e1ebec2c212e198b0351abb296c3cd10b599404f8729aa0a0edb5ec90d060bc2

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 2.8MB
Sample260930-a6awpay13k
SHA256 e1ebec2c212e198b0351abb296c3cd10b599404f8729aa0a0edb5ec90d060bc2
MD5 556ef83347670990c107c1a773241e3a
SHA1 8534cfecb3add1141152d19c2e59a602020eb234
SHA512 0acfbed2ad7cc7a86607f0baf8f7bc603ad82a6a7075eb3641b0bd9b3613a1d92787914066e543c95df4d9a6ad5d956764601fbc977183379a2dbeb10663272a
SSDEEP 49152:prxRP9sg+B/V2j+JHhxSMmT8oWgBCaXIarSj8RoTCCQhxSMmT8oWgBCaX:p3MBV24+M4FHXIJTU+M4FHX
TLSH
T1BED5CF1277F99129F1F37B71EEB883645A77BCB5AD39C50E6280215E09B4A40DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5556	elevation_service.exe
1280	elevation_service.exe
4928	maintenanceservice.exe
5108	OSE.EXE
4724	PerceptionSimulationService.exe
5716	perfhost.exe
4544	ReFsDedupSvc.exe
4432	SensorDataService.exe
1664	ssh-agent.exe
3568	AgentService.exe
3400	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
	\??\F:\	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a2d2901531e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000009442-466.dat	upx
behavioral2/files/0x00010000000093ac-465.dat	upx
behavioral2/files/0x0001000000009952-467.dat	upx
behavioral2/files/0x0001000000009cfe-470.dat	upx
behavioral2/files/0x0001000000009b92-471.dat	upx
behavioral2/files/0x00010000000093eb-477.dat	upx
behavioral2/files/0x000100000000627a-484.dat	upx
behavioral2/files/0x000100000000bd44-483.dat	upx
behavioral2/files/0x000100000001ae4c-485.dat	upx
behavioral2/files/0x0003000000018985-505.dat	upx
behavioral2/files/0x0003000000018983-504.dat	upx
behavioral2/files/0x0003000000018981-503.dat	upx
behavioral2/files/0x0003000000018949-502.dat	upx
behavioral2/files/0x00030000000184c5-487.dat	upx
behavioral2/files/0x0001000000006223-482.dat	upx
behavioral2/files/0x000100000000a319-480.dat	upx
behavioral2/files/0x000100000000a304-479.dat	upx
behavioral2/files/0x000100000000a2c1-478.dat	upx
behavioral2/files/0x000100000000a1d4-476.dat	upx
behavioral2/files/0x000100000000a0ce-475.dat	upx
behavioral2/files/0x000100000000ba34-474.dat	upx
behavioral2/files/0x0001000000006215-472.dat	upx
behavioral2/files/0x0001000000009cd6-469.dat	upx
behavioral2/files/0x000100000001b99a-468.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaws.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c7164ca7550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009919ca907550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000443ab907550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fedb9b907550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045a7488f7550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5556	elevation_service.exe
5556	elevation_service.exe
5556	elevation_service.exe
5556	elevation_service.exe
5556	elevation_service.exe
5556	elevation_service.exe
5556	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe
1280	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	3568	AgentService.exe
Token: 33	3400	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3400	SearchIndexer.exe
Token: SeBackupPrivilege	4544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4544	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5556	elevation_service.exe
Token: SeDebugPrivilege	1280	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5060	2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 3976	3400	SearchIndexer.exe	103
PID 3400 wrote to memory of 4444	3400	SearchIndexer.exe	104
PID 3400 wrote to memory of 1996	3400	SearchIndexer.exe	105
PID 3400 wrote to memory of 3324	3400	SearchIndexer.exe	106
PID 3400 wrote to memory of 3032	3400	SearchIndexer.exe	108
PID 3400 wrote to memory of 5008	3400	SearchIndexer.exe	109
PID 3400 wrote to memory of 2508	3400	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_556ef83347670990c107c1a773241e3a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4928

