fee12d94db1739165bfa5d8fe7056ba0226dc837da00041cf2d40b493ecfbcb7

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 2.8MB
Sample260930-ezzcxssw3m
SHA256 fee12d94db1739165bfa5d8fe7056ba0226dc837da00041cf2d40b493ecfbcb7
MD5 22f20e91eb6c579092bc9680d7724a42
SHA1 30ce43a1e9f1f66bf5f36e9532393236e3a3c7f9
SHA512 13254a19e0a4072e7e6bd30f5a4463daa628af4526fca07df775ac74940859781a26e6559816266ef4801b3f3bdc62432adc7e0dfe35ce990c637e239814dd3f
SSDEEP 49152:XrxRP9sg+B/V2j+JFhxSMmT8oWgBCaXGarSj8RoTCCQhxSMmT8oWgBCaX:X3MBV2e+M4FHXGJTU+M4FHX
TLSH
T1E7D5CF1277F99129F1F37B71EEB883645A77BCB5AD39C50E6280215E09B4A40DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5020	alg.exe
3996	DiagnosticsHub.StandardCollector.Service.exe
4684	fxssvc.exe
1652	elevation_service.exe
628	elevation_service.exe
2772	maintenanceservice.exe
876	msdtc.exe
2708	OSE.EXE
4856	PerceptionSimulationService.exe
1772	perfhost.exe
3780	locator.exe
3792	SensorDataService.exe
4780	snmptrap.exe
852	spectrum.exe
3900	ssh-agent.exe
4124	TieringEngineService.exe
4080	AgentService.exe
3348	vds.exe
3660	vssvc.exe
1808	wbengine.exe
1612	WmiApSrv.exe
1752	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	alg.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4f92d38fa26b1277.bin	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017431-617.dat	upx
behavioral1/files/0x000200000001ff96-628.dat	upx
behavioral1/files/0x0001000000022788-626.dat	upx
behavioral1/files/0x0001000000022832-625.dat	upx
behavioral1/files/0x0001000000016795-623.dat	upx
behavioral1/files/0x0001000000017039-622.dat	upx
behavioral1/files/0x0001000000017816-621.dat	upx
behavioral1/files/0x000100000000c534-619.dat	upx
behavioral1/files/0x0001000000023365-618.dat	upx
behavioral1/files/0x000100000001704d-616.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\java.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000361042899350dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003513aa8a9350dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d8afa889350dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000882355899350dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092c514899350dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064ae20899350dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3996	DiagnosticsHub.StandardCollector.Service.exe
3996	DiagnosticsHub.StandardCollector.Service.exe
3996	DiagnosticsHub.StandardCollector.Service.exe
3996	DiagnosticsHub.StandardCollector.Service.exe
3996	DiagnosticsHub.StandardCollector.Service.exe
3996	DiagnosticsHub.StandardCollector.Service.exe
3996	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	4684	fxssvc.exe
Token: SeRestorePrivilege	4124	TieringEngineService.exe
Token: SeManageVolumePrivilege	4124	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4080	AgentService.exe
Token: SeBackupPrivilege	3660	vssvc.exe
Token: SeRestorePrivilege	3660	vssvc.exe
Token: SeAuditPrivilege	3660	vssvc.exe
Token: SeBackupPrivilege	1808	wbengine.exe
Token: SeRestorePrivilege	1808	wbengine.exe
Token: SeSecurityPrivilege	1808	wbengine.exe
Token: 33	1752	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeDebugPrivilege	5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5020	alg.exe
Token: SeDebugPrivilege	5020	alg.exe
Token: SeDebugPrivilege	5020	alg.exe
Token: SeDebugPrivilege	3996	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5032	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 4344	1752	SearchIndexer.exe	114
PID 1752 wrote to memory of 3224	1752	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5032

