69e4018b58a95a0c08cc098ce04017b22aa583c55147f6d099804f496c51da34

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 2.8MB
Sample260929-xfb3dsdc62
SHA256 69e4018b58a95a0c08cc098ce04017b22aa583c55147f6d099804f496c51da34
MD5 a9810729139d6474f4af2c4b9160276d
SHA1 58db7757db184ea5f23d59679bba8f838381e1a7
SHA512 2551ecb122c79689bd642bfcd9e9cf99b17cfa7563ab60fb010156af6a2fb6dc714c3c38ae250f8a77b41bba34dca43f55df3242cc5e18ff434bc6776bd96eea
SSDEEP 49152:2rxRP9sg+B/Vmg+J3A9n/TDbXNKdh05w8t5GN/AxsMRqhqA9n/TDbXNKd:23MBVmmfb9s65w8tANYiMRqhbfb9s
TLSH
T15FD5C00277F94179F2F37BB19EB893645A77BC71AD39C50E2281215E09B4A80DA72733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2372	elevation_service.exe
5744	elevation_service.exe
1720	maintenanceservice.exe
1848	OSE.EXE
5460	PerceptionSimulationService.exe
5808	perfhost.exe
4404	ReFsDedupSvc.exe
4324	SensorDataService.exe
2064	ssh-agent.exe
2560	AgentService.exe
3768	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
	\??\F:\	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cf395115227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000093c2-469.dat	upx
behavioral2/files/0x000100000000932b-468.dat	upx
behavioral2/files/0x0001000000009952-470.dat	upx
behavioral2/files/0x0001000000009cfe-473.dat	upx
behavioral2/files/0x0001000000009b92-475.dat	upx
behavioral2/files/0x000100000000a0ce-479.dat	upx
behavioral2/files/0x0001000000006223-485.dat	upx
behavioral2/files/0x000100000000627a-488.dat	upx
behavioral2/files/0x000100000001aef7-489.dat	upx
behavioral2/files/0x00020000000198da-518.dat	upx
behavioral2/files/0x00020000000198d9-516.dat	upx
behavioral2/files/0x00020000000198d8-515.dat	upx
behavioral2/files/0x0003000000019849-514.dat	upx
behavioral2/files/0x0004000000018a5c-512.dat	upx
behavioral2/files/0x0012000000018a5b-511.dat	upx
behavioral2/files/0x0003000000018a59-510.dat	upx
behavioral2/files/0x00040000000189ec-509.dat	upx
behavioral2/files/0x00030000000189eb-508.dat	upx
behavioral2/files/0x000300000001897f-507.dat	upx
behavioral2/files/0x000300000001897d-506.dat	upx
behavioral2/files/0x000300000001897b-505.dat	upx
behavioral2/files/0x00030000000184bc-490.dat	upx
behavioral2/files/0x000100000000bd44-486.dat	upx
behavioral2/files/0x000100000000a319-484.dat	upx
behavioral2/files/0x000100000000a304-483.dat	upx
behavioral2/files/0x000100000000a2c1-482.dat	upx
behavioral2/files/0x000100000000936d-481.dat	upx
behavioral2/files/0x000100000000a1d4-480.dat	upx
behavioral2/files/0x000100000000ba34-478.dat	upx
behavioral2/files/0x0001000000006215-476.dat	upx
behavioral2/files/0x0001000000009cd6-472.dat	upx
behavioral2/files/0x000100000001b991-471.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b4fe4084350dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005927fe454350dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065b4700a4350dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e25960a4350dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	4404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4404	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2560	AgentService.exe
Token: 33	3768	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3768	SearchIndexer.exe
Token: SeDebugPrivilege	5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	2372	elevation_service.exe
Token: SeDebugPrivilege	5744	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5036	2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 4360	3768	SearchIndexer.exe	102
PID 3768 wrote to memory of 3676	3768	SearchIndexer.exe	103
PID 3768 wrote to memory of 4284	3768	SearchIndexer.exe	104
PID 3768 wrote to memory of 4456	3768	SearchIndexer.exe	105
PID 3768 wrote to memory of 6020	3768	SearchIndexer.exe	107
PID 3768 wrote to memory of 6068	3768	SearchIndexer.exe	108
PID 3768 wrote to memory of 2012	3768	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_a9810729139d6474f4af2c4b9160276d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1720