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5108

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4724

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5716

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1664

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3324
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5008
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 77fb65a357e225d6eedc08cba90a1012a5103b50a0c36f975d93c2686e2c0369
MD5 1db77c856af9d72840cbd16166ebd18f
SHA1 baffdec7d0918aa1ee893df571cbc8385ad44256
SHA512 74981e34b5c4abdc76684f903368a5db1600d7cbd26efbe5676dac1f08805b65f78bfb204b476f873e42c3a61936bfe67010f462cd6652fd053d34c3d105ec0e
SSDEEP 49152:zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnfhxSMmT8oWgBCaX:R3q6HjBO+M4FHX
TLSH
T189D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 1a63c276b9b9cdeadda03c35b50126db27a7de1ba1f30b7e2fb92148dcfff1aa
MD5 ed21168d82c5f628023210b215f2a7ae
SHA1 0879d365106c5b406cd73fda8a3552b789c15b06
SHA512 e8d3fb2a648b1695fe05bb059a5c34a145291b6df11a852661b221bf822ca34a25d2ed080998f0d90892d0265c5b13675865d39226ed35449688796999a90edc
SSDEEP 24576:xXYfDtczALrKhxr+EHNmT8oW4ll1JCrLKXI:UtcthxSMmT8oWgBCaX
TLSH
T1D185F12877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 0323bdb5e99dd278c8cce3a0b421840e8142ca2c805eed8bbdfceb34ec367f72
MD5 340b67ff0eb913707b306a623e62879d
SHA1 b5fa8be3c4756fc33c954afd5acaf4c68650b4b0
SHA512 eababffcd322be5286dd04a07f013c69c5a05e3e0265679e9c516035858a5b96655d6b789a1a0c97fdbbb2c3eac0e34d3a8b15b8605fd582cafce4f9de8c5450
SSDEEP 49152:/kcthxSMmT8oWgBCaX4arSj8RoTCCRhxSMmT8oWgBCaX:/1+M4FHX4JTV+M4FHX
TLSH
T154E52339A78548F9EC2B833CDDA28505EA733C988351E75F47B49A681F336D8193EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 330e2019e428e6136ff8648f7c661c8ef31498443cfa33846c0f7ab7ffbaa6ec
MD5 657332741cbf4c7ccc1f731b848967a3
SHA1 f8b49bd9789d37c97a031ab1e3119b0063d3b8be
SHA512 783e7e2c33365d82b6287ee29203fc49cd1f0575e80b367111106556d6a4aec3a8a7d6683b46e6567731eb472f461eaeec8d9ce0840a68d144260b8c246688ba
SSDEEP 24576:ZwuSOWZrKhxr+EHNmT8oW4ll1JCrLKXI:Zw9OFhxSMmT8oWgBCaX
TLSH
T1B585F14677A91CF9E9678238C557C136F7F2BC052621DB2F1770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 2.8MB
SHA256 52f1d46eb881a98cbfdd1445cfea0f6131c91f039ed8c0dddc4ec220d7fafdd5
MD5 6a5738ae0b67bb267a0102bd492f97ca
SHA1 30ca7b0a2d72993429bf23d4b8366e4fce017d9f
SHA512 446d3ba634ccee89a2f40883b4545effc0ef8e7651af0a968da12f692b178d5d96fe23dd3a57d32b9a1357a880db113bf607b66ffd35c450ddbfe0bbac9a941c
SSDEEP 49152:RhxSMmT8oWgBCaXgarSj8RoTCCRhxSMmT8oWgBCaX:R+M4FHXgJTV+M4FHX
TLSH
T104D5237A6B8960F9DD274338EDB256059BA23D9CA31203CF4E751AAC2F36ED51D39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 7.9MB
SHA256 f1e728a2547cf59063e041cea80935c40475130f59f10452aab2c35174a686a1
MD5 83d9e02491d0976c1ad129d05b2aeedd
SHA1 b1c9e3547087d82020bdea4555663190de104e62
SHA512 532db0bda9f6a796ec42efdc415f67b319832dd73ca98b09815596ff12d252b5a1f4ee0b3b8229c1d59ef30e0b0c6b5f4292ad9b9b6b9c70c86fb4164f5a9e2e
SSDEEP 98304:rQRQyi36YOcPELvw2gAf+PN3i+M4FHXCJTV+M4FHX:aQyiKaGX+PNi48JZ4
TLSH
T1BD869D13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 7.9MB
SHA256 526d42d1d6e3684a23fcaa0f385cfa15a356158e1e0336f4a3b1262357928fc0
MD5 4d67c6c0b2edf081cd93a7b5a31c5277
SHA1 cd64e4ad0e85af3fdacbaa907ded50f9c246ef7c
SHA512 c4457600dcea2ba81b25f6a92378d4d6da6b1ad1957439935fab68b94b56d07f01e4374ec020c86f077393e8e6b5efda1d32397c0fbfe6cc26ee51b0f6461cb3
SSDEEP 98304:dQRQyi36YOcPELvw2gAf+PN3i+M4FHXzJTV+M4FHX:UQyiKaGX+PNi4NJZ4
TLSH
T106869D13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.6MB
SHA256 96f6e9ce9d493ded7cd72d0ee74a53622f326973657defb8478c5d70e36bbcfb
MD5 725e6aa3ade2fdd15f3b6af109639680
SHA1 526d0ddb6ab7aa579a414fe20c45bbb16d2b9605
SHA512 5242b0fccefd1c3ac41a8adafb5b39dabc9877703556fe35c53d49c303ddea13b9d66f2b6fafd3e80d953358ba1729c42e675b53043049c37e22e8a9c96de03a
SSDEEP 49152:V68Qg55nhSeWu7PNU3/EhxSMmT8oWgBCaXLarSj8RoTCCRhxSMmT8oWgBCaX:jthVRc/E+M4FHXLJTV+M4FHX
TLSH
T17506AD33B2E600A9C44DE1769F46872196D27C75CFE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.3MB
SHA256 aa5b815c785b995014f7fb663088ce6db12713c50cf33a8c7d1b406546947052
MD5 c258461385b0bbcff440fca74a7b0bb4
SHA1 8d4d7f25496e329f3d29b0a2a80f8fbdfa25f064
SHA512 6b3ddcf39343b688508f54e834679a680eee1f1b4f27a7d5230f7c5db2dae3e373237dc76018711bd714f0a70c9e129bf3a0eb9032ee25267d495c859cb3d355
SSDEEP 98304:cy5112gYy5azzVvf69nLKnhZb+M4FHXWJTV+M4FHX:dLIHSWhR4oJZ4
TLSH
T1A346AD13F69900E8D01DD179874A9232EAB2BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2e8c8ed860d8865199f24e0e3e2434dbe571fe6226bf4491add3d6655eeb4eda
MD5 601fca6ed3e16a8e1ed5f19d2d37c04a
SHA1 e05a6c478b0b3bd546025dbbf57c75e54a751ccf
SHA512 0bb60eb53ff2e30fb436c1028ded406e13c51a9e995cc6606508bc9b7d0c834845662ceb85833415a55ba6b1ae850d279b72696b496d8e479c717da0104100c4
SSDEEP 49152:yB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKhxSMmT8oWgBCaX:Au6JmVxd2dK+M4FHX
TLSH
T1E1D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.5MB
SHA256 26b5534b37f66a7bd06c555e3779ffe34935cdb9123497af4fb69d32e7dd6d5d
MD5 1cdba3ba7a6c6ab63d90ba2239615c48
SHA1 6c46a25cd0477b9b3d536493df76fa8c659a2faf
SHA512 d48365a46ca6f3868af30d7caf1e8115e09cb8408611cd87662b43bd77e13ee4108be762f3e6837a1f2485e61c7bb90bfa40d50ad293cb1aac67e3e46910c2c9