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1632

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:628

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2772

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:876

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1772

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3780

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3792

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4780

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:552

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3348

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1612

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4344
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1cc28794ae61a43cb38fde35d983363881df7f00d49d6fbdccdc5aaa3edb1c69
MD5 6bc1b6703fdd3b6c26ec43849698e605
SHA1 872df8d1c723cfc085e1b16dd746876963d59da1
SHA512 5fbd7c6947787d8db99132455d31da29cecad04b030b4f1e6909cfb529687eaae1a7aed93d895bcc0cbc0973565596faac9e388f40ed3b6b4e150ec1c3e887cd
SSDEEP 49152:qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnphxSMmT8oWgBCaX:c3q6HjBI+M4FHX
TLSH
T191D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 61f638c8e925be6ec6035f6d46d19f7767cb4b6ec9812f24091affc5e311263b
MD5 00a915663630bf9af15b6ab2d31ba4da
SHA1 a29057468d4c72029ec537d0c75fae0a92b44fa3
SHA512 27abcd803710270abaf87ef2eaf62467bcb1ccee169625d93eb0c1d1e011ce6d98af56ab7d35db9e5f57c49a27ca36b613dbffccb164b5ecfc39a42f3775c390
SSDEEP 24576:cXY9DkczAtrKhxr+EHNmT8oW4ll1JCrLKXI2aKngL2jdshRTdG1YxITqvfPkbIcK:RkczhxSMmT8oWgBCaX5arSj8RoTCCW
TLSH
T162C51229A7C509F8EC67823CDDA28505EA737C998350E74F07A49A691F337D81E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 023177f5790246db8886ed2c9299cd37c8f5b201c270790de001f04c979dfda1
MD5 d0e4e1a7f19e4d745e29489db58694f2
SHA1 3e4cf678fd8d0be5cc8360b0955456d6d7c6b8a1
SHA512 c670188d346d3ab5707e434f1dbc104e43215f91f8667f3c9f6a46ad0e271ee73e1724749c1a6c6407d5fbd722b59c5218949ce969c341764f70cfc92729a577
SSDEEP 24576:rXYfDtczAtrKhxr+EHNmT8oW4ll1JCrLKXI:utczhxSMmT8oWgBCaX
TLSH
T18C85012877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.8MB
SHA256 65153ede7bbef1f1a3450c25d9ad361a22a299b87f41f6c5f638c744b5291cd1
MD5 3c5264097362d9b02f870cbecff9f1d5
SHA1 7974fa94e171907bb3b852d090e1845a77ef580c
SHA512 63f8c5118be2632d8b4c1a604c1ae4c012c92e67c05c1ac879d8d9577e88dba8004b44188ca369fcb2ac0b2b21c68e5c9a779d4fd3169cf4c3c4bace7f81ed8f
SSDEEP 49152:SAMbFoiq5fhxSMmT8oWgBCaXtarSj8RoTCCW:Gq9+M4FHXtJTy
TLSH
T1F195E091EBF945D4F5B3AB78A9B68570E9B2BCA95E31C20F1160D11F1E33E409D24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 a22d859d9743a69648bb11e718b4d98e0a9f24f50e1753b57d08061f5d1dd830
MD5 aa3e72a7add2db8aeaad9c57fdf11dd6
SHA1 edaa5267d9c13b92ed45945d3a242c7eaf1b09f6
SHA512 e8cfa541d04d573f9ae5dbc58e852475adf90b370b2de0f2c53e5aee82693e54d0bff1c7d8365207d4aed24c0035ca30a48e4e0ac4ed7ca49ad704dca4518432
SSDEEP 24576:CwuSOW/rKhxr+EHNmT8oW4ll1JCrLKXI:Cw9OLhxSMmT8oWgBCaX
TLSH
T1DF85F14677A91CF9E9678239C557C136F7F2BC052621DB2F0770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 2.8MB
SHA256 b219df2cfd922b7ccba9391113d7da1b8a0b6e30cacde8fb95ad80ef7f2b95f2
MD5 99bad4e731e2b5bff68aabb62705645d
SHA1 cbd8ce72187fa4e655da087790bf8efafb9382e9
SHA512 d20c44aca2d5d636ae10430e96e5232722ebdf7d0adb150c7fadf8f369d3ea8fe4f3be9fbf2b7b59aec2e2850b232b5e796c2e2b003b21e2222ca8b0c407112a
SSDEEP 49152:JhxSMmT8oWgBCaX4arSj8RoTCCqhxSMmT8oWgBCaX:J+M4FHX4JTW+M4FHX
TLSH
T118D523BA6B8960F5D9274338EDB25A059BE23D9CA31203CF4E751AAC2F36DD51D39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f67462528f4a1294f0f4350ac94c98540bd0c955880e91b1c82a2dce77f7521c
MD5 9935d1f38c82cf97f27492d54522a0ac
SHA1 dd5219dc9cb7d34f6b3d073a2d4bad6b44b38b2e
SHA512 ec2ffd3050574f37c93150b4d68233ef1220faca3d1e861b750a9a889127d193d901da8a926e1c7c53390e33e503972c85299625a9e5bb1dd2e5e3839fb87944
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:4QRQyi36YOcPQLvw2gAf+PN3c+M4FHX
TLSH
T1B0667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 32aa491fc17d23f1da54161bacccc2def0de04a05346d4513ab5f6a9d1f84c8f
MD5 61a519118698ea34a6b23ddd2900e71f
SHA1 1e9dd4afe110db44dd999df3708e188eee505ed9
SHA512 af8e27f338b2a96ded55b1aad15d3058de9fb4f9af9f4715381e06e5299ca7e2fc87e56f1ac85355a8df92e1998181481472a51a45090e6c05ecd48d73820d8a
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:OQRQyi36YOcPQLvw2gAf+PN3c+M4FHX
TLSH
T1D3667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.6MB
SHA256 4ab5d213850f78c6a26cafb75e3e5646711ab00a370c14db7a0f24de8e7fe266
MD5 290e31bcab77a7b3322e8ae5658514c0
SHA1 54e363df4e884529bee9f215a273691bf12c2a59
SHA512 2d15ad0a3eb91480a8112f1bb03c4b9c0cd82bb27016c7bb7429ae6a4a0bbdd5371f95960f9644057944b52d438cf22334a13e00d29c7238c5f43a15c80db326
SSDEEP 49152:E68Qg55nhSeWu7PNU3/ihxSMmT8oWgBCaXqarSj8RoTCCqhxSMmT8oWgBCaX:uthVRc/i+M4FHXqJTW+M4FHX
TLSH
T12806AD33B2E600A9C44DE1369F46872196D27C75CFE1E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.3MB
SHA256 1846b5969644c03eb07d94b5fdc8a848987196a1a23618ce2a1221d867ebe4f6
MD5 15c9eced34490a20b83e7b3641cd2aea
SHA1 7c23598585f3f435fecaffe5cf410c940a3b494a
SHA512 f835aa5f1b5878d30b2cd5fb65ffae2f33a80236636db8ec2c2aeda14bfc19acd17fffceef9e0c0eaf9f46266e0e4e42502389ab8181daa2b0cbb309146d73c2
SSDEEP 98304:qy5112gYy5azzVvf69nLKnhZV+M4FHXiJTW+M4FHX:TLIHSWhb4EJC4
TLSH
T11046AD13F69900E8D01DD179874A9232EAB2BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0a1f27839b7f26788e8340f5d5e197aa8a6ce83a1dbc7d8110a376b154160304