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1848

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5460

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5808

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4404

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4324

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3d1c1d230c04013b5af8ce4161ea29d2b2176da511c785733f4b9cae33c85945
MD5 e721debadf5d8e2b9b48d244639de179
SHA1 ef85a4b92dca40977691e93d271898cf840dfb8b
SHA512 e29166036db274c3cb027a671f84a7664f41f5349cce77f7fdb74692a276376741b3694803f1381ad902411173e1a95aed64b96efd68d556cc72508f834c977f
SSDEEP 49152:Zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnyA9n/TDbXNKd:v3q6HjBKfb9s
TLSH
T1E5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 d862904a46f7a2a76b6c553505305f7e54e62a980379a719e3c8c029728e6997
MD5 b1403d6fdecf016227ffaf46c2dd394f
SHA1 d7ff85716410caa55463d0b1f32bfecbec951ff1
SHA512 24af4349420116fb7096a97e6d3d720ee27b7e0235a838ef957e950ac136169f11b2633e84c6307d81a5ae13a91c0d65a2b67332738b6562339ceac440f6fb18
SSDEEP 24576:oXYfDtczAxUeA9n/TM4NZYeNm+9MhUwd:/tcsA9n/TDbXNKd
TLSH
T16F85022967E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333D85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 6d865f204381cf86c380f429c4d40deab59fc3c02e8ede0bbd93cb9a2fb61ec4
MD5 c78092c63c50875e956d6e2b60ed91d7
SHA1 cc5b3c86675cedd0a5d14d5b2fb4737203462e8a
SHA512 2e4ab0d95ae94924781dbead3c5608d6f28919f2b2e11a897447e096dd56a0731c77569f1c36e93c81c46de49d7bcc7d3e695198951a4e3409b08cb1bac7786e
SSDEEP 49152:zCcsA9n/TDbXNKdj05w8t5GN/AxsMRqhbA9n/TDbXNKd:znfb9sA5w8tANYiMRqhwfb9s
TLSH
T1AAE5231967F408F9CE5B0178C8B19A09DA33BC4597A0D79B0394A6394F337D89D3EB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.8MB
SHA256 3b643d7e936f3189010414fe5a01e74857cb6795ca1f98cdd4cb2ac99c3f298d
MD5 9bbfae706259f856c52e973e520f7e79
SHA1 9883e746341a170b5a07554e6ff68960ad24c737
SHA512 fa941eb2a11fc9c1a335a2579d77f2912dba85a72ae63e71ac7d8d43757f89aaeda6e89d393a45b69d65d4c1347753e76da722cf1182bdd44432f74b8014b474
SSDEEP 49152:ZAMJFoiq5YA9n/TDbXNKd405w8t5GN/AxsMRqh:pqPfb9sN5w8tANYiMRqh
TLSH
T16B95D081E7F945D4F5B3AA7899B69574EA72BCAA5E30C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 9fea5cea968e9b14f22acac16ef3a18376d0231985269443f68f6bcab6e1e9d2
MD5 a0c4381c1301aa63f5da743f06bd6123
SHA1 ad856055346f54101cc41cef34ecc3d04ae6abd8
SHA512 fb5016a15bfb85ad1d4167a8f8ee204317238c8696a72e997be48a5d726efa2d5ba4dc6be8b1585879f55989f3c4e30ba1604d461be4b63f0aac0dd885c881d2
SSDEEP 12288:jmw5HEjsChNzBFgl0WDm+CiBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dh:iwuSOWzUeA9n/TM4NZYeNm+9MhUwd
TLSH
T13B85F14637E80CF9DAA742398597D535EBF2BC062A25C71F0760C61B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 7.9MB
SHA256 af90f06462b7d03a9015b65f08ddf121be62d284565bbaea206e61df9ce11400
MD5 e2ffd5e55925599a9e99b4e7fdeb2b48
SHA1 2a9f16bb34ca71bac35aa88423ae71b9602d1e55
SHA512 5af870c43836bd1d49d4b317f3cf26e81ac47dff34fa1a8ec60e8062918438962fc9c0f639738ff26d72adea04debbaccdf53160556294fa0053d932ddfad53e
SSDEEP 98304:qQRQyi36YOcPELvw2gAf+PN3Wfb9sz5w8tANYiMRqhwfb9s:BQyiKaGX+PNU9+5w8hJc09
TLSH
T176868D43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 7.9MB
SHA256 89afbb0e2cca4e883738a2fe77d6d3c07223410e40599e6c2df24352414c188a
MD5 28320dcd70cda3179e2dd81ac8744991
SHA1 f226c9e9cbea8dcf5c96bc7278dec2b56632c098
SHA512 2271ec1535585c6e9ff540cf2ce2ba4aec33868535080e88dbd7aa25a6aa5d064572a8384df7848564d2d8c4caf676f938158b06274259356153c08c1a7f650c
SSDEEP 98304:pQRQyi36YOcPELvw2gAf+PN3Wfb9sn5w8tANYiMRqhwfb9s:AQyiKaGX+PNU9u5w8hJc09
TLSH
T15F868D43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.6MB
SHA256 9cd1782b8d5152734bbfda10b0399a0d5535edd53f7f8702ee7daf05f4d6fa69
MD5 609e3129c8e0cd852c32a4d6fe370c56
SHA1 5badb212bd7e40463659a474e2bf95b8118ddcc6
SHA512 ae5f54a3586f506b30465498fa53a456d2b3f3ea707c600e4bfc7b5d05e89ae59d6cd509ca3a2890c8504a7c556dd7e01a2d9785f9f6ef5bd3b66ecb9995ac76
SSDEEP 49152:Q68Qg55nhSeWu7PNU3/LA9n/TDbXNKdG05w8t5GN/AxsMRqhbA9n/TDbXNKd:KthVRc/gfb9sX5w8tANYiMRqhwfb9s
TLSH
T13F06AD33B2F600A9C44DD1769F4A972196D27C758FE0E3DB8505721A1BB2AD07B3A70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.3MB
SHA256 6488f9b353b7241ac868b79e2e91c8e09372357a548278cc19060654529730ae
MD5 7627a731def09fb868d46aa8b8ba2fc3
SHA1 4a5e43094f90d111769363627cb818c416423f48
SHA512 415a6da7c845448828e871e29c96fa38ea85f6908b7af9635d062ddc7e6df408ece25d45af6cc1a4eb2e687604ddd824594f657daf25f2d23d795f864c2dbdc8
SSDEEP 98304:cy5112gYy5azzVvf69nLKnhZnfb9sn5w8tANYiMRqhwfb9s:dLIHSWhN9S5w8hJc09
TLSH
T17046AD13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8d5505492b1fb2f9e35b0e3c00d29b4691773b5e406e4294d6d83e26550aaee1
MD5 3c5e13a9ef0afc82d0253448facaa5e6
SHA1 e4c23905acf837a4319af725e610c867dd6ce7c6
SHA512 6922105f5b68341f7ff33276b537d9a8c4c0d54d66d0e5d2979c04052e8fbb0b1a253f1fd5525fd6d556dbeb56d1ce3b6053fd2c3e8c74c6711a09311dbb1621
