fee12d94db1739165bfa5d8fe7056ba0226dc837da00041cf2d40b493ecfbcb7

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 2.8MB
Sample260930-ezzcxssw3m
SHA256 fee12d94db1739165bfa5d8fe7056ba0226dc837da00041cf2d40b493ecfbcb7
MD5 22f20e91eb6c579092bc9680d7724a42
SHA1 30ce43a1e9f1f66bf5f36e9532393236e3a3c7f9
SHA512 13254a19e0a4072e7e6bd30f5a4463daa628af4526fca07df775ac74940859781a26e6559816266ef4801b3f3bdc62432adc7e0dfe35ce990c637e239814dd3f
SSDEEP 49152:XrxRP9sg+B/V2j+JFhxSMmT8oWgBCaXGarSj8RoTCCQhxSMmT8oWgBCaX:X3MBV2e+M4FHXGJTU+M4FHX
TLSH
T1E7D5CF1277F99129F1F37B71EEB883645A77BCB5AD39C50E6280215E09B4A40DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4556	elevation_service.exe
4856	elevation_service.exe
2784	maintenanceservice.exe
6104	OSE.EXE
4128	PerceptionSimulationService.exe
5688	perfhost.exe
2328	ReFsDedupSvc.exe
1572	SensorDataService.exe
2428	ssh-agent.exe
5600	AgentService.exe
560	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
	\??\F:\	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6ed6bccc3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000093de-456.dat	upx
behavioral2/files/0x000100000000934f-455.dat	upx
behavioral2/files/0x000100000001b93c-458.dat	upx
behavioral2/files/0x0001000000009b92-461.dat	upx
behavioral2/files/0x000100000000a0ce-465.dat	upx
behavioral2/files/0x000100000000a304-470.dat	upx
behavioral2/files/0x000100000000627a-474.dat	upx
behavioral2/files/0x0002000000019c47-475.dat	upx
behavioral2/files/0x0003000000018976-494.dat	upx
behavioral2/files/0x00030000000184ba-479.dat	upx
behavioral2/files/0x000100000001ae47-477.dat	upx
behavioral2/files/0x000100000001aefa-476.dat	upx
behavioral2/files/0x000100000000bd44-473.dat	upx
behavioral2/files/0x0001000000006223-472.dat	upx
behavioral2/files/0x000100000000a319-471.dat	upx
behavioral2/files/0x000100000000a2c1-469.dat	upx
behavioral2/files/0x0001000000009396-467.dat	upx
behavioral2/files/0x000100000000a1d4-466.dat	upx
behavioral2/files/0x000100000000ba34-464.dat	upx
behavioral2/files/0x0001000000006215-462.dat	upx
behavioral2/files/0x0001000000009cfe-460.dat	upx
behavioral2/files/0x0001000000009cd6-459.dat	upx
behavioral2/files/0x0001000000009952-457.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005a16cc859350dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010b7ba809350dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eed26c829350dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000318e4bb9350dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4556	elevation_service.exe
4556	elevation_service.exe
4556	elevation_service.exe
4556	elevation_service.exe
4556	elevation_service.exe
4556	elevation_service.exe
4556	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	5600	AgentService.exe
Token: 33	560	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	560	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	560	SearchIndexer.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4556	elevation_service.exe
Token: SeDebugPrivilege	4856	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5392	2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 3060	560	SearchIndexer.exe	102
PID 560 wrote to memory of 2736	560	SearchIndexer.exe	103
PID 560 wrote to memory of 252	560	SearchIndexer.exe	104
PID 560 wrote to memory of 5804	560	SearchIndexer.exe	105
PID 560 wrote to memory of 4072	560	SearchIndexer.exe	109
PID 560 wrote to memory of 1756	560	SearchIndexer.exe	110
PID 560 wrote to memory of 4668	560	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_22f20e91eb6c579092bc9680d7724a42_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2784