MD5 3b8d68535cc9372bae36a4f0366d4470
SHA1 de990d9be1c6086d3c15b7fd3a879892d71cd204
SHA512 e04abae676f514f202e47e40eba159783903aaf7f0653c7133ef9d1b4108335a83fac07659ae71c7a8a7697643e5b41334f915f86a37dc2175495346882a4d22
SSDEEP 49152:lB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glEhxSMmT8oWgBCaX:Lu6JmVxd2dE+M4FHX
TLSH
T168D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6948439c46303244383807a11b91b7a127601d2d79bd3523668dfb04b9d0b6de
MD5 3ee25bd5297a8f676be4099e0f8d9e26
SHA1 f3876e5e96149b75c2c54046cce36432ca767d78
SHA512 0c06038329f3de32fe5b528436b0e1719c17d672c453b37b4291433a35b423acf5738988c624506fa7134434252f73a76eebde391f1d74b25160feafbd720a69
SSDEEP 49152:g1hpsNoJpF1A6UU44CwH7R4xAhxSMmT8oWgBCaX:gmifPbRP+M4FHX
TLSH
T1B6B5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 446b9347fb1caa1b1010836d4697fc375fcd780e9e30136df21370fbbed04824
MD5 7364fbf7222c61a5bcf4efdd381aae30
SHA1 ccaa0230cd4f6cc39bbc83cc46342a18d516e2a9
SHA512 375ba30ede8ecf28fbf10a799dd5fdb5ce93753ae027a49359fce6ea0b24da4ca026e5752d9d9ed6462cc4c44ff283f9cdce8a0c50b6465587c0332413524359
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHq5hxSMmT8oWgBCaX:e5dKTi615+M4FHX
TLSH
T158C5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2a3d44f335212d6e4ba1439a82ac5e25823c0d05e217bcaea76d14dea642a2e9
MD5 d9fc659f9a54b9c4b2ac14645638009b
SHA1 9517bc692eed357df97b5da37d4b4bf9ebb5c255
SHA512 28aa6f78350f5edc66c72d01719cfb04fe1fee921b2cf09afac0b5b1adbf34df4ff79ab74b45b010635fefc427e3fb088f13fadc4ea910a573154c5d79502e49
SSDEEP 49152:KhtSn8EApI0figngiDn0AP5wUhxSMmT8oWgBCaX:rX2iyphr+M4FHX
TLSH
T16295BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 1d803e8fd086bc38161584735d6d406e064fe7415f4f522151d2401b4f6d26f9
MD5 f72c143cc326e4c0393725d59b3951c6
SHA1 84b9b60a043e3050c2c4a0d39461e44299de3170
SHA512 28f135413a3ebfed075a16e9a9666ec5a9629ac547bf715c64817caf95a07630df8ea1ef78d2eb189019e8325a295ceafb4d6b28f27be062d7356e074c0b71e8
SSDEEP 12288:taJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:tqrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T15D652375AF0F94EBED2AC335E8620716D99C0DDDF201263BAF3E2E687B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 f2954383ed34a5dc449c60946c429bf73cb108366a001a7d043958b1be423ffa
MD5 855930e43ddd3ec9cff6fb93c17cf551
SHA1 655e0fb784f3a5b9e6f2a6e9a1b6878a4285783f
SHA512 a365303597deb4a006eb161f0fe6548d4ec9e7ced3d8b5aaa92dd7a290c106837cabdc04f99f8d9cfd71bc2aea667c61e91636d3dfc1d7b3072b596ea825eca1
SSDEEP 12288:RhJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:RXrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T160652375AF0F54EBED2AC335E8620716D99C0DDDF202263BAF3E2E683B31C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 ae929b85f28308f38ab5f7cd99fe3713d95deba5ea55f8b56604b753ecdb1224
MD5 b905a2621af5d3b8b6578582fef24689
SHA1 f00045fd97d9a45187920106c7e8e6c4e40e4aad
SHA512 7a085c1855cbcc155824174628bdb08eae0f367efac808b1b080b9929291b79b18b94801f2d55b0d083dacf087c3a1c1b46e4436ef2bba31b8336cfa48538d8d
SSDEEP 12288:g/JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:gBrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A4652375AF0F94EBED2AC335E8620712D99C0DDDF241263FAF3E2E687A31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 fb698898a6f83b987866feb25de4c443885a6040abce4be7160f341cff298f77
MD5 833e4b9d70d5bc8e00ec6369e34e2d41
SHA1 9b6f4b80747934706b9ed3ef82eae3a12ecc7d2d
SHA512 36b7225bb85ae25953ecf0a08dce5b1d848c2730bb6751afd592f0205372f6efd28b6c418d059bd5b3df1d72f606e5e287c5adaacb4fdd8ded068619d8c4315c
SSDEEP 12288:SVgJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:frKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19F6523656B4E50DBEC26C338D8724312D6F93CDCE322277F9F251E682E31A996931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 fc0be512f0f6e06d68d3f0b732e8cad993a1de8f7782b030f015f472dc139f23
MD5 3c29e4d71d8e2acc742edb3f8ab00c23
SHA1 65316314aa0a19c2d3ce17909b624d362c91b913
SHA512 946e53364be8460cfc943228fddc4ce6876657a60f038446de4166582ddf0a479ed0a820ad2511119f5f495176911fefbdf78c3db85b349f498ec6e1ec4f941b
SSDEEP 12288:o4JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:oUrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1FA652375AF0F94EBED2AC335E8620716D99C0DDDF241263FAF3E2E683A35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 ce8ce5f4d92101f3561a629d84d6fd9effad22f21b15d42616db77117471edcc
MD5 e6c2509bc3de39e08535c9d8dfe0ac70
SHA1 5577e62703771ca1368d30a7f3f5514e878db480
SHA512 8307723a28347f4924f06f727e02cd836ff8104b66579d2cdd94d1fe4c2c08f2f66ab83cf609f5647bcf7b3870d25077ef1ed26a04561f04f25ceffe5a6ee8da
SSDEEP 12288:b1JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:brrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D8652375AF0F54EBED2AC335E8620716D99C0DDDF201263BAF3E2E687A31C5A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 4901786164c154c3e5b73163714b9bfa9ea75581d9dd083e4ebd72a0199d461f
MD5 21f9728b93a9da725d7ac847e0a7ccac
SHA1 f3f3876e598c1c128b53697ae12cd59daf97631b
SHA512 6bfc9670028560fbe3fc83de0cdb3bc9d80cf140cf79360a6472183d1480e26a381827092299fb3ebd200bccf014d0b14a8412225c807a3e66375e935928511c
SSDEEP 12288:vZJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:vPrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A7652375AF0F54ABED2AC335E9624715C99C0DDDF202263FAF3E2E683B35C1A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 d8b33f00e47e345e66a7b054283f33f5d9a0763f5ac6b46170f0fecc6f6b7d2a
MD5 5093ae0f38c3270d055986e953d5a6bf