SSDEEP 49152:21hpsNoJpF1A6tU44CwH7R4xGhxSMmT8oWgBCaXtarSj8RoTCCRhxSMmT8oWgBC8:2mifPgRZ+M4FHXtJTV+M4FHX
TLSH
T1C6F5E013F2D900E8D06ED17887569632EA62BC490B21B6DF0A9077952F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 3.7MB
SHA256 7b2248a67baf90e3cc25de175296d7f6f4b34a71c048fe32443cf94ed1f22702
MD5 4bac9ff69fabe6635b32e25484a3d55e
SHA1 f8ae1b0c77472d244f1c6cc20e6aa8a2ad081e58
SHA512 757102138d556acaf6a712180bdd040d012074f2312b05a5858a500389fcc5d5732893ad2b160351882f4ee3a96278404e598ae4856c123856123b342f1050bf
SSDEEP 49152:pSuZQIY0Be2KWRVtOnks6NMHqvhxSMmT8oWgBCaX1arSj8RoTCCRhxSMmT8oWgB3:n5dKEi61v+M4FHX1JTV+M4FHX
TLSH
T10506E013F2E940E8E0BED6748B669232EA72BC454B34A6DF065072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.3MB
SHA256 b324e3c4324d76297649c575e8df52b964e5053f97484e45ad760777c9abe00d
MD5 b75e7e15a02853fc080020866ba1f9f0
SHA1 fec409e33fbb79a9b4b2cb3d8711ef1d095d4593
SHA512 97be0b8edc17d95d2169e33c34ea5389af6863836758fda84b041465a8d72fc2999d384d550de0fa18e9e0d6dffcae0025e809242ca41fd8c2e488f0d4f94309
SSDEEP 49152:/htSn8EApI0figmgiDn0AP5wahxSMmT8oWgBCaXParSj8RoTCCRhxSMmT8oWgBC8:uX2i/phl+M4FHXPJTV+M4FHX
TLSH
T1ABF5F013F2C900E8D06ED178C7568632E962BC154B25AAEF0A90B7552F7BFE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 2.2MB
SHA256 cb710b3c7d0f3be87b43536ac6d7860e062a71fb34575352896a7c82c371a9ec
MD5 bed0ad51a2c8c36a76bcc13044c08c56
SHA1 65cad6719000064c68da7a731292b95ff92a8f9f
SHA512 7b793cff844924c9473265788af1bb8f2b6844b9665bdcd477675b6f37a11699db2179ffcab0b52a9791fe6698d4799110d90970da9e3f8dc2e142d8eb471f15
SSDEEP 24576:cQrKhxr+EHNmT8oW4ll1JCrLKXIgaKngL2jdshRTdG1YxITqvfPkbIcbjLm:YhxSMmT8oWgBCaXjarSj8RoTCCW
TLSH
T12BB533BBDF8A89A5DD1B5734FDB29A0D2CD62FDCE003061ECEB52E5C397AAD51129100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 2.2MB
SHA256 87ef1b4e5b3b608fa210ca44e1f6ed7eccfcf0baaceae2f461b64c749007f90f
MD5 e0d36c9427b52d77e94768db45da5d4f
SHA1 283b42553ca1251f6113a8a104a976f1c4706131
SHA512 292c001d74532027d70e98be69808f4901c08993d5bde237f211a66a7d97e197af6798332a45b3efedeb0cc273be2dc0b9be05be6a3e0e1f5b76148f2119c729
SSDEEP 24576:gRrKhxr+EHNmT8oW4ll1JCrLKXIdaKngL2jdshRTdG1YxITqvfPkbIcbjLm:/hxSMmT8oWgBCaXKarSj8RoTCCW
TLSH
T125B533BBDF8A89A5DD1B5734BEB39A0D2CD62FDCE003061ECEB52D5C397AAD51129100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 2.2MB
SHA256 fcf28ff6e9c5487d97f3f8b55c0dcfd6ea6ad594b89d56b27e3821ac9cf05477
MD5 2c7c70a37f80395dccdbb199e6687f12
SHA1 7e869b5ebc716f1af2bdf27de520dc240db710fb
SHA512 aaeaf79bc58e3d83dca84fb711ac7df2bb1c51ecdd1fe1eb6c0f736ecd31970e211f908440ce7ee15adec99cee0e65dd8747cd1c6c9e36800eabe2c402bfc107
SSDEEP 24576:OvrKhxr+EHNmT8oW4ll1JCrLKXIbaKngL2jdshRTdG1YxITqvfPkbIcbjLm:ThxSMmT8oWgBCaXkarSj8RoTCCW
TLSH
T1CCB533BBDF8989A5DD1B5734FDA39A0D2CD62FDCE003061ECEB52D6C397AAD51129100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 2.2MB
SHA256 58315be55faf2292c731d0aedda3ce4546b0b146eb8475501ca03af6b6755098
MD5 f857acc5d4b455377652dcb1b4e30d26
SHA1 6b39e84c60a1fde6a0677920d888644c339d180a
SHA512 3d0b48b147f7ee518257c3295e4797859594e9d15add9065af9384183f7dd27d58606c6356188c38fc39f06e4156a382d72c3b8295c1d8130d842e55b82b8776
SSDEEP 24576:NrKhxr+EHNmT8oW4ll1JCrLKXIAjaKngL2jdshRTdG1YxITqvfPkbIcbjLm:0hxSMmT8oWgBCaXbarSj8RoTCCW
TLSH
T15FB523BA9F8945E5DC2B9338EDB299096CE23FDCE103471FCE601E9C2D76B952539600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 a84b4e3919866e63b5eb812473a920f88908ed5fd89c4619992f9fa5776a2a4d
MD5 63e4bfcb47354572f0a77fef78f56812
SHA1 aee67d796ea22ec1650f10e9acb7452accfd3666
SHA512 b0271472625b8b34d9fd4cf81b0733952d6634ad3782642234de84b63cbb8f0c86bfcd97a32f06a6ea14baa77dba339189a3bb39591c189735f3a3cdc228d968
SSDEEP 12288:SOJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:SOrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T160652375AF0F94EBED2AC335E8620716D99C0DDDF201263FAF3E2E683A35C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 e2a853328002e7ff775a0ca8410793fc755829a4f4a3a36a12cc563c27c28269
MD5 d680d8f5443f95bcdd18025126f44392
SHA1 32b4eb183f1569c5b6cda47a19d6546eea1373f1
SHA512 7bd5d055e17de470a9fb2e72df7ce79009f4d07ceb8ae5baf742c32a72ce8b77647dd86e33ce760f0ddf17c04a3bb50c223b80083558aa2f3ea08c43e1a655cf
SSDEEP 12288:vTJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:v1rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T159652375AF0F54EBED2AC335E8624716D99C0DDDF202263BAF3E2E683A31C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 cc35b641b425181c218d5b6029af5ca2c5a157ec8daf413fc7c746f2c4461546
MD5 dbd6358ce30671b7fc2883e036866694
SHA1 f949ec580b0fbb4216a0c779945dbf6bf49dac5e
SHA512 5892cc3658cce85ffcd66da239d37e8d6892ff21b5b96dd2fcace73ddcbc9aa9e34adc34951f5618599571db28d391c159c580225233d2de75c565fb36a1c364
SSDEEP 12288:eHJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:eprKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CC652375AF0F94ABED2AC335E8224715D99C0DDDF201263FAF3E2E683B31C1A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 94202a14448f9095dd3f84ae1e14ed48952cc0acdb1b23e083734ff2dabade37
MD5 5a737d13ed72fe20e3ea32c277b46ff8
SHA1 8ce3d0f9a4566e457879cc50cb35a892bcc7d894
SHA512 3da805c25e008de00f73c8377d7cf12a81c5dc6151a94934506110ca2a89f813b9fac8bad35398822216348cb4fcb9078a25d61e9aa436703f763ff6a7eda6e0
SSDEEP 24576:fZMEzFVSOxrKhxr+EHNmT8oW4ll1JCrLKXI:fZMEzfshxSMmT8oWgBCaX
TLSH
