7382e919
SSDEEP 12288:yKBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dC:yKUeA9n/TM4NZYeNm+9MhUwd
TLSH
T13A6523824FFC09F6C74A06B581A57B0CCDA2BE4FF686439E471D712A5B345C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 1.4MB
SHA256 e256ac0eafacba2af45fa75bc5622d450a9ecc4b4e33d9d756ce992f95e7c5f5
MD5 5716c28e42a17706e25f1f0d30bf1b17
SHA1 cbc954cd3bc9320eef83b51ee630c79e58ba5af6
SHA512 b34f365c9c3bf11ca8eeb1976fdbecd92fda1c9fbdee10cf1361b78ca030d2bf49b0288757699851d03d1eb83537991ad6b4e3a573319cb1342febed47729433
SSDEEP 12288:rdBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dl:rdUeA9n/TM4NZYeNm+9MhUwd
TLSH
T18F6523824FFC09F5C74A06B581A57B0CCDA2BE4FF686439E471D712A5B345C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 1.4MB
SHA256 8b903e85311c7aac2c4a657915b00726f043dff7ebdf5374a125b60470d65c6e
MD5 d2eb3403ede878437cdf0d9f8c7c170f
SHA1 a81a84e1403705d34e93004c37f1ae7fdccf46c0
SHA512 68425647078bffc648785bf912e80a323aca6a2e4b36d656a724fe499bbd81325c730fcb37f986c6cc320f66a5616930698e2d73b9f8d29450e96238c66dd851
SSDEEP 12288:xBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:xBUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1276523824FFC09F5C74906B580A67B0CCD92BD4FF686439E471E712A5B345C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 1.4MB
SHA256 f38834822730de96607ab28a0d943305d7a562a64e771c637dfc06b223cc75d2
MD5 8edff18c1509795a8e3b0cc3c7fd800a
SHA1 e258acd6cdc4661c6671504fe384dab0ad7991b0
SHA512 bf5a184160c9d8206adf84aee909f8beb4c03d29787a428893d0d7dc6edf12a8c706b6e2a32fd18be8e2ea6956ee84d30005cb4df5ef575892be0967d221364e
SSDEEP 12288:NBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dH:NBUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1FB6523824FFC09F5C7490AB580A67B0CCDA2BD4FF685839E471E712A5B345C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 1.4MB
SHA256 9dbbbe61efd46e8cfa8401e965aecd99de5702ff29e11af0e0e17cc8159f44af
MD5 61baaee708e5a824c363d4bb79a02362
SHA1 d515fb138d8d9738c9246a097e3b1946c5b5927e
SHA512 72861e742a441fea142318ad807cb5e921d317af914e5aaf6a95a40c62c1559797c847fa13403f51bb981336ba4ac8292026fe9d7b87e8219668186ddda0638a
SSDEEP 12288:2kBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dC:2kUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1766523824FFC09F5C74A06B580A67B0CCDA2BD4FF686839E471E712A5B345C6CA564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 1.4MB
SHA256 4be5065263b495e9ce4c494d2b0ea70eeadec58fb9512b9969ebb28bdeff6809
MD5 c06bbb196986bd44a25ecc6323dc28f9
SHA1 dd3ebe960856afb92483599b2a4d7dc42c169370
SHA512 aa8567fe7500d0c9126c297f8b4101b31e11d23791a805f457aa86fdd2a545e1b3caffadff776573a786e9ee649ff45fb006ab13f5e93cc0fe59138a1c3791ab
SSDEEP 12288:UlBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dE:UlUeA9n/TM4NZYeNm+9MhUwd
TLSH
T19C6523824FFC09F5C74A0AB580A57B0CCD92BD4FF68643AE471D722A5B345C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 1.4MB
SHA256 cd24724ccc02360f638c20ba856cca52e9b4c5b54df5f3dc83aba5af66f614fa
MD5 105838a8fb1c7900b7b3e3aac5369021
SHA1 63aa24ba1520a278ec301bdfc38fdb0c683de1a5
SHA512 209a8abc3e355d3525b7518dfafa6988a6e693cef93ee356f45944783865e2bcf1d41b394817d318006506d251a192974ae0acff26d0ee03a28c81c63b68d664