SSDEEP 49152:FB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gltA9n/TDbXNKd:ru6JmVxd2d+fb9s
TLSH
T1F7D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.5MB
SHA256 8190c31793c3f97b81137bdfe469acd8419122070f67e2e325ce63febfdb8cd4
MD5 b71fe2ec0bd470f184a7f701c5c7695a
SHA1 f95c8d7fe2d8beefe89c6f2a029150549b9b3074
SHA512 892a257a05ac93b798f3e4c9400353e04b99cdace34712db141128679c2f35f78d39f48e3c4def618818f27da3ff7d4df34c810e1d64d0b8f10d0ea2ab240fd9
SSDEEP 49152:91hpsNoJpF1A6tU44CwH7R4xJA9n/TDbXNKdT05w8t5GN/AxsMRqhbA9n/TDbXNs:9mifPgRdfb9sw5w8tANYiMRqhwfb9s
TLSH
T127F5E013F2D800E8D05EC17887569636EA62BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 3.7MB
SHA256 8de7c3415454db479d6fc4274d7cd8bb8e3ead441779215f9e342b6a8d6fdceb
MD5 21c3668f8921d2084ce1b7fc3b6a314e
SHA1 ae51fde846c2eef8b779fcd16be6e9fbf9407275
SHA512 f1e4149fcef9067ac076071e705ab23ed3e3cdff2b2ac8d9642e8ce4bd27ab55a24e2a881d7624c70249776ae61caf098de4a542c7fd8f32db4c44324a935f25
SSDEEP 49152:xSuZQIY0Be2KWRVtOnks6NMHqCA9n/TDbXNKdC05w8t5GN/AxsMRqhbA9n/TDbXq:f5dKEi61Dfb9sz5w8tANYiMRqhwfb9s
TLSH
T1B906E003F2E940E8E0BED67487659636EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.3MB
SHA256 b2cf62b46ba6fae1531921608f69080d1d0762fdf1de1338e163a505a2160dbb
MD5 865537b632c9bccb6fa126bdcd5fcb69
SHA1 2a65651eaa9d6bf01ef70d143645f90807b7029f
SHA512 b6732e1affa19e09aacfd70e942212fbfb005f906107df6727a8c3ffd32ce7c0d1ad090731e4be7722d2b26f27b099f0ea4c14bf0e4569f02e9d34bc1bd4f14a
SSDEEP 98304:YX2i/phxfb9sJDZ8kBYk7nsiga/tLfb9s:M2i/p96qkkN6tn9
TLSH
T118F5E013F2D901E8D05ED178C7569632EA62BC060B34B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 2.2MB
SHA256 2401c1f1ff6f962147b1b427acd034061600afc35c23d2da9fc6042ba98f8185
MD5 2c92cba696803f31f4f9d47ebc3b5096
SHA1 e01c66bfe0445492e4a8ec9e73ffd00ecc141ff9
SHA512 1f404028b8cf0d3cc161be934a82f066163a0e6747dd968afeae7d9bf953955ec891a53edd5b27fd85df35fc8cca7ed061a2bd76b32f7552d28e9f3f31dee545
SSDEEP 49152:AA9n/TDbXNKdXDZ8PsBYk7ix2sicNa/6KLTt:lfb9sXDZ8kBYk7nsiga/t
TLSH
T1A9B533414BFC4AE4C68A85758297BF0CD55DBE8DBB2021BE855F701EAB38489C5237CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 2.2MB
SHA256 297d1441ed68f24f6c2da6698561b163893af0fd84b59aaebff8bc24e3d706da
MD5 d66a9700bf84372650eaefc60f360db8
SHA1 a8e5e80458a4caf6545fd25fc5a64b30a98580d6
SHA512 5b86a2fa6911c26e0ff483da2ba16747aec32f61bc3f6cf9bc75ed5d4f44405cee5ed03053a42c475a79cbfd865bf50b366c0fab3567b38681ff6c778f796497
SSDEEP 49152:WA9n/TDbXNKdlDZ8PsBYk7ix2sicNa/6KLTt:vfb9slDZ8kBYk7nsiga/t
TLSH
T120B533414BFC0AE4C68985758297BB0CD95DFE8DBB6021BE855FB01EAB38489C5137CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 2.2MB
SHA256 8f5ae08fe7bdeb06ca47cc286590cf6e5cf408c665ab1b874b71fd0647829a08
MD5 dafd561b0019d6bed469f63f22593812
SHA1 5078ec1a7b1009c7053ec93c597b947a64a93819
SHA512 5df49409d536da6b90ce3fb0ce2d40a3282cf080c8d14b5521067c30b850b743dd0eb49d8d05d961e7359d57628dec69c9fab02b2c0d45cc73be32f6c64a4b41
SSDEEP 49152:1A9n/TDbXNKd9DZ8PsBYk7ix2sicNa/6KLTt:2fb9s9DZ8kBYk7nsiga/t
TLSH
T10DB533414BFC4AE4C68A85758297BB0CD95DFE8DBB2021BEC55F701AAB38489C5137CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 2.2MB
SHA256 fd6b4228b42a0c2d692c399e2429171480ad24f366dd17738d02063992452b7a
MD5 52189541aa7497d9a27ef624653128c4
SHA1 97b7c509400ae81d78c775c08d3bc6601a267b10
SHA512 ceffd49274d63bd92d53bfbede080b4ec6c42ca6253854696ed524b71707b9455401cdcbe111424c6ddbf9a0830004cce3e91fd8aeded63ea962575bce4bc7b5
SSDEEP 49152:eA9n/TDbXNKdpDZ8PsBYk7ix2sicNa/6KLTt6:Hfb9spDZ8kBYk7nsiga/t8
TLSH
T16BB533410BFD09E4C68AC175C1A7FB08D6A9FD8CAB30667FC65A641E5F34289C9227CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 2.2MB
SHA256 41dec4be5b18d7f0b58f5a693485ab5c609d44261a05aa237b42d459588589ba
MD5 9f8bc9321e1701511205ece3d6790735
SHA1 a1de06a194c9db23800b02b6fb3daa0c029f1e00
SHA512 355473815575e5a1eef275cc268e23d40b388ed1d65f80ce2ecd884309092e3af01abec3b4126f2c76b14b671c0c46bd9b0501a726dd474022d11bf3af687fa1
SSDEEP 49152:tA9n/TDbXNKdiDZ8PsBYk7ix2sicNa/6KLTt:+fb9siDZ8kBYk7nsiga/t
TLSH
T18EB533414BFD4AE4C68A85758297BB0CD95DBE8DBB2021BEC55F701EAB38089C5137CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 2.2MB
SHA256 ab55407b1dd4eda77e92e464335f931dd01b542d0a1c77a85cfdf930e9f817c6
MD5 419e7bfd408dff2e50dfcfe5fae826a5
SHA1 bee6f1705e37be03abf19276c27b5bbee6274cb7
SHA512 29e283166f38e85c11eaa1eb919b5a66ed6245589cde5bb4eec183cddc9c806de9943cf3b2b7185dcf38bc2e9dc4ec2ff8c2365f08327790193b9e31285dfa03
SSDEEP 49152:/A9n/TDbXNKdaDZ8PsBYk7ix2sicNa/6KLTt:8fb9saDZ8kBYk7nsiga/t
TLSH
T1A8B533414BFC0AE4C68A85758297BB0CD95DFE8DBB6021BE855F701EAB38489C5137CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 2.2MB
SHA256 0032db01f5e949f19d8cac02064b6b7766f873cfab87c67d879c504aa3d99843
MD5 a4117a441e0f6b51695186b73a80d43e
SHA1 0889dd6cb45c1b613c8cdba6afeb79f34876bb21
SHA512 24e258f2b2c3c38cbaee754b6e2ec9508e26a758e32292bc6f4ec4564132241ecb35e9e673485318a81206b9e572b153ca22923f90a3d3088ded1876dd6c5cb7