SHA1 06c5e15a1a12803ea072f837a2e1eebb4325623f
SHA512 cce0d4de7977761e70e9adac19c6efe976161a95f1099e83224e61b0e1c6b27bc53a3cba537e70c4575cea0aed36f4e3f00a7c7244f18542932ccdff12d954d3
SSDEEP 24576:4ZMEzFVSO3rKhxr+EHNmT8oW4ll1JCrLKXI:4ZMEzfKhxSMmT8oWgBCaX
TLSH
T1538502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 da40262c4b84c43afa195745f1bc439134e42b913a0f8cfbfc860be0a0892335
MD5 9ec9ecbf644f10f33dd63307a10409c8
SHA1 f514930abf78b76290d2cd6136efa00c9a88970a
SHA512 542312fb8a8a8a6c1bfd29c3a72a4f3195efc56bce820f0242b0daa8066543cb2ec93cdd3397b0bbf3ee109ed6a2d7eadbc6388c24bc059f1065ab10015ce138
SSDEEP 12288:AmJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:AGrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1E3652375AF0F54EBED2A8339E9620716D99C0DDDF201263BEF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 7c86c437420fe2716f24f5549f242ad01ab04bc1e131d87758fdd2f8445725d4
MD5 e800427f27085035ba35afac1accb101
SHA1 6539006bf5550f432b6b8bc893c694c5d5ce3e39
SHA512 719256106ca173ebd099bfcfbd6f92b9352b2dde9a79530b8bfb10e4cc1044a5fe74a5072b256f1f99d7a1e87488a54117734f152f43a8d36623418f34c97d31
SSDEEP 12288:YCJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:YSrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T11B652375AF0F54EBED2AC335E9620715C99C0DDDF202263BAF3E2E683B35C5A1152221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2202c23240143650591b1603d2e23eae19e5bcb891723efec648efd41f152dc2
MD5 193d1dd7aafcbfa0036becead55a3628
SHA1 5ad90e866a97254c514b8a371fbd69d5d760a03d
SHA512 3c03f59b706a8f5bfba0caacc1d21b48396f5d5e2fdbd4f6593f2dbae4264534f2bcb6325b4d70a80fab2f1ae7b9e173c0ab2382998c1ad10618df49d5d876f0
SSDEEP 12288:jyPz5L8dJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:OzyzrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A1751257779630F9D5378238C8621A02F7B57C7953208BAF5B640B7A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 bc26f89e45b15a49c951b6591348f427cf38b58e8beae04ebde4a142ee4258a0
MD5 cf5dd7e2890a654a0013737c923c3ba6
SHA1 53ba99ce4d0aa43cb8322136d01caccc35f20eaa
SHA512 6d58c82b2271d9706218f0e8f3e2fd6dd7fb0672480f41405290240a6a843876295eab4a244a3c7c70b95b1c6148d57a4ad75e3889f47a641cd30d0b21a34042
SSDEEP 12288:VmJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:VGrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19A652375AF0F54DBED2A8339E8620716C99C0DDDF241263BEF3E2E687B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 2cfa89e469e741eeb464601a8238efa7a287062269a8d8c6e33966633cc90d78
MD5 5503783d36c9a869eedd86ff28170f48
SHA1 f1bf8a610c632c4590e7426e801dedf21f4dcb6b
SHA512 3f197dd5fc239269f384daf4efd51d3bf591b84ce8b04f2f9a7b6431f8f0b2a4c44beb9f29b0692fbb11ef74b6a7bd0101269ea1dd473dde7ff5e35ca61a8cbd
SSDEEP 12288:UmJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:UGrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T14D652375AF0F54EBED2A8339E8620716D99C0DDDF241263BEF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 2d5b3f44d2be7f37866fcdc1dd5d28b84ce40b9f1ae06bcfd1f94daa805ca3f9
MD5 dc7a630ae14720b157b1670690c53366
SHA1 58bab1febf93f996d9f26b087614c16932c8a61a
SHA512 62cd4c1f1531e36448bc43afa86bc9163d914976191412ed2e233fff1f33827f560ee6384a19a88078430935a1a2eca36fae762d2b60d2a530cd754f3de0eb66
SSDEEP 12288:eyPz5L8dJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:DzyzrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19D751257779630F9D5378238C8621A02F7B57C7953208BAF5B640B7A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 36c9513bdf5668d6c1483bf3916f948ec1cfc709973fe6055f066a72546fe216
MD5 fed900bdaed4ec4a24df8a3e2f191955
SHA1 5506a88d2115994778915b7baae96a7c7b441d7e
SHA512 5395b7c7da947dee9769067886fe4453a1136f1cd13dd39a3c195f619ab0a67cbcaa836c38ce7fcd7632744ac81a9d5a1af0dd8de9d0a21a8ddb6bdab8f2b027
SSDEEP 24576:uTdaLl3z0zDRrKhxr+EHNmT8oW4ll1JCrLKXI:uTwLljDhxSMmT8oWgBCaX
TLSH
T1DD8502A5B35018F9EC67823ECC628916D6F27C5A4760C61F07B8366A5F333A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 d9d8d53b776b623024713f0442e8c97a5bbabdadbefd65f8150bf25ade9ab9b5
MD5 8b8fa0141fd30aa49fbf46a418485810
SHA1 002b0f25ccc94c60ea54776a919a1d8960eac89a
SHA512 b465df60f952c03dc15c1b89082811611ff192fea21b60ba6f7f62c22f0169024c64d74c20aee50cbf700b7868da42a375153cabd3f31618fe8a6f2ae6446884
SSDEEP 24576:q35d9CHKy7GZVrKhxr+EHNmT8oW4ll1JCrLKXI:M5d9CHKyaKhxSMmT8oWgBCaX
TLSH
T18F95CF90F3E414E9F0B78A35CD724511DAB67C995B21DE8F03A8265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 5abff00aa68dbd625292e666adcf9ddc591a93851c5b9ac88a9bae9bf62ebdb4
MD5 72abebf0b15ee4eec0107d5854327e99
SHA1 c6a14036c46a4757b80adde8ed795a48c7d68dc9
SHA512 20f110b09cd893a2603db09c984b260b15b22daaad57089ecea6c29f0746713fffe3e5b0e28cfb609eb74dbc55683f01a150a1dbc73206f51785598fdacac8f4
SSDEEP 12288:nfJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:nhrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T12D652375AF0F94EBED2AC335E8620716D99C0DDDF241263BAF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f4e04d19e3384d0c8045af1f73697c4c0e731805b2985a559f02b93eda36c2a3
MD5 ee9ca077a44b88dd187679fd8f17899f
SHA1 bd6d81b7853b04970fa480285d9b82a32ace9381
SHA512 9f5621bd0e7790e16b8cb3dd5e23b66fda6849cf2242eaaa1b6faeee02ca5b2e2ff3459bf7a55bbfc83c4f3a915aa0f375051ede4ecde5e54387b445aa1d5eb0
SSDEEP 12288:Y9JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:YTrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T17A652375AF0F54EBED2AC335E8624712999C0DDDF1011A3BAF3E2E683B35C5A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 33d476d7d6a92a75e88123227eaaca30d8f9e3a46b01c518fee66ea363e6863a