SSDEEP 12288:X9JBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d9:X9JUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A16523824FFC09F5C74A06B581A57B0CCD91BE4FF686839E471E722A5F385C6CA1648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 1.4MB
SHA256 4f4960ceb8d27987684f19a3a6c1459137327e37a2f36ff52d2fe16f869cb9ab
MD5 9a661e64929bbfadb8b5dd5a4dbe27ad
SHA1 31899d9d1c533f7eecbb145c47e64647524340eb
SHA512 93b55f88f7b9fa37cade752269d2b7048424f014b11964ac7e86271e7592120acf1b51fd2e21e2265e91fa2018d962ad23eeeb9616a9fcdf8d5f013da22308ce
SSDEEP 12288:GdBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dh:GdUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1DD6523824FFC09F5C74A06B581A57B0CCDA2BE4FF68643AE471D722A5B345C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 1.4MB
SHA256 f10bbc5ac6c222dcad84dd60a6ad89add87ace019e59ab0bd019af6f102ee8dc
MD5 30e7b1c7f1b97d4be85fdd16375e54bc
SHA1 c6fcb50874e344c47b7182b8b2f828ebb15157ef
SHA512 2386e9341fd9c55b2d0ad8711692aff5d675e08d5c17b2a33c9ddbc3a21c90f93fb8f0240c71f15fa32e172d89f5e61d2d3ac612380e3f46295dc6b2d2a00ff7
SSDEEP 12288:kXBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2do:kXUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1EB6523824FFC09F5C74A0AB580A57B0CCD92BD4FF685439E471E722A5B385C6CA564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 1.4MB
SHA256 bb4c92f1444bcbe022750fe8dfe0e8f220b72a649883f098dd2195ffe31a5049
MD5 0c804d976f84a653ad30a64aee575a8e
SHA1 7a3c03763cd1efdf59c3504d3c1a0ffb4981ba27
SHA512 7f37b5f1ae91c62d0606e9a08efa56b60f3201cb57d61e9d5b4c5181a516ef75bdd63ee8c26536473069476164d6cbad24ca5bcc6797628ce9cf467847064608
SSDEEP 12288:00BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:00UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1136523824FFC09F5C7490AB581A67B0CCDA2BD4FF686439E471E712A5B345C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 1.4MB
SHA256 d548210556f124413ac50b0132a2ef1c724ab927c2c15534c7931c0a365fab42
MD5 edd83089dab04da14d475b3c4ff8ef49
SHA1 9d96912915f22e204bcd4f05743180284c1783e1
SHA512 474429e1c99036c7cc91e2a6524f24ff982af2703143288a8ed9f4696f2d0fab455e238681526e9e90c0afb03f8cdf2ed12344d2f3807c23e7917dbe6f4ab526
SSDEEP 12288:pkBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d8:pkUeA9n/TM4NZYeNm+9MhUwd
TLSH
T11E6523824FFC09F5C74A06B580A67B0CCDA2BD4FF686439E471E712A5B345C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 1.4MB
SHA256 04fa02702972d7c3f0de856e8bcca245cc8b3c8a20d7c7aa4db95a5ba7c60463
MD5 69f850a7ff6badabb8b887939c942d77
SHA1 3add0a4c7c0d13de7befae712e78000860304fd5
SHA512 ca3745806032af6c785fc03bacdfbf2ad3e304a6f60e91e025c4e58563990f4e25124d1d97de5829996618145fafc78691ffc5e025b880dfe84a0be3e5ae54c5
SSDEEP 12288:M4BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dtR:M4UeA9n/TM4NZYeNm+9MhUwd
TLSH
T10A6523824FFC09F6C74A0AB581A57B0CCD92BD4FF685439E471E722A5B345C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.2MB
SHA256 081a10a744a9a07c8db70478e72ff8ec9e5dc430cc10f1f6d3a0b9e09ee17bbb
MD5 ddd1ab08307d329092bed9cd14b52542
SHA1 68022c42b4eebdb1b240efde1563cc9d24b1dac2
SHA512 bedaf7e516cfc08fe2995a42ec67900fda5f4146d36b536f3d16f4351f8401c79b3a2ef49881eb15223f2fff13d976e7ba04e9851bcbff6d2b8caa4840315a71
SSDEEP 24576:vwwvtk9RX6wkyAIOa7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:ZMnYIpIpNbohqUwLi
TLSH
T14545E029EBD804E5E1B7917C8DB7460AF6B178591B31C2CF129A53AD0E33ED46E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 4e85d9019c6f24988a3613e3f239b997fcfd94f7e0a1433a60059f4c13c2a9f5