SSDEEP 49152:mA9n/TDbXNKduDZ8PsBYk7ix2sicNa/6KLTt:/fb9suDZ8kBYk7nsiga/t
TLSH
T13FB533414BFC4AE4C68A85758297FB0CD55DBE8DBB2021BEC55FB01AAB38489C5137CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 3.0MB
SHA256 0a431aa9c4c9a395ce4f6f48185e921e9088418e37a7dec6fb36c05434b60b42
MD5 c91826552d0dc8e9024bd5a9be178a19
SHA1 d1a56632f49e25eeed58e919310c4e42acfe4fa4
SHA512 8fab24367ef362887547683f54b6d60b06f53fe1703214fa091410ee94cabdf17203986949c24990af3f438ec8d1b37043c7e8bbd651f726e734d4dff3fedda2
SSDEEP 49152:VZMCz3lA9n/TDbXNKd6DZ8PsBYk7ix2sicNa/6KLTtoA9n/TDbXNKd:Fz3mfb9s6DZ8kBYk7nsiga/tLfb9s
TLSH
T1E3E5239163B40CF4CD57813EC956AE08D6B2BC4D5B60C62F03A9362B5F373914D2AB9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 2.2MB
SHA256 8baac765d3b5bc7592eba071de61d3bb998b260312c7c89a386a57f311030914
MD5 7923e6b68258d407ef4c198a47350615
SHA1 f6d83014395f90362c11021d41e997d3263d2973
SHA512 acc978b35e27be05fe29b54d1092f623659430501825cc3e0addc4ad255d4d6331c45ef9e00684083c5a0d1fa220c6063b4578a1800aa0a58cfe48a6099a7285
SSDEEP 49152:eA9n/TDbXNKdlDZ8PsBYk7ix2sicNa/6KLTt:Hfb9slDZ8kBYk7nsiga/t
TLSH
T1CEB533414BBC0AE4C68A85758297BF0CD95DBE8DBB6021BEC55F701EAB38489C5133CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 2.2MB
SHA256 a85c25a641bde37aa21c4a425480a4532f35fa781e46a2e537238ea9cdd2409d
MD5 8ce6c4c45a9bda98559863217516d3f4
SHA1 8eace45f31a2baddedb32048a296f70c96486363
SHA512 d6c9312eb9635046b87f193c66ddef1feb1637329672ecba037d3526182462ce7ef7f16a6ad0b63ddae72c23be7f39850a141d0d91952d471ee56954f452acd4
SSDEEP 49152:SA9n/TDbXNKdYDZ8PsBYk7ix2sicNa/6KLTt:Tfb9sYDZ8kBYk7nsiga/t
TLSH
T174B533414BFC4AE4C68985758297BB0CD95DFE8DBB2021BEC55FB01A6B38489C5137CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 2.9MB
SHA256 0c540f280a1337ff4e8857c066789c25a552faa4e956450ff7018d770d15e090
MD5 a39e6bcffc24dc3691a8a54d9e866b88
SHA1 a3eb9cf4a31a7c195b868ee4b22dab7349c9f468
SHA512 24acfd2eb095ece48dd4c1f2732c343d2a9d1cfc7cad20c829c8e889b69850ea4948ec34e5c8a2cda64d94e7038a804e7cf142d18939453194c00c74119e668a
SSDEEP 49152:i0A9n/TDbXNKdFDZ8PsBYk7ix2sicNa/6KLTtoA9n/TDbXNKd:iRfb9sFDZ8kBYk7nsiga/tLfb9s
TLSH
T142D5234317F810F8C24B4239C5A26F08E776BC6A67209B7F4359663B6F36281CD27799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 2.2MB
SHA256 723e44a8a686fd6e525bdcead835654e7ec86ea80a89dc0c4a719fee31e167ed
MD5 e216b88d89676469383508cc94e5ed38
SHA1 c9d92d80fae57611a98c2009327f5a1953f2b2f7
SHA512 49a8987314a5f2788d13d1f6b988efbe776af68fb814f83fbfb4c94bdb69a802ed2a926e8d59e4cac649a93f2adfa05d402fc7bb59429988b84e6b8acf37bf90
SSDEEP 49152:wA9n/TDbXNKdIDZ8PsBYk7ix2sicNa/6KLTt:Vfb9sIDZ8kBYk7nsiga/t
TLSH
T185B533414BFC4AE4C68A85758297BB0CD95DBE8DBB2021BEC55F701EAB38489C5137CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a5e96af713d7fb6c61d8245478086169ba8d0ec4258381477c4eda2ed82354b9
MD5 8d08a0c3f349c63ca743c05ff4565d2c
SHA1 fd7f61e9d4c64d18b5a64a0db573e9e451fc472b
SHA512 bdd96879322a328014bfa8b09a6cf6747f3ea63d5c7c5a32179a734483b17f5c8b9ad3e7986b58a5307fb16ea083a57f22128123d583832ce387a1ccfb1e1bcd
SSDEEP 12288:qQBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d8:qQUeA9n/TM4NZYeNm+9MhUwd
TLSH
T19A6523824FFC09F5C74A06B581A57B0CCD92BD4FF686439E470E722A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 c876999bbd6f988e4b22263c459f9a4a31e4dc68a8221561a8b9c00292756712
MD5 c0a51f7f1ab852d818053a09840e99cd
SHA1 f76d6236cdbc5e5ab0d4b3a5b38e34c32ccd1736
SHA512 08975c0b289d86385e8400815298d6f457e2dbf92f99394c000b699fef7759a7b5b195c94f337d18fd60a168e625d4bb4f853a8d0524b690f6bc742a2b22f7e9
SSDEEP 12288:zyPz5L83BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2di:+zy3UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D275024777B420F9C2664239C8A21B05F772BC3A57608BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 dc4083a66efccbf5bb1e5b89d9bb34a9577e5a77e67bb9926086074d94dbc1ef
MD5 dd67ac2036d90d6eaca6eac8eac179bd
SHA1 65a27bf9065a0eda9b5daa441fb3e97405661dc4
SHA512 ce92abc14b14f55c92f06d66496812841153c3bc7b4b731de88d75a7813ee375b1a665e11838af5b2c7eb69fd1f1d1492a15c7998d6438113f656fc7386196ed
SSDEEP 24576:HTdaLl3z0zDVUeA9n/TM4NZYeNm+9MhUwd:HTwLlj8A9n/TDbXNKd
TLSH
T11C850295B3A00CF8DD67423EC8659A05D6B27C5A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 8492493fb46e3ab64179cc97fa2991c9f6b8aaeca1ed5fa824451e0c27e9885b
MD5 1c8ae5e487340c01408fb26a77a9761a
SHA1 6c080eb36392154fc081b5973a5478386a4b1764
SHA512 44e89f5f64b4ffb26793c9f1a20762c1d264326cc901e4e4195f0ddccb68fdc7917fe7da8eeedf747c1902b011d4e39a76505db8a1301f873bb406795947fac0
SSDEEP 24576:035d9CHKy7GZpUeA9n/TM4NZYeNm+9MhUwd:+5d9CHKyajA9n/TDbXNKd
TLSH
T1AD95CF90F3E814E8F1B79A35C9765501DAB67C5A5B31CA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 903d381d4b19293e7b4db195f7ba9c6ae43e7e3173eaa28314b4b827f91975cf
MD5 5cc8b1a8a979e3db065e481ac2de2cab
SHA1 f8245dc46664b2e02a6bbbbd8be874c73b3005d8
SHA512 8f8d799b128d915ce93cbc11d36bcb95db658303afea0449c1cb9f427d95eeadc9bd91b0bea7b2db6928947c0492dff660dfba994fc11a53590be5b4887f7844