MD5 bcf5a140927eb8c75d2cbf45f9539d14
SHA1 55edb34cf655fb173066e4b7a5051f66d8303d25
SHA512 1415c93aa3054d3084e52731f1665364d5fc09af2f0f3abd299eb8d8fcef41b8e3592daaeaae469c94b758ca043a5f7006af282aab872fe5c52c83706ee09e22
SSDEEP 12288:NcJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:NIrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A8652375AF0F549BED2AC339E9620712D99C0DDDF242263BAF3E2E683A35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 1b9bd915fc3501f27b2bc650606a922e397edbb06195062b11a0613e16d77e19
MD5 16988bb4cb80efa9a21d3bce5ef7f092
SHA1 0a9db29073c808c94de197133eeb2e1a6b2fa2df
SHA512 cb6120b093c74daaf1075984b85ae6343f019843636d5ec81d2e75c8a1fa5801ee6f1b99dc63c9a53aa74fb2fbe89c711ca3f966124601e9e0a88049dacbd6af
SSDEEP 12288:zmJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:zGrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T117652375AF0F54EBED2A8339E9620716C99C0DDDF241263BEF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 9a87fd47a5c8202f69cbd4e13444087565bd12f25c97df8e28cc96132dc4e4c8
MD5 c40cd3f6e3d4b05e273c1b99aa996f0d
SHA1 9ba6b2d8cb563f8df0b395174a70569be4dac3d7
SHA512 6a0f883a03382324d6e26160c8705eb3286f4c8e8e2a602f5a4e5ee01454babeaa667f529058b620d2a46144c79e8a488f77c6291778f80ced5335136bbaf722
SSDEEP 12288:bfJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:bhrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D3652375AF0F94EBED2AC335E8620716D99C0DDDF201263FAF3E2E683A35C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 b5a3b1afe520c51f9bdd495a53f4200831f79229dfc72e6be508aac86512f425
MD5 746936b4cba28542578ef67ab9bbb294
SHA1 2dcffa2e3b4a579b6e6a4421c577d902a1149e65
SHA512 b2f23906ef8755fc89828eee23f176913a13b2bf664fa004a300f4a362bb23c9e39ae9f5a8088f857adc717a95e909e228eec2d1c5bd20d5a3ada23d15a3aede
SSDEEP 12288:Z+JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:ZerKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T14A652375AF0F54EBED2AC335E9620712899C0DDDF242263BAF3E2E687B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 14fd0d98f35772d0207b189d33407acd7aa63ac860efba58d6f5cc2832178c3b
MD5 3264a9fd45fa3c37ec402651ae710639
SHA1 28b1cd4ad7e58223b8a0b951060329d58144e095
SHA512 f5ca908f55a1ef3644dd4d82e638c8c9db167da6b43bb3965a453b7f81c2fd0f8bfbe60ccf1f1e1eee859a9b0c7f8cfc13a4a6f8ac1714741a0732c7fb2f4667
SSDEEP 12288:T4JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:TUrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T17D652375AF0F94EBED2AC335E8620716D99C0DDDF241263FAF3E2E683A35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 08c75fd7b6c85de78068dd696060705b18c3d27cd170a4758f4da5b0bbaaa572
MD5 421f9d4def1e1afeaa2cffd09e66514f
SHA1 d66229461ba14c53004e59d167a482550dc84df9
SHA512 6702a2f0550dd2c03e5cc37ddc6f6f8f73d3febc1b2bb48e0f2a72363713f78877f26a39aee0388a04d2257a97e4fb3f05278fe7223d8de1b693f0ec9786b1d4
SSDEEP 49152:wP4m4IpOO67/8KThxSMmT8oWgBCaXjarSj8RoTCCW:IppOOiV+M4FHXjJTy
TLSH
T10EB5DF2DABDC0096D0BA923885658A49FAB1742E1F3286CF1160937C7F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.3MB
SHA256 864dfb0bc958bb1adbca0587e50990cd9a101fd21ad4c192bccd02aa0c27fc7d
MD5 08e1bb61bb6c9410c6320cfd1ef22f7d
SHA1 f3ec873c9998478e170534b72106b6454e52a3b9
SHA512 b7d86f8290a62b4fb1403d5e57669ab653b97e4f6b0549e9696cdb5c8a930ef1191ee79fe190f1bff7f24e129455f41f3229423d78d4201cd9e1eb51235e7b41
SSDEEP 24576:qWrKhxr+EHNmT8oW4ll1JCrLKXIfaKngL2jdshRTdG1YxITqvfPkbIcbjLm:2hxSMmT8oWgBCaXcarSj8RoTCCW
TLSH
T162B5226AD78802E8C42E6334DB525A05B7733D6892D2838F8BE0F97D1F766905DE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 bba62c08d68d644bae9c6694aa3152c7e7a43bdb0c44f66c1ffdad276a8dba12
MD5 46cf1f2ada28155c0bc74b98a5456384
SHA1 5ee33b4d592ecae04ae338c4908a4b7437980e71
SHA512 6476e5e12a19dd20c0810cd5cd4e94704f8e688a4305b9306715638047d2a514af842089a6f03a2b296a106b00258669a4f996e1a49ebf898130be0e9ecf15dd
SSDEEP 12288:F2JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:F2rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A86523759B0E985BFD3A8334E8228331595D2DACE301566FFF2E2B6C3A30C565D62712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 bf481f81eec4e330b910e3aa63ad4ce97cac4bbd57e90fb70946e300672bd593
MD5 0f2a1c82d9e4fa5f8c5625fcb3543978
SHA1 6e7621ee4b63211b76e667f6634b01a32e1e6a1c
SHA512 8f6a7657d5022af4064cadf62b8260568b473843f5530c8e84166a497391ddfba2ab5ecdee0fcc2575a28de4bab5201f07bae06cc6d0ec7124c03a7d624ad638
SSDEEP 49152:wa0h2GEkuAe73q3pp46zwwQnhxSMmT8oWgBCaX:wa0hNYG4Jwq+M4FHX
TLSH
T1A485AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 a7a924704c78871ca3a8cc90d655e9315d9a4367553cb9c92eabf9108d064d6d
MD5 74a3aa33f146c9c2adb8e2f74248309c
SHA1 0640b37af85bb0a5df2c06876b0ee40aed8c3aa1
SHA512 9187891b186bc9678d5e848809003622370166689d1c51b9817aa81e083ffaff91ae0abbeeaa3ed4c23988306ce21c601f942ee6ef06656d17f71730cc65b300
SSDEEP 24576:VhbHjPnrKhxr+EHNmT8oW4ll1JCrLKXI:VhbHjuhxSMmT8oWgBCaX
TLSH
T14175017E279D20DAE936D23CD9528606C771BC691311A3EF27A682781F37DE81C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1848f817e8f7f1923039e51b21e5d76e042134be9b50da8f1aa271c02f237398
MD5 4da9315344b20b6dd20ea81fc74bcfd1
SHA1 52a52c2c2f1cfe0927086e1dd52d146fcb75a384
SHA512 ca3fb1f5b490bca48c3702d5aa36e29718e7d41c60534ccdea18871acde5bc88b0ee2f2cf8217dbfe34de1ee5f131bbea5f70ee85bb88446f73198e8fa2f2c5d
SSDEEP 24576:c3YgnJcRTk4yti+R5dpR//rKhxr+EHNmT8oW4ll1JCrLKXI:cIgnaTk46ppR/+hxSMmT8oWgBCaX
TLSH