T1C88502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 6c451f7d7af8860b9ead31f9d110f57175924cbb96493d20d92a200d2de2b51d
MD5 4416b33926b31ebe9f479ca9386f191b
SHA1 90790db867255f968ff69c494dd1e1b7dd76cb83
SHA512 77f42e778de8036db7457b09ca35d309aa42a2dad30aca1c165640c3a2456d1bdefad8d500171d16ba6d98aa79e616ec4dbc79fb2b15f699b19c287590eeff19
SSDEEP 12288:uQJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:uMrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1E1652375AF0F54DBED2A8339E8624716D99C0DDDF202263BEF3F2E683A35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 20be48672eaa12f747fb8192af67ae33eec01bf85974c9195a359a6a0640a1cc
MD5 10e7e621e9c640b5b676ef47a35473d4
SHA1 d40410c365b6ac199a06432058467c07607f654c
SHA512 cf0ed5c72df750c3315787fe77a815104ae61d9d007095fa065df8a3fb799f4b5194016857c90fe7362f99549bb82396b1caa6f20e094c4b96e9f12483352940
SSDEEP 12288:mMJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:mYrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A7652375AF0F54DBED2AC335E9620716D99C0DDDF202263BAF3E2E683B35C1A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 5e9b3379bc145227ee61d58b09ff2d27c378a6cb8cab6807bdc677f080708976
MD5 22fef11690d678b89b3bcfff65924599
SHA1 8509fa3e85bb6a7671904114d3ae28e9dd96ae44
SHA512 d602fe1fd1c007ace1217de3e9254cfc4789e3f0b29379efe52f9c705072d43e728682f93d4cf2ac547c864fc275ff3e4a29516c5dbb0010c0c337115dfdaed8
SSDEEP 12288:2yPz5L8bJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:LzydrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C2751217779630F9D5378238C8621A02F7B57C7A53209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 ea5d4699fbe2356cc82464cdf9ef14aad500c3493e93d4e49e697b25f95da301
MD5 7956851198d810825ed9cb6529378d70
SHA1 cb527f905bfe26f0723cd3c2f7c6899e43ec6761
SHA512 e66d4d821a072a4dbce293f36496385a0f78087c9f617ff01b1afcbf7168509a6701780670ae2137fd4ef04f4acbd4e4d2141d9958982aaa408bc5a175410363
SSDEEP 12288:gQJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:gMrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T193652375AF0F54DBED2A8339E8620716D99C0DDDF242263BEF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 44b0292de13779a7256582eadd085b9dc1fcfd4ca8c19c0484e0e082c852c69f
MD5 1433804ddbfc3fbbf985c24d1d95cf25
SHA1 2e0e0176c257b26a33e8784efcd45fd040d7ae12
SHA512 19566b858886e686f0e042b2a18dcc85678b326972d14c8cdb456ef96be70d28a84c22b478d7af99d85c7352549305eb3510ec8d1710fe99db1ae2eaba5c4ece
SSDEEP 12288:ZQJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:ZMrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DC652375AF0F54EBED2A8339E8620716D99C0DDDF142263BAF3F2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 8acd092cde936632d8893118869fa45a925bcd133c214876e42e8da04d0476a8
MD5 7b2df2e3e36b202747328bdedbb228ed
SHA1 28aa3ede89007de07b900cbd2393be4c54f2bcf4
SHA512 ee5b2e92fed8ff3c4d702b88c5266abcf61e154e727da7e4ce72f5b3f7f608c74dee1f51c3c3ba38f80dff5782b3735ea6cae4928690bb5b20c0b4a4e7c0719f
SSDEEP 12288:AyPz5L8bJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:xzydrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T187751217779630F9D5378238C8621A02F7B57C7953209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 1049dd7d7b25c934bd68f3f683b2a9c16fa43f61e41f4936f9ccef37d748f07a
MD5 e5d0c9badcf21b708668b18c5451cabe
SHA1 213f099d922d7c4e1bb395eddaa45bf6dea50ab2
SHA512 5ac10dc4da45dd0e94a9fc3c0f3bc0f88d188f4f09cd4f0f157a20d61c3239fb0e1682818eb91ba01a8a4e164e938e89903c137cdc856cdd3d978b5d305184ea
SSDEEP 24576:zTdaLl3z0zD/rKhxr+EHNmT8oW4ll1JCrLKXI:zTwLlj9hxSMmT8oWgBCaX
TLSH
T1378502A5B35018F9EC67823ECC628916D6F27C5A4760C61F07B8366A5F333A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 9ef670ef0de5e30641382f1b675ba264c0d4bc27a9745d170e85d0543e33b381
MD5 c49b44ea576996b2d5f6ef16104f4079
SHA1 078cae3d5ef5c9b5e32c3f48eed3b01e7d3e4158
SHA512 20d7ce86d2acc6aca62f305869c735cd68b8027fe279cae5b4d0b378609a3de65ad98a74f95c3b7e5bdfbd982ee205b56d54902e94c7f027357246d8a193d2c9
SSDEEP 24576:835d9CHKy7GZzrKhxr+EHNmT8oW4ll1JCrLKXI:m5d9CHKyashxSMmT8oWgBCaX
TLSH
T1DA95CF90F3E414E9F0B78A35CD724511DAB67C995B21DE8F03A8265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 3caf0c11559eb17f80119c864085f169b6b53dd8406aff2c69bfd894443c57d3
MD5 2a4ad99713231e0c78b3f2a90f5d14c5
SHA1 d67fbfa01f05a395b03189183e1011a2dd6d0300
SHA512 3269a3fc1c2b776a149182ebc5c434218137f46164e21ae6006a862b69a9e9fa8a421038bb9aaed39ba9c97538155d7bced7b035511f76573c69ee632574784c
SSDEEP 12288:zZJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:zPrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T121652375AF0F94DBED2AC335E8620716D99C0DDDF242263FAF3E2E683A31C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 27e8665f83d1306b32659d541075ed160ad8365c7e955d2dd9bb1204223474c6
MD5 3b265aebe92391844d7c170e2f913d44
SHA1 6fbc6a7397ec185c229d8138f651774ba5581788
SHA512 35ed0a7d5c3031a02b7ab31451542127f52d9a35ded6cfa675eeaca6f151d02d8ed05e5bd503bc90df537a53d1da90781e31a324a4771b2a6c08d64c775d81de
SSDEEP 12288:Q7JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:Q9rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D9652375AF0F54EBED2AC335E8624712999C0DDDF102263BAF3E2E683B35C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 560a22c3358195f1677dc7923764da497e57d02986d7f8d2b6974126f4f8fbea
MD5 e5a59af7995440a7b78ed729b58e6872
SHA1 2b4eff11bc3347fbbeff137ef503b4633ac85b7e