SSDEEP 12288:+FBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dO:+FUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1FF6523824FFC09F5C74A0AB580A67B0CCDA2BD4FF685439E470D712A5B385D6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 994ae4ea581c78178f4a2213a3447822afa6549a9c7baf3b74d70235524e68dc
MD5 0fb96262acc9bf8316518534fb4ffcd9
SHA1 6bdeda4a6684041b3ce2559037ddc12e6b159613
SHA512 3da6c687242a20ff58448db7ca4cbcf496f9f3b60d15902757ce4b7bdccb216817ec6b278de9bf66769579eca7233f6839faabaa9865021956883e8a0625f934
SSDEEP 12288:ZXBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dm:ZXUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17E6523824FFC09F5C74A06B540AA7B0CCD92BE4FF696439E471D712A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 ac3d07ec0f4ae72e080830a3811a3d46040fbe0185d6381cd8f7aa813a384a5d
MD5 f84185d5277d276236020f02d210cdf7
SHA1 d8c24405a8d6ba42bec65d500ae11baf409b1435
SHA512 890eae781e6d94cea7f4c61ad70708d48e773368051446bae92ec1b884219ffe7f6d3211fba1f4a0beaedb4d566fbd61fdc159e19415d256b148c3ff8961214a
SSDEEP 12288:fqBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2di:fqUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D16523824FFC09F5C74906B581A57B0CCD91BD4FF686839E471E722A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 16c6923a650f6fa674924ac7b38e90c4c2585b038f4817d88b071a2e37b24683
MD5 b4f4d34a9d2da12ef07aa94b60ca1fac
SHA1 83c1176f63d63952ffd47de2fc939dbd2cd6b3df
SHA512 31e4b2f08d392efd2109a58db16bfb7d288d2a7b88a338f7c6c0f9b5d1cc3e4c38c73344e7e011dcde802d87df2d6887e2e1472dad087eb4b10fe88987530e4c
SSDEEP 12288:7QBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2db:7QUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1776523824FFC09F5C74A06B581A57B0CCD92BD4FF686439E871E722A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 c85a55871af0bc8b6b13150f66196b47303757bacb547a6be1382b6199f95d91
MD5 b8892656275bd8d8acb9026b2c165d3f
SHA1 65faa35ad7f730b821672ae0c7c3f083cd89f4ed
SHA512 5cc3314e1bbdd5fbeed488d64f9f2b097c028243a8502c21a3e6efccf9ee5c6709d8ae8fec08fa5a564c0f8f32f27c352c64d40cd62c67b7bc2cdb512c9ec9de
SSDEEP 12288:MFBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dj:MFUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1AD6523824FFC09F5C7490AB581A67B0CCDA2BD4FF685439E470D712A5B385D6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 b870df844e68520ccff50241983310416d8c928e9a4cef2636387ba3686d8dc0
MD5 7f99cdab396c3f08e3f4d6c008355f76
SHA1 1b61c964d5140c830ed4d013bc46931321c100b6
SHA512 04e63658cffb89f2ffc6accff8f12e483cc7f723c7e6caaf3422d655221cc83da2a6a31344a0444e8ba0e0c8078c0a1aef6adf86dc036a21fbd82d74a9265f5b
SSDEEP 12288:RYBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dD:RYUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1706523824FFC09F5C74A06B581A67B0CCD91BE4FF686839E471E722A5F385C6C91648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 04d30f02799d62e0194505aacd0d9e59ac0d75dbba71ebf832be7d96cf5972cb
MD5 893d56077bd19512efc6a35ff0a57b14
SHA1 72f6812efd2a000d905d13202061c304e257ef74
SHA512 8e74a335c2a83ae5ae2f6cd45279e95d6ad15bebf7dfcf79dba16ce894555d8ea6a9b9decd3f8d273c7d1711db76f4360e856b81199f62f04c3bae1a291f4f77
SSDEEP 49152:PMnYIeA9n/TDbXNKd505w8t5GN/AxsMRqh:kRfb9sy5w8tANYiMRqh
TLSH
T141D5012AEBDC44E5D1B7813C89B74A0AF6B278591B71C2CF029A536D0E33ED4AD39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 8923c32fa8aa732dd08b44ead89913854abc9b24ea6217565f8c8a2ac1a21cee
MD5 5b0fdd65c14198b82e08ec9c1563c271
SHA1 60f6cf022168182726c2a5cdc3ec0e5ae028ceeb
SHA512 15fe3bb07a84a4d9ee792d1c16f2deab84a81bf44b0fe368e77ed70d988cff4c3d5d6e24d7207187acc044cdcb2b4f5619157c72c5b2ad36c2f56795786d726c
SSDEEP 49152:gYaZNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dA9n/TDbXNKdV:0ySzP2fb9sC5w8tANYiMRqh
TLSH
T134269E97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 ebaec5df449753183f6da0e91abd8adcb677af7819b826b9a5b18190665bcf7e
MD5 4472a2dc09c8455a56e1aebd37117807
SHA1 42ad7f164b7920f9cbdef577e2c0a09f9a233561
SHA512 05b4cf5039982f2670cbe075a536d4cc51ffc79747934dec89c23cd9dfc5c69a9bcecbf806efa9bff78f8ff70388e80b3359d668e00eabcc66393aa799c0d4b4
SSDEEP 49152:9p7JUQj7irIhCnDHUPfF/tA9n/TDbXNKdA05w8t5GN/AxsMRqh:LJ5glD0Pkfb9s15w8tANYiMRqh
TLSH
T12BB5D01EA3EC01E5D1BA827885154A5AEA71782E2F31CACF1270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.3MB
SHA256 b5ee532676bcb85be231cb3d8c00e07323d5e5111aacfc2f933055e084bb8e15
MD5 f71d11bdbf2ef08375385c7674dc329f
SHA1 6d441b7d136660915520d321d82ce0d92ebc6c47
SHA512 d150eb132f09f61a252ed5530b0bfa25e1f3e1d6a2d6c96c9d1d94c8bff9c58773d5f1263ed32dd1feeb5a1871cc9b6e4727935f2485fb339e37f75846458a37
SSDEEP 24576:YAUeA9n/TM4NZYeNm+9MhUwdc205l62Rao5D0mUD5/Axzi9IrRefq6/:9A9n/TDbXNKdr05w8t5GN/AxsMRqh
TLSH
T12DB5124AD2A801E8C15E1174C7665A88BB337C56A7E0D3CB47C0F63E0F766D0ADEA647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 8617a6cfbf24df83626fac980eabc58ed1f9cdbc82ea16c2e211dc4e90c43221