T1FC45BF2DF3B910B9D8AAD236850147B5FB71782D1F209ACB0170C538AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 977371697bf39f691001184d04bf6c99eef16a389704c7391748bec0fbf1cce4
MD5 b5b5558e81b93d57434ac0cc69ccd166
SHA1 1cd4ff9b05711c1a472d4531ed3a5bdc6b696f70
SHA512 e9641e3382e4657443875279e6c569c8fe9cfa6aa18ef167f7d546fbbead77a3aeff49d512d04fba5149aa725d0da3c23326bb57196eed8c3fbe730c03da3f62
SSDEEP 12288:7SJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:7CrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1266523755B0E689BDD3AC339E863471599880D9CE30217FBAE3E2E683B35CDB1572211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7676656c777013879d277e907855a5f8a562bc1ce589d4400a138d4975cf707c
MD5 c174a537fcd244649d82b1adb49fee6f
SHA1 87be04dcc5f54e8af9a60d36a7bf4d7781a74e66
SHA512 d260035c634092f748789527cf5d9ffa92049f5bd735148ddd21e1e12d6bbcd4ad55ba7fb68457e4724d05b420d9684e516abe2a06d7611bf046ec5e00d03fb6
SSDEEP 24576:ifL3UTtrKhxr+EHNmT8oW4ll1JCrLKXI:ifL3UghxSMmT8oWgBCaX
TLSH
T12E95F155E79500F9ED7BC23CC9628A16D6B2789D0360E7EF07684B651F236E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 590ff9e474940538d0e9df861e51d77ef5a7e1ddee9278baffefeda135c02d8e
MD5 b41b221c075cbbbd239a6ee99b3e6e25
SHA1 dbeac2f4a1fb5bef68b3ebbb6826e0cb55164a21
SHA512 5c112412ac61e8fb42912df831d2af8d1927d16029656a1325d1ec20ba413ec91407bf74f684fd54e60cf5137517e838de59b3d81a47d090f33a5743ad8b5851
SSDEEP 12288:ipFtfO3JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:yO5rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1F2750229379D10E9E93A923CC9934309D7B17CA9531217EF46A085BD1F73EE86C3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4be01c6625a095ee5feb9c297ee9ff749731ad9a13625243293cd4dc18767a27
MD5 26eb19ffd1a4ac1d2fcdabe802e7c239
SHA1 3ef80205c705726c848003ae439210b35d202f5d
SHA512 dfe5329474caff8f7c09cd06922e4c962c82b65a605f20058bde948266b6ebd9889ccda584a94e3cdf237f9a7084fa73680a7e2d23aebdab7b8c02f9cce2aa2b
SSDEEP 24576:b7NM9YmZqmWMUkPjZM48Mv6bEhsGrKhxr+EHNmT8oW4ll1JCrLKXI:b7cBWMpPjN8DbEhmhxSMmT8oWgBCaX
TLSH
T1E8659E2E6BAC81E5D477D13DC9A28206F6B1B4651B318ACF1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 cebbf613253b72162d36ad1089b5af8445ff832b11826c5e4ce30811c905fafc
MD5 6749f345c60e5f295974f1f1b0c80831
SHA1 b9523a84e60587f7eaff83634c606b3329d18778
SHA512 42850360e660043bab1b16d1415a845c1f4579b7420f5b39454a7307cdd4dc46d21d40a1a1f70d77ba442441395126fa38231c4a9861f653ce218ec47e91667f
SSDEEP 49152:7F2YuHNETovcvNYf8kmphxSMmT8oWgBCaX:a6tCf8kA+M4FHX
TLSH
T1E3858E2927ED80A4E0BBD27D85B7D246FAB2B8551B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 56780a3c9dd3b5d1a5039b43278b30450bf1edd8a8d4f352a512da85d610f0ab
MD5 f50cd6a727808dbb45efbecb9bbfcea3
SHA1 ba3d990e41926b24243e29029e1f8dd022ac9cae
SHA512 25980911c4367902974f92ec0ba770e012889d599bea742e4b6c27da5a7934d0cabea92c792d9165e81c2a7ee8dbfee86b810ccb429628f409f088821ffa29ea
SSDEEP 24576:+AFs06+Omlf3NXEbToVrKhxr+EHNmT8oW4ll1JCrLKXI:3Fs060lVXuHhxSMmT8oWgBCaX
TLSH
T1EC65AF3F66AC00D5D07ED17E8997C91AF6B1746703215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 c156750c558e1bd2590055b63cfb4c64badaae7eca1b5177d56192048a315b7b
MD5 1f362af6d344779e1f1c6bcddd435075
SHA1 ec15d9c7855a1f3e4e66842786a1318ee27c8f71
SHA512 5402f0cf8bdbaf8f2e868be7d277e9c0c37c98c938360534108d75b23d7f5acf2242234971514499224901b4fc7b1283daa203d33b2856985717096cde980145
SSDEEP 24576:DJnJ5D3WL0rKhxr+EHNmT8oW4ll1JCrLKXI:DJnJ5DGLHhxSMmT8oWgBCaX
TLSH
T1F085D03DD2A810E8D4B7C374815A1B56FE72387D2B226ACB28B4D5353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7a94471201e17b240e3eb465a57b1232250ecb6a0c2e30585cb3e6d1c59b962b
MD5 3236b0b7d9fa1a7c908f47431c0125b8
SHA1 ddc278ad670d1b8d184c1f619ba2932f22d44a16
SHA512 996b784b4dc3c10c3ed9398d966d3037fce594c15ddb5484ddb64e319e76426c8baeb3d831bf6b4b6cfbf2e4913e0e4522054fe0a94d6c3ca7e32d0de732b522
SSDEEP 49152:bo06DIKdwc+eQnSt65aV9hxSMmT8oWgBCaX:07+M4FHX
TLSH
T12E956C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 918e1fde01aa8f244867ba11f8290be6e9dd3a2819c5615fb7245f6d3ddacc90
MD5 d3c396291f716e3719302197f317de1c
SHA1 8a87bf62e8a940529e5bfd3cc28d0543500ee53f
SHA512 ec7958323aca0e75f9533cafe6a21c2e09919e1cecf9744137a4083c3f782c69707e26628889e047fd58ac401c640575958d2d8c004ff60ffe1d1ba7dae2e009
SSDEEP 12288:HEP3RBkJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:MBQrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DC75126D2B5D70EAD92A913DD4A18605D3B2F4B8630227FF5AA5823D4F33DE91D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 04b9af84e995b7f0f24488255866dd9b7b67e8a88f4d5ea05847a18b56423d8b
MD5 5d0853ebefbc6c286538f94eafcee40f
SHA1 8f8e3d30ef6a3d57484fbaa7d4c646fc6362b378
SHA512 376890b7a89a0d66546e5f5d93d78342ac944949e837189777ef3152163a2a2f8e2c95d46a8e4b0dfcbac84fcaa950a14fd076c7d023e8c9f7318585c527e58e
SSDEEP 12288:BjkyhJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:BIyXrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1F2751218638860D9ED7A4238D97342619E747C24AB1157EFA9A0FB3D7F32ED46C31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 bf6c7825b744d159aab95853bc3062fb2d9f4c03ced25ebc5f9a45cdca7777ad
MD5 bd3997466f065bfbffe753284c63becb
SHA1 9fc279152c84f909cdb8d61ab9c1a07bc63ba97c
SHA512 fc8a316105942993bde909f8cf30fa2026ae81c9d10293a878b59e8ca7d0b63daedf3685e6a3c1a7219692ce5d9476f97eeef39d3aedb8994130d1f31598e948
SSDEEP 12288:GrHJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:KprKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T17665237C5B0F74DFED268338D932471195A82DBCA30129FF5EB9AA786B35CC61172A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 82b3ef9e05cbc85ce635bdd71b92af6d221b0f77e8165cd2e024caa5831421a2