MD5 a5744643358dd3dee12a1f8a3b9ad609
SHA1 32269d98a5766797fdef0e775f8b52205b7254cd
SHA512 619e73ca9e436dee0e2bcfb97ad6dec2405b5a7a964e0e9102efe5dc05dc5632b39e40e18938cc3d63d5e5f6fdfc77745ccb0e5bc003429ffb7684a1dbc14afc
SSDEEP 49152:4Y/ANpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iA9n/TDbXNKdH:CySzPbfb9sGNUcUwLi
TLSH
T109269E96A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 2d7afc0644a085d199cf610c4aa9fd910cb4440c13b044624567e80b38bf9ce9
MD5 ecd26338135e69bd743f45bcc9b6d58f
SHA1 cd1284a7d7ee7921d84300383c72c0c73679fd3e
SHA512 c01733c23994891ab1e0494184a2219fbefd230da60e575d7ebbbcfc5b8839473b734209b6bf11f1a9a15743aeb3d429096c658fe1fc2a85341aea3d3d44d1b4
SSDEEP 49152:sy7JUQj7irIhCnDHUPfF/SA9n/TDbXNKdhIpNbohqUwLi:5J5glD0PFfb9s2NUcUwLi
TLSH
T1F3B5D01DA3EC01E5D1BA927885159A1AEA71782E2F31CACF1270837D6F23ED44F35B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 e0a302fbfd8bddd4a1f37ae8740a31d44e1f19ff5ffa8710e732499b8754e0bb
MD5 7c83031fd7d84bc8d638b21d4736e214
SHA1 066d8eed1e8bc447c61a044016d059405c40e134
SHA512 d503706c82247034b4bd6ecf52bb8f2f414212247f284ed4c0ed60b9597dc19402b6cac103efc29b490839ba03560ad90fce0e9431a7abd63596df99c40450b7
SSDEEP 12288:BcSg5BqrzauHMBfVupyseS76maRMITPmRXt83S+3R:Bc5Gsnup9POmaRMISRd83
TLSH
T1B8551701B626CB4FC6A940325E32D2CCAB707D41FE056F1373C9873F9576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 1324bbde9896f00270dd9901abbd1caa2838055263f9e3e2311a0690f0f7a97c
MD5 515cde11b7cbb983d0a7d5e96d8e8cd5
SHA1 142579e2ca3045e6994474e20f9a5bce414f3049
SHA512 b95b4a0cc77ced36a7576042128bb44c7faf897ac535975f3f8c74b96f69fc31a7343481d460a455e641fd3685cfc3594f11e91328c11c3e34d73b410c6214e6
SSDEEP 49152:rG307WTyCHJMsfFXugIqmCFYpiMFaMhw+btW0cg:Ig
TLSH
T19E750A40913BE78FC1BA5032073A5A8DB774EC16BB056F2673C9453AD86AB55B0F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 13f9738dccd90fb1af5df206ef3a90e45c1fb9e3c68d5cc5a2b3e54c708ba62f
MD5 7b733fc2090d58c2aac58b3d725ee734
SHA1 e97c6d6b2979e33baf3613f0d037c1d6f7df0070
SHA512 0d626711822034d0f656d90d70fcf22290e723c310c3f04f505c3d2828e4e155d0c87516f97d94616248df5215d2ffcc5fe13dce32abc52157cc290c35963e2c
SSDEEP 12288:1O7pBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dqd:IpUeA9n/TM4NZYeNm+9MhUwd8
TLSH
T15B6523824BFC0CF5C75E16B440AAB7089E56FE5DEB4083DF8609722A5A349C6CE3654F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 14e4a3d86f32bc97fef11707f1ee0315813c2a211a935fa39b29b10f75639df5
MD5 5a30e4921504b091f155ee4f663c092e
SHA1 33b0f7930fa1d92b4ed1f15e34fd09419c24d581
SHA512 a97a6f80b258ff9969720f210b15f49b02d61732e8a84ea055d00d8fe4d5eb9c190ab8f7052e8041a8520ebe06ac3d98b00441ee9d5c2880d45d3602270e7990
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bY3UeA9n/TM4NZYeNm+9MhUwd:Bgb4mBIBhGFIA9n/TDbXNKd
TLSH
T15A65AE1E22EC02F5E1F9D2B88DAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 211d90eebf962bb743df20d4ce64186d6b9592a4576764a9ef6305afa8b51f68
MD5 a4fbe6d4aee9b26b7480de75466bd7b4
SHA1 59fd10aeb3414791f57685a62aae75c08ff57ca6
SHA512 acb98b2ae3faae6d15024e615bc0ff93f7401bc99f643668f199f8559fb280fbcafc5fad42fc637fbe9f3c8ba88a1919ab029521c3373fc6461dcfe9abd67cfa
SSDEEP 24576:sG13a7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:sG1oIpNbohqUwLi
TLSH