SHA512 4c39e3a8dd0dcae72f1bbe0fd11b6f91fe51e8f0e805a0bb8a48dbec84a304487be28778b4859d78bad0d120c2d5a7c6830bcd724114ad8f50f1ef9f9487e58b
SSDEEP 12288:HSJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:HCrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D5652375AF0F549BED2AC339E9220716DD9C0DDDF202263BAF3F2E683A35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 251a51034fc2a1add48b47d4cfa1f415f26a0152733d716cef6220dd2c579935
MD5 f6039b6ebac425ba4ff86f62008f01b9
SHA1 b398f835d3f25b1257d71b4e6ca0f89d5dfd9ada
SHA512 47a22ac3aed00560f69e66b0695bda85bedf983c795b4a78810e57bcc6d2f96e72baf97c5e69f5c40a054b8289d5bfd51f8d136a8c194fa6ac5dd48aa6215327
SSDEEP 12288:1QJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:1MrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DB652375AF0F54DBED2A8339E8620716999C0DDDF202263BEF3E2E683A35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 2eb298d4c74f3a98fb1efd77bcc8e76be62a2137203d12752facddabd749b810
MD5 98b0344b95123b817f5e652a8bf1cb3f
SHA1 8c65bf68ab24783c365f275bf7ed25836e56e97d
SHA512 71056857e5c78a01a566b5e13938fa6ee1fd78f51e5382d49b20ed8cb8f01b600ee792b78e74c3070a932d6ba8b56439baf222c4bc61135dc14306dc25ba7448
SSDEEP 12288:vZJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:vPrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CF652375AF0F94DBED2AC335E8620716D9DC0DDDF202263BAF3E2E683A35C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 66f42e914e0bcfbf9e47be345587c4ab2d71a7c04ef57da7aba4ac2065c20179
MD5 3098cac174b4090a614696915614b443
SHA1 166e06dcd4aba8611c3ccb228c0411b10b19aeb5
SHA512 c9b8d81a0d5e3bf76453d852e4107cd8548ddc8205c88d56d7bd1f3aadf7e34df7bdafa51eebfb31e2497599f06711d66e31b0bdb3db40407f75736d299fbcdf
SSDEEP 12288:xoJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:xkrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C0652375AF0F54EBED2AC339E96207129D9C0DDCF142263BAF3E2E683B35C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 2ccf6ea405810cbdc7fa1febfb090a68e5961cee04b94846c58364515b8f8edb
MD5 796b587e1cbdf9aca4cbca72d166bd38
SHA1 96a04e591d30abbd02251e7de248e51d1e8bebfd
SHA512 c5f83079ef0d5931b39fc051eb4fa8ff40c880b1644887111a57c4250e238792bac5c3980b26dcd0092e4ed4af9fcbc0d5cfd6ebe14ff7c4d45fd15e558c3e98
SSDEEP 12288:gOJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:gOrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CB652375AF0F949BED2AC335E8620716D99C0DDDF202263FAF3F2E683A35C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 6526d81d0663c2b43b2dbe7c881f9f7336d65298a1d2d44429cc1e2a0bb72e61
MD5 56a359578263582c18bffb88ed744537
SHA1 18d7fd51f3d1092a2b2b0d0677575c66c5b49280
SHA512 1403dbfd3aa931014afabb3a8cc728e4f4f11d21e774ddb35eddaba105368287ff6b7ccfbdd7849db7a9a48efea6ebc0e9ab93d10b393678af9e8a7645711b79
SSDEEP 24576:D2wvik9RX6wkyAIIrKhxr+EHNmT8oW4ll1JCrLKXIzaKngL2jdshRTdG1YxITqv3:kMnYI7hxSMmT8oWgBCaX8arSj8RoTCCW
TLSH
T1DAD5F129EBC844E5E177923C99B3460AF6B1786C5B32C2CF06AA53AD0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 26acc072c3beeb0fe38038899b8382814c4080f27b38d1adfb13e57956650cdb
MD5 6a9d912541750d6eb889b62b5a744561
SHA1 1968e3247d3e95ceaccb161898ddf0897b768c49
SHA512 4efb2e50b7dde352f332b4d6b8cddbe86941d007cb9174e29968e1c395d8904bf8205fb2c2c34ddd9a1f263229acd31d9a3d5fc6c56b25d4b907a18ea319b1ab
SSDEEP 49152:NYVeNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06hxSMmT8oWgBD:dySzPC+M4FHX4JTy
TLSH
T144269E96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 fbbe79b8a2fe384888e813cd6b4f7a9fe615c6381fcdf51b8bcbf8f3cd93b0f6
MD5 be83622b6c6148b797a2f7d40f7ec409
SHA1 a96032213da79401bf28cd1156f07aeeaeb8f2ab
SHA512 160f0b6ea1c46928833057b4b24db702664da808dec3c9b903df878c207885dd19724e4e587b31c03af6936296a4b6252cb7103edb3e7f4629dc4fee668fe92b
SSDEEP 49152:xX7JUQj7irIhCnDHUPfF/KhxSMmT8oWgBCaX7arSj8RoTCCW:1J5glD0Pg+M4FHX7JTy
TLSH
T1B4B5D01EA3DC01E5E1BAD23889558A1AEA71782D5B32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.3MB
SHA256 f4f2a07184b6630cf4ef71928e3ce80b24c58412f40bac595a3c6dc1215316a0
MD5 3021522b6f70741dad775ef1309b8bb0
SHA1 fbd26941f6890b7732f722fd658599ab830ce5a9
SHA512 71b9708c2e6aa3872ec5e1d6ceef4170610d0b3f8841d82c355e2d71db8d1f9a4b7534caf4a0dbcb16af4c185fd9cb784d3ad2593acfcb036bbdbd4278e2cc40
SSDEEP 24576:PcrKhxr+EHNmT8oW4ll1JCrLKXI/aKngL2jdshRTdG1YxITqvfPkbIcbjLm:HhxSMmT8oWgBCaXYarSj8RoTCCW
TLSH
T1C7B5226AD78802E8C42E6334DB525A05B7733D6892D2C38F8AE0F97D1F766905DE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 33517c3995e7f19ff89ea180c8a424605f047297bbc1c6b8f6a61d139d7c257a
MD5 a889e5f2cef47ec780e92520fe9c27da
SHA1 4dcba001267100582045e8d327eb7dfcbea4396d
SHA512 b0804a9f30d493c1f7de4986e13848315e81f9251eefe623ec3925c7f61f61a8f4cf22c9b39a29e7b2897811851178fe377bad956e8662ccc787c08a72721968
SSDEEP 12288:OiYfJU3fqvXcq8Dp/YU+ZHROPyEF1L2EzAGxjjuAf5+qdaUHcPAg:OiYBUPqQlYU+M1LJ8kjjpf5+q04cPj
TLSH
T1EF3528107626DB4FC6A940321E36D2CCAB707C55EE44AF0773C9873F9576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 f2d8184244763cb365a479773e11769c3db48e8aa6af4c1e790c90327dc229d0
MD5 d0ad8fedc3df1e00f85240bbdbff5180
SHA1 d7e91c0e920effe2faa1b4afc45c757dd246ad25
SHA512 aae52f0d6c724fab565f5863bc7ab297e9dc82f12879eafff142ae0213d845bc743551a62490f28459f5f1b997958a8158bda5394b69e6e04981e0c270e66e75
SSDEEP 12288:mmy1i/eZsuA96DqL3CHROYItr+AIp9eEHCK:mmy13G5tr+AuoEx
TLSH