MD5 0098780a4bd4661af0a78a0cc05d1131
SHA1 1467892919d9bd9970310a0ff8238bbbbc25859c
SHA512 8a99954c967dbcad05e233f66a5845eec8388ee1dcaeb555456ca290c04ccdb2ea4b742b245e26997234a0414bd037841c22c09e13b9edba35f1bf39e036e914
SSDEEP 24576:QQ9MxZKdcz97w3urKhxr+EHNmT8oW4ll1JCrLKXI:QVKXRhxSMmT8oWgBCaX
TLSH
T17B558C2DABE9059AE177D239D5A250C3A673B4301B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 43827a55381145cc65f5f36ade0ff7e3533c765789a9c305d91e5c05344fcb43
MD5 f711d7157b9485fe1981b91d6fef2561
SHA1 f66b5bb960e770f21a77a3c61463293c5f8f62ef
SHA512 47799ad283bba2d922c15eac279deea174d8bc95dec6af390000e10fd090a5f859cf57e5e90d7e161e86046542cb63c0a18c1828418f67409eca769f15aa19de
SSDEEP 24576:HyocbApDrKhxr+EHNmT8oW4ll1JCrLKXI:SocbApyhxSMmT8oWgBCaX
TLSH
T16D85EF1FBB6E40A2E136823CC9818305E7B3B4745B6267DB6691C73D4E239E9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f74647053fdcd5b05d4decb43f0d171067e73fbe9d4f6e3b35c43df124fcd2b3
MD5 59f567bcd24b6128170e69e5224d3461
SHA1 71469957d4ec283ac09478a4fe94d74bc86e1c36
SHA512 1cf91adcbd24a7a6e1e7444112fc52742174bc6af0d781c47a99f543bbb0cd81875dffc4ba40bf2c98bf030474f75793ce3bb503a7537c8a555d893d4599c9c9
SSDEEP 49152:OWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKyhxSMmT8oWgBCaX:o0zuNIO+M4FHX
TLSH
T10EA57B3DA2BC00A9D8AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 a715f9c8514e82ebf623c3c52d2a2e0dc3e44603797d6c9ab71ae8007a3e06dd
MD5 e5dfe8ef56ae561f76082c1f2f8eadae
SHA1 026606bd1f13479a1fa9a7e1b409433a4efa21b2
SHA512 386462a398f22f851b8c3d6efa3fbf2cff4cd65858d6b68833d2febae260310b17527ecab10a9e52516ef0846ee9ebdc471cda65d05aa03439e04cea6affd46e
SSDEEP 49152:Ca0h2GEkuAe73q3ppj6zwwQnhxSMmT8oWgBCaXVarSj8RoTCCW:Ca0hNYGjJwq+M4FHXVJTy
TLSH
T10DC5C01E67DC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37EE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 53fa8315f436ab27d4613c01c836e22a1d1d596e6debabaaf444549d2f760336
MD5 311c28de9e526a871286c638a600bd90
SHA1 53a5ddaebd0075fffcbcfbd73794107f9c136a4e
SHA512 4d225095d13d14a54ea6d5e17768edfc13f1574b4dc5d9deccdb6606ff2296eb88d963a55777579188ef8601b03ab05520b9a661d1066c48497c85592be56278
SSDEEP 49152:+TDxR+N5YzTljMghxSMmT8oWgBCaXHarSj8RoTCCW:Gu5s+M4FHXHJTy
TLSH
T157A5E22EA7E815E9D17EC6789A23C506FA727851033193CF42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 2.5MB
SHA256 ae6b9c2540f2f379bef01ca2c6f2852036f13dd1323b27d0dcb941b63c7f90f4
MD5 3ab0040ed75903fe734e321a07a2ed59
SHA1 43b502c4364ee771547a71f976768b0e9f29ed14
SHA512 ade0ac8577302b41c8aeeeb43b18f5d79aa2a7ae325fbec27165af1d906d5b091a674ced7b163b079bb68a1b540d5d5d595a214cb9e4bdae35328e68944ea5b4
SSDEEP 49152:e0K+LmSLPhxSMmT8oWgBCaXqarSj8RoTCCW:t/+M4FHXqJTy
TLSH
T1A9C5027EA79D14E5E47BC23CDA538906E9B23865031266DB46A0C17D3F6BFE43939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 3ea99c653d309767ffd07473ff48c34e7323b3dc4a852d09af5fd39c695a3072
MD5 23c380a14e518437dd223d8f964cabda
SHA1 47360ce3d8901b3451436f3a68fb8e7d25f9e3f4
SHA512 5345e148bfdbd541ff3dfcc453ae9d6a75bd6ec489140f000accd0dacba48cf69d4ecca71f2d942baa2acb5f204b0baeab040f5039e99f70edf2ed960d9945e4
SSDEEP 49152:i4gnaTk46pqR/+hxSMmT8oWgBCaXzarSj8RoTCCW:iHT+M4FHXzJTy
TLSH
T13A95E12EF3B910B9D8AAD236450147B5BB71782D1F219ACB0170C538AF1AEE85F35F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 2.2MB
SHA256 493d5e30e7f990e624a51a4fa4b1bf3617d93bb7c3667b2d63a18e3b5e303692
MD5 cdc3d3aa09a714fab020b792197391c0
SHA1 e4295378902666720ee4a58b8e62e82605f2c556
SHA512 6d241058bf314c487d5390f19c7ede184d2d6983694e6ce62bfe11ef4e6d92dae84841065b8e20088e67a7e4cc1fba3bd6b566fc4e2ad9062c0209b8d93b50f5
SSDEEP 24576:JtrKhxr+EHNmT8oW4ll1JCrLKXI6aKngL2jdshRTdG1YxITqvfPkbIcbjLm:JUhxSMmT8oWgBCaX5arSj8RoTCCW
TLSH
T1F8B5236EABCC24D4E8379338AE72460959B13DAD630217FF5DE09ABC5F36AD45538700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-79-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/628-77-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/628-71-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/628-197-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/852-176-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/852-182-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/852-185-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/852-427-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/876-220-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/876-101-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/876-102-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/876-108-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1612-272-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/1612-512-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/1612-269-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1652-65-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1652-184-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1652-68-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1752-283-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1752-290-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/1752-326-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/1752-284-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1752-306-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/1752-513-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1752-664-0x000000000D290000-0x000000000D298000-memory.dmp