T1EC052325257034E4C636A5FE89A5A62238F030E13B1065EF4EE9E6B15F752F4333AD8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 ed2c9ab4f791ae2421f4f7cd41bc202c26aafcebf79a396becdc5e5558a13b61
MD5 c054e50fc228309011435e8db54992d9
SHA1 3339f47b0a99f60831669508c98b275752ef91a3
SHA512 a6a82b132d3b0a3bb2f2b91d108e7e3ab4beef0af6a1f767c62e09364b27fb4113cbdbc06c349ed6da8550a4e8a65506f2fd39515b4f52d8d4708e6746c2df40
SSDEEP 24576:OG88u8FpJqH1hzria7/muUeA9n/TM4NZYeNm+9MhUwd:F7ZFPqVoa7/jA9n/TDbXNKd
TLSH
T1D695016567E401F0C47BD13889824667F6B2B8251364EBDF07AC8B561F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 abee0c2a773056977aaa6acf7a24c13dad40602e570113c64d2f1b9228adca59
MD5 9c3636e116defe1c0ca9029db2189472
SHA1 fc938d15ec933a0f74f77f8d845c13c99bcc8132
SHA512 da578c15b06c0286c1ae617b03a01371103872becd35eed2556c3830fc81667d8ebaaa9966294ba9d459218d030947cedc40afaaead1a0da481ddb15fe0e4fb0
SSDEEP 12288:ZHvUrBFrEjwaQyBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dR:ZPUr+NQyUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17C85E11F26EC08E5E67AA17D8586870DE772B8561312D2CF0290817E4F37ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 544ce93ac6765af04adcd8b629dfbe66aca09fb6d9ffe24346d9aaded9a82e39
MD5 f74442a3bce00dd83d72685d428b2a5e
SHA1 af6566e39641055f80312dacfb5671fd316c078d
SHA512 8782ca18cd52764e59c6f95581c350bd14aab080a3856306a48870223e01084d8f1376f092761d48058831ddbb8ddc45032fc240715d6d079f5a65b53d6a525c
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8A9n/TDbXNKd:yG05lO43bqfb9s
TLSH
T119D5C06A62EC01F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b3e2ddc5162541fab0001bb8bc3436152aab1dededaf336483e1626588c7bdcf
MD5 bbc28be685b1818266d286de4765e398
SHA1 37ab7ce2939e3a73aa424847c8035793af559f67
SHA512 258a2c5f6bd277c2137c341c46bc8e119e89fe9261557181e2ef71d951942bca46eeb3049513a9d311be844ab4203df51f6899f3962accd27042bc8328db2b0a
SSDEEP 24576:4fa5POZ3dpFWVM50JicR2hG0lasx2+47eidngUeA9n/TM4NZYeNm+9MhUwd:Aa5POZ3+Jt2pasx2+mkA9n/TDbXNKd
TLSH
T1CB65AF5EA7FC01D5D5B9D17DC583460AE5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 60d51ed8b05c25c89da65a64d9d57239bd02885664f5cd4fe760d6117545d5a5
MD5 c4c2e0732f9fc59989f267fdf5738b2a
SHA1 1302677d6ba9164f9259f22b5a20f88cab0f2e2d
SHA512 ee37c4e10e6ecd7b485a99902f8fce974366afd87799669d80bf6d62538e565599099cb2c144c3b7b4d36f129d5918402d2e21bf85fe2a8b7c26c62b2257ffbc
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7FkWUeA9n/TM4NZYeNm+9MhUwd:DNc/zEOVHFDA9n/TDbXNKd
TLSH
T154858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 0c53c35d59623775b2dc3afcbfe6c9fed5a1eb4b376b734fa05e7993e2f06e5b
MD5 bd90530acc701c734a1d11bc0664f500
SHA1 df0d4b0c53b0d65cf89af9980a3a98e4f0b9418e
SHA512 3b9b1aa400e0b918916f84ea3fb91a9b66a62df035da90f272978b49500a1d212270303dad02d53c3730824ca5188e09f37fd674e5320707f2146ccb78e84eba
SSDEEP 24576:hjDILa7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:hjDIEIpNbohqUwLi
TLSH
T16925015C233A10F5D167E07EC6820612E1B2B0A1971269DF4BD8C5B95FB3EDCBA39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 b00e3fdfca9e62eb21a3353625a5e67ef2e0e71f2456ce545ec94eacfb5e80ee
MD5 ff4ce6cb85b3a3524e6aed846047f3be
SHA1 133780ad2086494ebdb7456b5fe8aa47463c3ebc
SHA512 07184889feca3f2018652825bed7e78a37f0d14740c88f211d9d305a51622401b017e458d091e6431ce62932535e236553030cd2cc31b86cde38f36694aefb66