T12765E8406537E78FD1B76032032A5B8CB7A4EC17B7496F22B385453AD86BB15A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 1b0c2d79da0f0fca0a09007d040efcb728cd68c90fdfbe373cc314249aaafe59
MD5 fa7cf2094d1a39d3f95af33b5c1ab8a1
SHA1 f8ccf553b9213ebbe26acfecd1000954f04fb669
SHA512 36bca9540797e69707f0da9f29c69f2a4700afdeddfa5c7718c989ceaac3c559b90de163006411405bf5d1a0ff0bcf6ae6aa2af37212571a39c117670ec8d4f1
SSDEEP 12288:/O7YJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:60rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A36523719B0E989BFC3A8334D8674321695D2DACD30055FBEF2A2BA87931CC55D72712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fcaa9b1d906a794e7a757dc7ee7dcef1f7b27f3369d7ed9604eaa3dff97b8291
MD5 645a2538e23bb778ffd66140dd2bcd02
SHA1 17aa0ea6e8fd980c7f8df672e5d200998bb41cdb
SHA512 596d4a86843e2a5b8d655acf14351f94f4571fa65df757672873c1b36bcb34f20e9634d829f7bc4f7666229ac84f02ddf1c93f0853b2519f93fc346f07eb5e6a
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYqrKhxr+EHNmT8oW4ll1JCrLKXI:qgb4mBIBhGFohxSMmT8oWgBCaX
TLSH
T19E659E1E22EC02F5E0FAD2B8DDA64417D6B278161331D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 dd35565056c1340bdd4175c2baeb00f83eb8cd78a4e9fcac491aa8b7c379e989
MD5 7f52670ef38e787fd27dc5427f569ba3
SHA1 15b7d19e87a70b97e66e5f49b3c0a293dfd9c17e
SHA512 7e7a92358607755509f04cb34a2e57c301660d0caec08cd6bfdeed2b2730eafb642ebc809dc9e291c37a90bd92ba2b90db0bf66f6a4b2d58d9b9ffdf02e37dc4
SSDEEP 24576:TGIaKngL2jdshRTdG1YxITqvfPkbIcbjLm:TGIarSj8RoTCCW
TLSH
T11E05237EA7C566A4C43B977429B6A84A3CF33758970A46DF88E0957C4F6A7E0363CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 f17b368590d14f92264adc22c9fb30265a962ee4e6b06f44d5f923a9e20c5fd4
MD5 612f4593cbdfeb9a3bece5962665d084
SHA1 6a6832a78caa108725ead3c3746b02437347a030
SHA512 f1f8fc9e9962fa7f824cbcced85db9bf988d2a470aefb432f0db88e6eb57d69aff2119a0503235c99f2b4a89f10ea587ff0f97df978a8a69bbe399c2ba908321
SSDEEP 24576:cG88u8FpJqH1hzria7/mxrKhxr+EHNmT8oW4ll1JCrLKXI:f7ZFPqVoa7/VhxSMmT8oWgBCaX
TLSH
T10895F16577E101F1D47BD138C9824663F6B2B8251360EBDF0BA88B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 724ab32244a6ca56188bb6c0e195c026e1f37d406a3473855c55103e68b4b43a
MD5 1044a7a38a1dc84db0baa546e16628f9
SHA1 6134b2315bab0df8c6bb054e463b5212ca897fbc
SHA512 91d8cc2d3a9b21fdbd92f2ad62c62e6c7f3345f340c093d1cbbf6eeb95840970a3daaebefca2a534b88906b5a7b516d72e5c62c7a41403bfb4c493942f986547
SSDEEP 24576:yPUr+NQlrKhxr+EHNmT8oW4ll1JCrLKXIt:yJQshxSMmT8oWgBCaX
TLSH
T10585F12F269D18E5E67AE13DC9824719F7717866131292DF02A1817E5F33DE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7f1cddb9a2b87076b0480e8c9bd502deb761ea8517eab49c4e68a2c398ec745b
MD5 a946b82ac2f753ecff158a38fb597818
SHA1 48100784395745d30c5a71c32e1bb3de88d61c77
SHA512 ebe1fa3172a80b307ad0fe117122adfe1b338145abf657938f18e423fe71977736da90b2d6936a53865b9569cd6c443e9142e2ecb1ba16feeabe22739008a723
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjchxSMmT8oWgBCaX:bG05lO43bz+M4FHX
TLSH
T1CFD5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0c3679a55894d9eecb3c31ea7211eabdd711ad5c16036f1551bdb24fafdca5c6
MD5 049a5abedeedaf92ee16b8c6c6f2d398
SHA1 2a0ece3f2de3394346014735dc7d5a39d6846f8f
SHA512 c330249ec5c013ad1e90856e2439858f4fb6a8d014dbbe5ea94ef593ecbb595b6264d037284c352088bc22721d6048426b60bbf75fde55ec5171ff2152425ec7
SSDEEP 24576:Pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnrrKhxr+EHNmT8oW4ll1JCrLKXI:3a5POZ3+Jt2pasx2+mEhxSMmT8oWgBC8
TLSH
T18765AE5EA7FC00D5D579D17DC583861AE5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5bb0f0bece73bc701b7c60eb0761a9fdd4b0d7122d1210038a50d031a05b2165
MD5 d721db8dae2da6c8d6dad742ee169120
SHA1 dd2a6629c81abdf65c5ea48570d1b3923827e723
SHA512 7816a15fa1ec334d2d6a848f824e6cb7dada6323e79e89cb0c3af4d2ae94dde7dcb14c770376e040e3efffba1a224e7d1c92b16b672c3a0cdfa92d0f0193b3e1
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7Fk5rKhxr+EHNmT8oW4ll1JCrLKXI:MNc/zEOVHF1hxSMmT8oWgBCaX
TLSH
T11B858B2623E900E4F5BBE1BE89779546FA717869533086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 7668edbecfe5d60a5b9bb4ab7934af0ee4b33983e5c48deab963c324d3ccf51d
MD5 1be037349b5411d70967bf82f2ecac39
SHA1 a83599205e7e3cae990ac0a7c6540581b0670fb5
SHA512 cbe8e1cce91f496802fcf16a51c2f5c5ab0b7efd81e220b99a7696d41adcbac9cf6e95156d1e846079185736e1caf9ea39ca1b6ad5a452ec3345f3db4a0766b4
SSDEEP 24576:t6DI9aKngL2jdshRTdG1YxITqvfPkbIcbjLm:t6DI9arSj8RoTCCW
TLSH
T1B425125D63AA01F4D06BE13D96934506E5B2B6B583034ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 4ac8f07c77f2b85cb897fe02c9b741ccb1540f1d08a1abd01e48c6579eb70786
MD5 8ff7a04cff9d22ea0f35114e5caf8d14
SHA1 12afb2eb567bf74578e4982d1a125910bfb81922
SHA512 c1dfe8fbc1daf4ec2437678af6c34c859d5c97c405d4f6e62c14ef6a769c575489bc4e9384bb4a0ad0ab5873be460102b15ad8c671adde1a2117ce966d3755ab
SSDEEP 24576:Nty7aKngL2jdshRTdG1YxITqvfPkbIcbjLm:NtoarSj8RoTCCW
TLSH
T13315231AD7C456D4E57A27786EB385886D727E289B0783CF89E0E63D2F367D06934B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 094dd12aef421ba1ab79fc4632664ffd20c3e92aefca7fde389bee3eb0c6bfe9
MD5 8b5bb36f3bf833db5b5a5d39b08f934c
SHA1 f3b347f4e55488f581d5cc3a3ce1663a357baa73
SHA512 4c064fd0dbc709be1f44a62629449fb416dcb735c24dcf593b29f86657a649f6622ba5e61da3002ccb39100dc4346cf42d69064674d1f3e9fa602f7577678ee0
SSDEEP 24576:iaaKngL2jdshRTdG1YxITqvfPkbIcbjLm:iaarSj8RoTCCW
TLSH