Download

memory/1772-259-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1772-139-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1808-260-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1808-511-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1808-257-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1808-251-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2708-235-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2708-113-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2708-122-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2708-119-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2772-93-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2772-95-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2772-88-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2772-90-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2772-82-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3224-681-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-671-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-669-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-683-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-682-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-672-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-668-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-667-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-670-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-676-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-680-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-678-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-666-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-673-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-679-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-677-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-674-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3224-675-0x000001E2E3BF0000-0x000001E2E3C00000-memory.dmp

Download

memory/3348-233-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3348-227-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3348-507-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3348-236-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3660-510-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3660-248-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3660-245-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3780-142-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3780-148-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3780-271-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3780-150-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3792-460-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3792-159-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3792-161-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3792-462-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3792-282-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3792-153-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3900-189-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3900-195-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3900-198-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/3900-464-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/3996-35-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3996-43-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/3996-44-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4080-225-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4080-223-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4080-221-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4080-218-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4080-212-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4124-475-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4124-209-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4124-207-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4684-98-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4684-99-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4684-56-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4684-47-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4684-55-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4780-405-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4780-173-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4780-171-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/4780-165-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/4856-125-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4856-133-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4856-247-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4856-131-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/5020-27-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/5020-21-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/5020-121-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/5020-28-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/5020-29-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/5032-406-0x0000000003820000-0x0000000003887000-memory.dmp

Download

memory/5032-8-0x0000000002F30000-0x0000000002FB5000-memory.dmp

Download

memory/5032-624-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5032-400-0x0000000003820000-0x0000000003887000-memory.dmp

Download

memory/5032-67-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5032-15-0x0000000002C60000-0x0000000002DA9000-memory.dmp

Download

memory/5032-0-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5032-14-0x0000000000CB0000-0x0000000000D17000-memory.dmp

Download

memory/5032-16-0x0000000002F30000-0x0000000002FB5000-memory.dmp

Download

memory/5032-2-0x0000000000CB0000-0x0000000000D17000-memory.dmp

Download