SSDEEP 24576:cPtyIa7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:gtcIpNbohqUwLi
TLSH
T1AE152300236420E4D6B625BDDEA3822169707C507B11A2DF6AD5F73E2F367E47A31F4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 c80c44ea974b4bb0038191d16865c2a5b7794022d91a23d6bcf6ff79c217c1a7
MD5 183846945489ba108acce3849655d75c
SHA1 4bf31c84b3dee90032336fc1040279457628bd56
SHA512 79080ebb4de782a30704fbfd3c96a77acd6426517a1cd4043c973f97005964c38db920108e8f26ab11deb44e4fdabfe54a825ed03797e5c96c28c306d2f945a6
SSDEEP 24576:7za7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:7MIpNbohqUwLi
TLSH
T13E052350263034A5C66278FE9A95A72130B030E13B1265EFAFDDE6B15F763F92332D49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 0a785648a2b37f16880046205ac879916704aaae9fbc85536712440968f95b1e
MD5 689817a9aacdb466b893a2345840f3f9
SHA1 2c321b2a5a8e3a1dfc00b768f9a2645557773899
SHA512 81b61189c432909bf89370c6bc50f382348a5ad85135e1415d9006ec4db2729c57d5906ac040b698f6dc8dc583b2442cb7355051683c4fe6d6ac827f8053d85b
SSDEEP 24576:XAgjboTfaidZea7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:QgwTrZZIpNbohqUwLi
TLSH
T1E765AD1D67EA05CAE2B2D679D8721493D633B4311772D6CF2488C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 1b76794bfa041acd93a2f21633739513b693cb5999eea499f6647b1f6285fb85
MD5 63b050a5ba01129d1c92ea90a5e95cb0
SHA1 1f5f6656c6627710b97f2ba40a33626fe52642d4
SHA512 14b613ed3464b962dd09215b3c42e77937690c883284759c07dd6973a8d56634ed86423c869ff106e97ca3572eb382723ef7514aae51194b9a98aef7f0196bb4
SSDEEP 49152:Rgb4mBIBhGFIA9n/TDbXNKdmIpNbohqUwLi:RtYfb9sRNUcUwLi
TLSH
T1FEA5D01E22EC02F5E1F6E2B8CDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 ea27e3acd099c9c421a12b8435d803a5b79a2f430344ccf2e07e8f7047cb6d45
MD5 34dac090feb5e039b48dd4927081da0c
SHA1 8e325c85546cad61129fcb3d764144f2f15fc32d
SHA512 2145b515a482e5892adcbeb58cba16d466de5bc541cc0c5628636894358ad113f002fefeb254bb60caacb5166216f981395c38929c373f6f66f7446fbd281ed8
SSDEEP 24576:sTkNvNnaFeYhJNtmZBmwa7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:sTMwBtOmzIpNbohqUwLi
TLSH
T19975BF2E7AB806E4D1FAC6B5CD238512F6727461173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.1MB
SHA256 1a3bf5b89c4a029d333c40dd06ffdd32ef940a89a6f8e6aab189292a52a81f02
MD5 baef52e6c7522b2586f1b40180fff6b4
SHA1 f04fc1b3309184d6e39254cdaaee9aa60cfea947
SHA512 710d3809377e9218f5274b42ba544d130a9831090076962794f47b08bbca2013ff3b27d537cc32c29a62ec9043bef5088cba95199d9c7e2a77013814214a6547
SSDEEP 24576:SCD3FHshBIYQgALa7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:VDVHeBIAAEIpNbohqUwLi
TLSH
T15745F27DE66C04E4D57BD1BCDA638A06E6B138A9032265CB06D4C1B61F6BEE43D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 fd63751d87a1d5ddd68dddc86aeefc289a4cd0737304d58ae2f4defcc47ce7d6
MD5 9dfab93425e680b9e03c15b8b24642ad
SHA1 8d7f0560174b95687516d9c893d64b7a5715050f
SHA512 8facce8d6f5816e7b479aa473c47725936aeaf49e0d07709050a8acb426876879d0937da576df6d264cba6f662177e7a989efaf9ed65dbd13e3399b086d2cb2e
SSDEEP 24576:mJnJPbzB4Sra7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:mJnJv6SkIpNbohqUwLi
TLSH
T1ED35F13DD2A810E8D4B7C2B8815A175AFE71346D2F2169C759B8D5343F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 6e6be362edda2eeae4458b6d3545601f1458a16937edd6e14e49a3a05d60bf44
MD5 8d056ddcd388d80c1034d176c53aed83
SHA1 10e81715c944f0336786e9e5feb7565b557abd98