MD5 12e586b8fb16ee56119f22200d382b99
SHA1 331c7844796f80d361b0d8d883b68478765c262a
SHA512 11000e49393d24ceb12529da3eecbd509e1389761b62efca04ce32a5cc9b2ba6950d48f968dd595a38ed8a3ce9d6b7a1f9cd698049275b645d41c5b9a0c1f76d
SSDEEP 24576:LfxUZUPcMP9NbgZ71vstWRM9/2nnR1v4mqyxq0:CZUEGbU1UwRMEnvv/qyxr
TLSH
T13B4528007226DB8FC6A940325E36D6CCA7707D42EE046F1773C9973F9476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 ee890613390e5c55bb2e125798e45d2f976c8a0382b499b360d9e0d10667e170
MD5 8251a8f59ae97441dab9272af345f7d0
SHA1 f91b6ab1c5bc881c42840e098bc231f81e851897
SHA512 3aebe3f68f48952d3f8d67e8f051dfe133d9068834360bbd7e96c0b7b86b12b87798b8ccbe9d9c6f525e730e51d7f8ef2f027544adaecf652d3d9e13c452201a
SSDEEP 12288:bPhZeHQArhgXga2GjtZzg2G1GeBaf6yjc5cjOU5pA5GMo0D47WKlUM:bPhD4uwT4iBafiAAED08WCUM
TLSH
T12A451800A5B7EB4FC97A9037473686CDBB785C07F6452F053345883C986A96FB6E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 2fab47d1ee16baccaae6080a2a0dad33884674671e324c00e53bf417da1f0f04
MD5 41e1c1d9f5ce383ca1faa7ffd98c7c25
SHA1 e0ba50b4bdf5b9e034407f1c1793f00c76e91ef6
SHA512 1d0e823238586ec527a9070c55fa905e4f9880208a152231e5b3cdf6099036aad86a6e375acee6a95bfc91d73db50dce7f3029627e032f3648edc89be3515521
SSDEEP 12288:cO7IBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dPd:3IUeA9n/TM4NZYeNm+9MhUwd1
TLSH
T1226523824BFC0CF5C75E16B440AAB7089E56FE5DEB4083DF8209722A6A345C6CE7654F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 80a3a5ba37c95f4de763eaf6210265805b17272ba7842a2bbddbe7b9e7aacd60
MD5 c3c0e81fd5dac03a6922790a8bfba2dc
SHA1 f56576d7ed2ff5f7c2eaed230ab794a1d02eeeac
SHA512 07d9b4b3d3506565ff7100f943116f6c7c36f5f5da0e815927305389949ef363c2bd14423e74d72e634e74d784a4117913a45acbb2738643576a93e9dbba57ce
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYCUeA9n/TM4NZYeNm+9MhUwd:Xgb4mBIBhGFPA9n/TDbXNKd
TLSH
T1B165AE1E22EC02F5E1F9D2B88DAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 2d3c83f3c26d3e6b2e6a11cd6fc042f694b76d938699de728533a7183d29ea90
MD5 2de0688ccb88427a67778b5c13d34b31
SHA1 6598de0fca30a28f4865ec893565659192284739
SHA512 3136ae2d1fdefe84a45b880a5539dd6c54e5b9ef15cd05cc890ff47af26cb2caff4856dffd0474f0fc604472efc853e0a8892223a00e908c8fa34531b52db962
SSDEEP 24576:gGQ205l62Rao5D0mUD5/Axzi9IrRefq6/:gGH05w8t5GN/AxsMRqh
TLSH
T16405236E20F69498C43A057099350DDF7D3239A177A066EF49C1A7388FD2BF0B5B4E86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 bf57a5f6a36b393559b31ab4193c1eaac4f50661adba7633894558b8ab0afc84
MD5 d0f6f184f597b750e8ef4026e26b2e05
SHA1 5551c856a73fbf86f018ae52a38856d4427411db
SHA512 2036950f56192103b15911b26f2f93a15eecbb78ff1616c97489785c5aeaa985b5997f1e7d208cc6e45ab045aaa0cd859f8a11565a60777d44b2270060ae84c2
SSDEEP 24576:vG88u8FpJqH1hzria7/m7UeA9n/TM4NZYeNm+9MhUwd:e7ZFPqVoa7/EA9n/TDbXNKd
TLSH
T18095016567E401F0C47BD13889864663F6B2B8251364EBDF07AC8B561F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 7c5658547688c4470e9e55b8260683db7b4906d899cf2e6808fe93a0f483f32f
MD5 38f0a269139e0f7b256551f71fd681e5
SHA1 1bd2e46d15de6b1c8de6b1250f33a51e9b6a30b9
SHA512 a6be3b972fac1f6c90137d159acec3926efa2157b9925d46840de813f09ec692440b82e24b33d26b4efa74d3101794a3dff23f1433d1c616a727b9f53851a661
SSDEEP 12288:4HvUrBFrEjwaQvBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2de:4PUr+NQvUeA9n/TM4NZYeNm+9MhUwd
TLSH
T19F85E11F26EC08E5E67AA17D8586870DE772B8561312D2CF0290817E4F37ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 75a0ff881bd9f9f7514f728fd39ebd7b8dea9af15effa2d3a2c04911369894a6
MD5 35ca83d987b41d05c3dc2a2606ef1e72
SHA1 77f6b9dcaaa3b1b6928db613d92d56133f556109
SHA512 6262dfadd35965bbf5d3f19b658edb717eb03f78006aca759c435c4ea049ff04a8065cc8c49d6678fb8d41b73e706a66e21108b33ff1ad63e11b260edda6914b
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTA9n/TDbXNKd:FG05lO43bffb9s
TLSH
T18AD5C06A62EC01F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 be901cdf610b345286fcde9cc75e805a2aa132e44e027885315e602dc45e384d
MD5 77b6dbe9166066d8d8fc30a9cad208cf
SHA1 fa2c60f696e7740f94ad5a11f660f3af88797d54
SHA512 a279f5cac7f1ddf0547491ecf8b53a9bd7e850923a2ee8a6e4eafe0178eabc3afbbc6f03d614225555b0adb30c50b5ced68cb4f7e890b2d02a913e0b7eda319a
SSDEEP 24576:Ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnRUeA9n/TM4NZYeNm+9MhUwd:wa5POZ3+Jt2pasx2+mLA9n/TDbXNKd
TLSH
T17865AF5EA7FC01D5D5B9D17DC583460AE5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0b7b3566cc7c7be316a5eae7b9d0a4e2bf30f8e008c8293a8ac629895bd0ff9b
MD5 78b53f3c49ea78a51db1323f1782d047
SHA1 26a21486fde53fb201a0b66ca3266445a10f0f85
SHA512 ff90d01135c0a49ff55a0cefe373a2a191bd508618731de54abd59d440dfbed24df41058bc24fcd2a787719a06ff12eff22d5067c76475594cb7686734f034b7
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkTUeA9n/TM4NZYeNm+9MhUwd:KNc/zEOVHFkA9n/TDbXNKd
TLSH
T1C1858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 25d12cf648eef1c37d4d9df24f9b9e6cdafe6c5375e6e5a0e0519d7584259301
MD5 bcf805c390ea71f82a035fd9f09136f4
SHA1 26a23fa3fd12778d03805dab957d3138753ab562