T1A80523BEDBC55BA0D41A7B783AA6A94D38B3376C970B46CF8CE0557C4E7A7D12538800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 3536054e88e029dd880e80f9f0f85ffc168ecdcb2311f23f4d391398cd49a6cf
MD5 8e00b6f75d5b09747d60b2c5436c58dc
SHA1 46a713ad2f8d009b8f958ca44ec7ef7b09a9f1b7
SHA512 356ea02b4de045ee843d52854115c626c0d92fb9141dfc0529ed69aef61060fb7f9688ca26153c49dfc062a3b0e0f6574ffd966cbea18e27e968a7cd0a7e06df
SSDEEP 24576:INgdLoTfaidZJaKngL2jdshRTdG1YxITqvfPkbIcbjLm:IgyTrZJarSj8RoTCCW
TLSH
T13165AD1DA7EA06CAE2B2D675D8725483D633B4315772C6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 9d4c00503183d0c326b73c652e6fea6ec6de3c65e2f5b231bb304e15b268bd9f
MD5 3709c5bb6b5831b74d412556698baf42
SHA1 11b4e732b0359d95176b96d05e6dab022d453175
SHA512 e389ae281f27e7a7c31caa8a029831f8324997414f6eb445172609c25991f6252e3ec91c36d1a83a93759add880e3084368b37b0dc3c36749697dd1583cccb2f
SSDEEP 49152:Cgb4mBIBhGFohxSMmT8oWgBCaXxarSj8RoTCCW:Ctl+M4FHXxJTy
TLSH
T157A5D01E22EC02F5E0FAE3B89DA64407D6B278165332D2DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 a9f0f8f2c8d76366d95276c6d3d88e08ae69722c367f124f444593d86e37bb90
MD5 a86c5f3265f2ac2399d87af0aa835c7f
SHA1 101d298a7d90d3ac1b917636d29af6cc82d9a57e
SHA512 2627beb970b9df6a2609efc7b3bebba9a5d4c22297cb6e3b5b6bc9df81ae773967dbd898b65e3a92f98743d340c76203b2e932853135b67a78bfbe1858e852ad
SSDEEP 49152:pDMwBtOm2hxSMmT8oWgBCaXFarSj8RoTCCW:lF++M4FHXFJTy
TLSH
T11DA5D16EBBA846E4D1BEC674DD238516FA727861033253CF8290C13E1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 d2e8cd06de158c8828b960a1274fd1e1d68a597e8cc58356c447bb4c1db402bb
MD5 8aa10f407efebb4c7f667683df0b00f8
SHA1 2afa1af6c7d510c18e868846f786b6d7a7fc99b4
SHA512 9e8b03eeafca1c780898852048f42cc81ca86ca74005d0f805de66e573e3f2765209910ea62b5d78e77098e111e2ad09d2713a03fdb4cc015358b8d554656af2
SSDEEP 49152:eDVHeBIAADhxSMmT8oWgBCaXasarSj8RoTCCW:W+M4FHXasJTy
TLSH
T1F4C5027EEB5D04E4D57BD27CDA638A06E6B138AD031256CF06D481B91F6BEE42D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 c168361fd83312ba147cdc4e973ba844eeaaaee5761566c2c5263087c38a9555
MD5 2446856a7d2d973f5ebfe41c094c7c0f
SHA1 ec3d3d15d83b7274843aaf01ed0fd27881a68f02
SHA512 2c0c77423e8016283d3641b1f681816f6dc71bdec6f6fa519a9192ff67829175ac00efacc9411bae264dca486695f2afa7b77dddc34c42abb50a574298ea94c6
SSDEEP 24576:wJnJPbzB4SlaKngL2jdshRTdG1YxITqvfPkbIcbjLm:wJnJv6SlarSj8RoTCCW
TLSH
T1F535F13DD29810E8E4B7C2B4815A1B5ABE71387D2F1669CB59B4D4343F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 fe78c9164185cdcc1cbb3010ac2d832fd6be87de81b5e2b83e4db053fa2d15cd
MD5 d2663e34f7e787c9010fd8453ec07b0f
SHA1 c388d648951b5302e224bcea7bd33b2f5478c970
SHA512 8ebf639a97dfb691aeb4efdfc4e43b58a02e1eba415c65e7a8ee452be363ca894dd88e06c170bc1b6f4c0a45a71f97c64f48acab285d7af2093c791214cf7d0f
SSDEEP 24576:SGaKngL2jdshRTdG1YxITqvfPkbIcbjLm:SGarSj8RoTCCW
TLSH
T1B60523ABDBC48B94D55A3B743AA7A84D3CE33B5D974B47CFC8E0159C19AA7D1263C400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 e68d6ab4fe9c06326a680d460a837a3b27e7d19f752e10f3bee7dfd840de3654
MD5 a4e79a247737c88a9802d57c965e9802
SHA1 b641122d9700e5048ca1153cbf4d02ce66e89f9f
SHA512 3f0e31507ab2f1a89c4e136d606c031866366f558dc77adb0de9c9d2350c58e8e9c36e1d47f39651a7538d3eced0aa1f06ef63efc1915cd2a24e66aca55a43d1
SSDEEP 24576:k6UqjpPaKngL2jdshRTdG1YxITqvfPkbIcbjLm:k6UyarSj8RoTCCW
TLSH
T1D715226F97C419E4E03A2334AAB6C10918B27E7A035B86DF65D4967E4F36BC0953EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 6d4d10aa7ad68ef70adddda48aae91ab989ed6cb12e031d1462c25a517fa8570
MD5 c42cd9942e521e35732e3e404b3f4237
SHA1 9c5e11d6515f50b7d495a958d0280f109df58820
SHA512 ffc36b9d5daafc2050513e2059ba93a243e57150ae5eaf6025341ab225f3babdbf71c2b14959d8e578ecde855fbed9733ce6a68b7a9fa44b2161e187a6574ddc
SSDEEP 24576:lCLHGL0MoeVtFumTijCmlKQWDkYaKngL2jdshRTdG1YxITqvfPkbIcbjLm:lCLHGeeV5ijCmlDWDkYarSj8RoTCCW
TLSH
T15AA57C05E7EB4284E8F3CAF5CA2694169A327C549B34F7DF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 d2899d301fcab4e331b5b354a70cf429cd0fe4743cb75142a2224d548023ffb4
MD5 1ce65db3ba61c19d639a2377b2a57f46
SHA1 ceb6d91cdadf147f75ed4f05c8aa616af65ef4d6
SHA512 923cd3c67884449e5fd0993cb44c8e52e7b44735f5a34b4fa3bbc0b557ee6951a39f31c0ce2a7505a81d75c92d3d50f8863e81cb59c497bbcaf1fc01ec294869
SSDEEP 24576:lrcmRTaKngL2jdshRTdG1YxITqvfPkbIcbjLm:xcmRTarSj8RoTCCW
TLSH
T1AE25015EB7AE00E5E1BB923C89828549FAB37534530257CF46E0877D4E67AE97D38B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 ca26152bf6a7e7b0ef48135da7076d53f087254648f30b5ea6e510e6d58b6522
MD5 e64d1dff7d07c54c60d51282573630e5
SHA1 546939d2b23440aa0489e6c2d46ef8671f66a8af
SHA512 59c29134353232fc750b4001ec50d1db1e73ee20d10f5e84cf0f306b4e10ccfafe688d6f1c91cd0302b120cb304f951d87c50f60e76d398779f44c5d516393d6
SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3FarSj8RoTCCW:j3Upow8sBUJTy
TLSH
T136B59D3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1280-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1280-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1280-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1280-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1664-138-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1664-132-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1664-130-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1664-318-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3032-570-0x000001DD44170000-0x000001DD4421E000-memory.dmp