SHA512 fedbcde541189594969ef34afca600cd88928e7eef02fd0039e593a652e94f8ac362e4cfc32700df2aba92f204b0fad42c0efc4e191edf0c0e162ba97d3601fd
SSDEEP 24576:Sga7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:SDIpNbohqUwLi
TLSH
T1F9053340163428E5C26378FE9A96A72134F021C1371165DBBFDEF6912E763FA233698D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 832e1d212ebc05b85e08dab5c660fdd4c7653d16ddee2bbed13351e25a1bd4d1
MD5 82bde682286db13d55dbf4d816903707
SHA1 6e5c426856db275835800b3c578b53ed1a0639e0
SHA512 543a82650524bd4f8ce270e21a83f658bcceb370ca985c262dc4398ca1e0003917cfac6da42bd3e684835aae6501665dfd62c6e42c20fba58386f2b0461e884c
SSDEEP 24576:1H6UqjpRa7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:F6UTIpNbohqUwLi
TLSH
T12C25230917A024F5E07661BCD961823550B078B22732A5EF77DCE67A4F32BE4923BF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 0193b258f6d110177e5ff56901330c60cd80766701e28d17be92ef0b588f7f50
MD5 e04bf7d7c72c4bc463ea7190e9cca4c3
SHA1 10c00e8a0f8ba273d612bfcff9eaa83553381e6b
SHA512 d6e0907502b202bf547306bdfecf55943a9e9bec8566c58c8ac511b7b9aa88ba720282300fd15262831db94dd30b861b331b4e991e0d2ccf811b58574cb468db
SSDEEP 24576:BZCLHGL0MoeVtFumTijCmlKQWDkla7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:nCLHGeeV5ijCmlDWDkeIpNbohqUwLi
TLSH
T1DAA57C05A7EB4184E8F3CAF5CA2694169A327C549B34F7EF4E80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 964KB
SHA256 6e53b8e2520f8a3253e16a7d31852418ec53d949914e6478b9c2aa92fd7263cb
MD5 5ca7005d587f00dba5acfdccd288ff4e
SHA1 34f3f5a2d07b2ce87606fc64f230d02ef18478e4
SHA512 2a02a34e0f31f6e4d11b4fb50152db83204f41604d3abf593e93ef7f6d1f5b0f474a8147aa38d1c063c3aba5af499a1e106585ae8b74e4373107ce1af5c5ecc4
SSDEEP 24576:8frcmR7a7Iz9jJzV5FV+AxOhfwXt9oXAtsk1lm+GC+N:AcmRUIpNbohqUwLi
TLSH
T10325010E726A00E6E1B791BCC9824216F6B33070271267DF46E5C77A0E276ED7E39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 3bcf9dd3b0cd4c4d0153600e6656ff14fe9986206f14329d9c6333c3d5d30f80
MD5 8a3f5d317cab9d9c9ede3b131a08a5ab
SHA1 5edc02526ae045c3f4e6a9b58b72d1d085311328
SHA512 40d7b99f6be4085c3f50a65f481eb0bd7dfb9d39aeab69c7ee20bad756269c715d9aebea4b68211824d00c0aaa06a92f407df3876cc735d861aada4e240f7d76
SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3zIpNbohqUwLi:j3Upow8sBlNUcUwLi
TLSH
T168B59D3DA2E810A8C9AAC379C5421366EA71742E3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2012-162-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2012-348-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2012-169-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2012-163-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2136-54-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2136-63-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2136-48-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2136-55-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2136-47-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2136-58-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2256-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2256-147-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2256-155-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2256-157-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2256-153-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2440-556-0x0000000001760000-0x00000000017E3000-memory.dmp