SHA512 f02ed99bbd83e30b50fb60a8afb7c9c3655c031c6bd3a91d92b50a5b4ac28254b7673bb8d802a134f14f4da238892b7205d83d88270932b03a5927ec4f53a23f
SSDEEP 24576:U6DIk205l62Rao5D0mUD5/Axzi9IrRefq6/:U6DIj05w8t5GN/AxsMRqh
TLSH
T19A25025D33BA00F9D06B8039C693054AD672B4B197615ADF0AD4C67D8EE3FD8B938E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 a4e562fdd58e846f82ac538854734ac53917c45e3a5d0c382538df5bbc2aa327
MD5 21f44e087a5ec9c2cad79c95cbc4a59e
SHA1 c26ef3a02e6b5799138e047a7011410353a2a922
SHA512 4b07fd0150bac9313ffedfa04e52b82a0503b3b344cfeda37030166aadc5f7c6b045d9d21934a6851e27d2566e33475e91453836a1564cf691fc66a943ac40af
SSDEEP 24576:AtyA205l62Rao5D0mUD5/Axzi9IrRefq6/:AtC05w8t5GN/AxsMRqh
TLSH
T12915220962E490D8D57A05309A3246DD9E36BC217BB093DF55C1EB3E5FB2BE0B870B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 3d987a98fe45f2b9185d784a033ec064aca8e3789ea2c3b5f77d2a909893620f
MD5 602ca2d3a4d6fa135c716f2bf814e073
SHA1 d56a04a3a63434cc733c39830f8eacde6bada1d1
SHA512 b3cc5e1a2d0f6d661503e541942b6b4646f2128ff5900c6b734a399b3e8ce6daac681f1b0ca80de0f249265dac0bee5e27522c11ee098213b5f3fe92a9b39b98
SSDEEP 24576:NY205l62Rao5D0mUD5/Axzi9IrRefq6/:Nf05w8t5GN/AxsMRqh
TLSH
T1D805235E60F68498C459097095390ECE59337AA27BF056EB59C1AB388ED3BF0B4F0E47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 d0a38652d99df8b87e3a510f8ca0a602a93fc25b305e84c1b600c056bde7c2ec
MD5 700746b2da95059f56c70978cc490a24
SHA1 df104f2089eac676836f83331a019c55bf5cd154
SHA512 39aac34ae092e3e8b31b837f012e13cc0fbe9b5c4aef5e960be6ff66edeb8a7878bcf43fa023a475f28d963265f809fb0a94fa533931339127b66460802d8371
SSDEEP 24576:l0gNLoTfaidZg205l62Rao5D0mUD5/Axzi9IrRefq6/:agiTrZX05w8t5GN/AxsMRqh
TLSH
T1B965AD1DA3EA05CAE2B2D675D8721493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 9e8f03eba536222e06285f9b954ac2c416c9ebf163b899183884ab0918d12c03
MD5 61edc686921605e5a308b535a051f553
SHA1 5c2d72bee9078718f5110799f5cf35b039734feb
SHA512 9157bc4cedd7ea42a2283a4757cd17f015ded5b18988c27c98db74f8cbb88b36ec1293e91cfc13b253df2f328c48be4410817a860baef22b027129b64219d38f
SSDEEP 49152:sgb4mBIBhGFPA9n/TDbXNKdE05w8t5GN/AxsMRqh:stxfb9sJ5w8tANYiMRqh
TLSH
T12EA5D01E22EC02F5E1F9D2B89DAA441BD6B278161731D2DF0151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 21aa834ee87e7ffd525c8e0be8783f0bc8bf114e639ba642fb423402ca0959b3
MD5 4cd2b64f9f8dafe674e03a7c00fed110
SHA1 92fcf36b38266160cd679b7c39ef905a64966588
SHA512 f43af44b4d895cf04fe6631efb5314d882a9a4238c8bcad4a01015c8c5f22f08d22ab321a9b71e468111a67665e0235c9fc218c8c8660ff1724ccc48109256c2
SSDEEP 49152:XDMwBtOm5A9n/TDbXNKdG05w8t5GN/AxsMRqh:TF6fb9sX5w8tANYiMRqh
TLSH
T1B5A5E06EBAF845E4D1FEC6B4CD238516EA727861173293CB4290C13E0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 455f31505176e84a29767cdb67b398ca9bbd5d51447352c2422fe7f7dd7edd28
MD5 d162a730b5fd9be3385ef61129ac5ad9
SHA1 7680d7b69674a633c896c2d6ba6f7189f87dec32
SHA512 7b5177a0b566d430072e26732d493fe7082f63b13a95582aca1a53f65d0338017852758a19a91511ed413bcf03c0e7fff6be31ccb59be1320605944ecdaf4523
SSDEEP 49152:qDVHeBIAAWA9n/TDbXNKdg05w8t5GN/AxsMRqh:Gfb9sV5w8tANYiMRqh
TLSH
T197C5026EE6AC04E4D57BC1BCC6634A0AE7723CA9032156CB029492795F6BFE47D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 268dec655b31fc4c23960b5e9452436830d2667267e70bc5cd39a318697cb751
MD5 fb36f8905bd82baf9050720d162ebdf7
SHA1 dda6092ff34791737803ee98428f35225af626fa
SHA512 7c7ba26a263a969a85759496a54fee3b0318fb9ba6329041bad7a0800b18ac8ed8c8fcfbe267f7d4027606786eaaed65dbcd33119ce8b99ad9bf1d34c1093764
SSDEEP 24576:DJnJPbzB4SG205l62Rao5D0mUD5/Axzi9IrRefq6/:DJnJv6Sx05w8t5GN/AxsMRqh
TLSH
T13F35E13DD2A810E8D4B7C2B4811A1B9AFE31386D2F2169C719B4D5343F52FE0A979F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 455c4fa18ddbc4e0aa024d8cc142a36368bcef158d98ef7c7866c0276bb70b2c
MD5 ae4cef9d2899352d0780f1d8ec9d321f
SHA1 24efa1e32c6f4512c54575a93c5f6ceaec5e119d
SHA512 f469b4f25e8c01bae20886964d17cc3a56c5d77226d0ff87b50390debbba173e631ecd582831b4cbd21267371964cff2794fb304544088c62d76667e77872e6c
SSDEEP 24576:2k205l62Rao5D0mUD5/Axzi9IrRefq6/:2j05w8t5GN/AxsMRqh
TLSH
T13F05235F60F6C499C55A0870A5360ECE1D236E527BF096D39986AB3889C3FF4B4F0687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 e97f9a641893cb8eddbc9bd367400e6929b7983ef2ba51d00fbe3ed2c8ceeb12
MD5 ff05bf4a9f33737ac843a8a598a13fd0
SHA1 2348c66fbcc6925db76e615db2a44c021a0e900b
SHA512 c1a6b3c25661e4ec54bd28a4cf7127e67c572097b409d4c48937cdf1660f808981b1209cc2d119050a37eb2e84a3baacf5fb3a5662011bf9333a538f3bb908f9
SSDEEP 24576:Y6Uqjpw205l62Rao5D0mUD5/Axzi9IrRefq6/:Y6UA05w8t5GN/AxsMRqh
TLSH
T10325235E21E454E8D03A0530D93546AE8532BC7227B096EF75C8973E8F72FE4A53AF12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 7ee2150ffa9b360eb2c2723177268877562163ee1a4d440db11df91786d94a21
MD5 8d357de5d4d6a236de37504fc7eba728
SHA1 db8404379b1d7d5d4a82292061f537b0fcdf58d4
SHA512 5fdcaff7e1daf175f51df92b9fa2aa2553fcd5e6d7080103ba05e7b5895bd84f2011a966210bbae365bd21d292f9d4762875df26f0776f1b24423cc8fe4217bf