Download

memory/3324-363-0x00000262EB600000-0x00000262EB88B000-memory.dmp

Download

memory/3400-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3400-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3400-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3400-336-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3568-143-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3568-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3568-151-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3568-149-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3568-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3976-559-0x000001C261000000-0x000001C2610AE000-memory.dmp

Download

memory/3976-359-0x000001C261000000-0x000001C2610AE000-memory.dmp

Download

memory/4432-123-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4432-124-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4432-117-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4432-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4432-324-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4432-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4544-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4544-529-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4544-265-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4544-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4544-526-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4544-98-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4724-71-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4724-83-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4724-76-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4724-220-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4928-58-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4928-52-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4928-56-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4928-46-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4928-45-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5060-8-0x00000000030C0000-0x0000000003145000-memory.dmp

Download

memory/5060-87-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5060-1-0x00000000026F0000-0x0000000002757000-memory.dmp

Download

memory/5060-16-0x0000000002DF0000-0x0000000002F39000-memory.dmp

Download

memory/5060-0-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5060-481-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5060-15-0x00000000030C0000-0x0000000003145000-memory.dmp

Download

memory/5060-6-0x00000000026F0000-0x0000000002757000-memory.dmp

Download

memory/5060-103-0x00000000040C0000-0x0000000004127000-memory.dmp

Download

memory/5060-108-0x00000000040C0000-0x0000000004127000-memory.dmp

Download

memory/5060-14-0x00000000026F0000-0x0000000002757000-memory.dmp

Download

memory/5108-60-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5108-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5108-67-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5108-196-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5556-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5556-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5556-29-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5556-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5716-240-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5716-88-0x0000000000400000-0x0000000000577000-memory.dmp

Download