Download

memory/2440-540-0x0000000140000000-0x00000001403A7000-memory.dmp

Download

memory/2440-573-0x0000000140000000-0x00000001403A7000-memory.dmp

Download

memory/2440-550-0x0000000001760000-0x00000000017E3000-memory.dmp

Download

memory/2440-549-0x0000000001490000-0x000000000157A000-memory.dmp

Download

memory/2440-547-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/2440-541-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/2596-529-0x00000298EF9B0000-0x00000298EFBF8000-memory.dmp

Download

memory/2596-351-0x00000298EF9B0000-0x00000298EFBF8000-memory.dmp

Download

memory/2796-141-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2796-134-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2796-330-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2796-135-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2896-21-0x00000000038A0000-0x0000000003907000-memory.dmp

Download

memory/2896-14-0x00000000038A0000-0x0000000003907000-memory.dmp

Download

memory/2896-475-0x0000000000400000-0x0000000000BB6000-memory.dmp

Download

memory/2896-2-0x0000000002DC0000-0x0000000002E45000-memory.dmp

Download

memory/2896-0-0x0000000000400000-0x0000000000BB6000-memory.dmp

Download

memory/2896-62-0x0000000000400000-0x0000000000BB6000-memory.dmp

Download

memory/2896-3-0x0000000002AD0000-0x0000000002C19000-memory.dmp

Download

memory/2896-8-0x0000000002DC0000-0x0000000002E45000-memory.dmp

Download

memory/2896-7-0x0000000002DC0000-0x0000000002E45000-memory.dmp

Download

memory/3016-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3016-126-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3016-120-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3016-334-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3016-119-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3016-332-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3240-93-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3240-273-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3704-106-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3704-112-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3704-352-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3704-295-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3704-105-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3704-354-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4184-247-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4184-89-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4184-83-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4184-81-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4640-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4640-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4640-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4640-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4640-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4716-222-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4716-64-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4716-71-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4716-77-0x0000000000970000-0x00000000009D0000-memory.dmp

Download