SSDEEP 49152:BCLHGeeV5ijCmlDWDk505w8t5GN/AxsMRqh:445w8tANYiMRqh
TLSH
T121A57C05A7EB4184E8F3CAF5CA2694169A327C549B34F7DF4E80CA6A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 964KB
SHA256 712e1eb855be336887411842880c9c5d38782dec3b8425a76e7614d47feeb4d3
MD5 cfbbbc7d23783f393a83a178a66d6486
SHA1 4ea4495a2131499f06057e8958a3c1a5518427b3
SHA512 1e1cf40bb14eab304141542f4097cd3a397246548502549108a28d6e6cd577b90769f97706a968237b8eae456c0ed98d1d2f193f001ca955682893ac6130da89
SSDEEP 24576:IrcmRw205l62Rao5D0mUD5/Axzi9IrRefq6/:qcmRn05w8t5GN/AxsMRqh
TLSH
T1AA25014FB2AE00E5D1BB813CC9524A8AEA737431276167DF0291C73D4E97AE97D34B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 a93eb79c1c596b9821d6dd4d4125d5790a9b176218e5da4a38e04be70d6a49e4
MD5 585f73be0c68c4a4c26c1edf73493736
SHA1 cf5fc441a719411032a7f261a086f92606f54cb7
SHA512 e68c73feccf80ec5b468c950175fafa0a5bb95b1b83cca32ebf487a71c5157f40c309fde83807bf4f9037d87ce7e11b0088b9c8291ec84b2693cc09cf053e66b
SSDEEP 49152:mDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3L05w8t5GN/AxsMRqh:n3Upow8sB55w8tANYiMRqh
TLSH
T106B59D3DA2E800A8C9AAC379C54213A6EA71782D3F3055DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1720-60-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1720-47-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1720-54-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/1720-48-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/1720-57-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/1848-62-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1848-191-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1848-63-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1848-69-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2064-137-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2064-131-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2064-321-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2064-130-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2372-29-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2372-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2372-127-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2372-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2372-30-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2560-143-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2560-151-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2560-149-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2560-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2560-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3768-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3768-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3768-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3768-342-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4324-288-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4324-112-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4324-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4324-322-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4324-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4404-366-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4404-94-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4404-268-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4404-100-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4404-367-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4404-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4456-364-0x000001CE11520000-0x000001CE11768000-memory.dmp

Download

memory/5036-0-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5036-120-0x0000000004350000-0x00000000043B7000-memory.dmp

Download

memory/5036-115-0x0000000004350000-0x00000000043B7000-memory.dmp

Download

memory/5036-8-0x0000000000E20000-0x0000000000E87000-memory.dmp

Download

memory/5036-1-0x0000000000E20000-0x0000000000E87000-memory.dmp

Download

memory/5036-17-0x00000000030D0000-0x0000000003155000-memory.dmp

Download

memory/5036-9-0x0000000002E00000-0x0000000002F49000-memory.dmp

Download

memory/5036-77-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5036-487-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5036-10-0x00000000030D0000-0x0000000003155000-memory.dmp

Download

memory/5460-217-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5460-78-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5460-86-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5460-80-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5744-42-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5744-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5744-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5744-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5744-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5808-90-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5808-243-0x0000000000400000-0x0000000000577000-memory.dmp

Download