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6104

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4128

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5688

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1572

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2428

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5600

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4072
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4ba8225f931c7ee35c3ddfca5996b7fb0ab286ae0f3ca19468ea3bd6f13eb78d
MD5 1dc47745322db21b935cac2d3dba273f
SHA1 ae3c2bbb8cf26d19915e5ca702c9e2f0d7d28d96
SHA512 5d10263cb34f2c75b0eb2a609eb0d71e2daa35d4bc6635ef191a98496cffff9df1e96aa46bb1a098182acd79dce225d36763031fbd8dd7140ad7caef8d5175b2
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnOhxSMmT8oWgBCaX:t3q6HjBH+M4FHX
TLSH
T18BD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 1cbd95de70816dda568b6f4cdb522c8f2b07ce6b595c26a27b5f82b51bceb5c0
MD5 77640a2234ddf2653855653d929a07ec
SHA1 6e9e6587f77b0da2ce86cdc459095f77ea3ddc69
SHA512 58d01dfcf25b09c5957190cad6d21458967f8a0a72d984ec0c25918d34b2c7d9b13924f971662521e1f7bb108580a531055234166e6416bcbf349c0df1f72e0c
SSDEEP 49152:skcQhxSMmT8oWgBCaX4arSj8RoTCCT0hxSMmT8oWgBCaX:so+M4FHX4JTP0+M4FHX
TLSH
T1F5E52339A78548F9EC2B833CDDA28505EA733C988351E75F47B49A682F336D8193E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 49c8ff3615d62577f07048faebaf373dc5742899822059c1d12f3d6aaa3d3709
MD5 050aab874bd4e38eed548e55a6c085ea
SHA1 35f82585ed090a52f0e5aff498f051c3df4ebb88
SHA512 2d17d1ab0ec0c571c763e28c3a6062756425a5c61b84e104fbdbd94e21adf35970021bd917b9ca036a4fc64f0175c87139a9e11ec61ac34c0048e95464ac3f32
SSDEEP 24576:AXYfDtczAorKhxr+EHNmT8oW4ll1JCrLKXI:3tcQhxSMmT8oWgBCaX
TLSH
T1CB85012877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 3.4MB
SHA256 78c3dd93cf404ff01d98a11088a85ade532c1a1d70d1cc958fcf5ab655d3dc5b
MD5 59ccdf611090a07ca65d388f3d58014f
SHA1 a43e91e51788d40ca9e55bd191dfa4ff20c9af0c
SHA512 09f2778ac7fe3810802b053ff8644876567111b88d63095228cdea63eb446704c2507848dbe89116fdc9d627c5af4367aa2ad932a6622cc31d85a8582c78d331
SSDEEP 49152:JAbRquA/m2yL5zUfFiV+XenmE3/z5hxSMmT8oWgBCaXIarSj8RoTCCW:AoqlVjnmE+M4FHXIJTy
TLSH
T1D4F5BF1976A8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.8MB
SHA256 ea41ceffbb57e368ffadb0f95bb70cc21d26c24d6076682fad334a51e93b3504
MD5 b120f19717af6fdb9351908ed6228e16
SHA1 3e35dac8ff5891b0603d0d862c8a81e8709833f8
SHA512 c0932c59da8dd4df145dcdca3622948e462e763f6fdec745783ba4f104e2f2f53512106398dac148d7f2c58c9006be5b60c27d053b9c4a4f9b6f347051cbd460
SSDEEP 49152:DAMbFoiq5UhxSMmT8oWgBCaXcarSj8RoTCCW:hqa+M4FHXcJTy
TLSH
T1A395E091EBF945D4F5B3AB78A9B68570E9B2BCA95E31C20F1160D11F1E33E409D24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 abe6da935f1ba4afef157f69893ac871b089ae6cb8c65b6bfe1edcdf555b567d
MD5 c4de4f846227952efdd87a70cd18f05c
SHA1 32289fdcf2cf0004fa628afce9c43233172e2d99
SHA512 187623284e345f30735578faf799c857e109ea9ca4dad7455564b402e63fc149404af9c98c895c5cc87ef70dcc1852afdbf948c4d5a6479e43ae575ed1678753
SSDEEP 24576:dwuSOWKrKhxr+EHNmT8oW4ll1JCrLKXI:dw9O4hxSMmT8oWgBCaX
TLSH
T1AA85F14677A91CF9E9678239C557C136F7F2BC052621DB2F0770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 2.8MB
SHA256 13a99e78e3e47b795ef248f94f5471d5ab3ffdc21f701b485de2a83c8fb342eb
MD5 4994fb7dcfd6cba8a4a9c23c6e256216
SHA1 6ce54adf005c24b3700a1f19aa31fd50a7b011a5
SHA512 a2bfa0093b1dadd98b15e9b65df8281d85173e8802b2e555ca1b07daa03120195054aacc75bc4ca42df72b1093f460d8773e8ccc2a0477be47334bdff6de8430
SSDEEP 49152:thxSMmT8oWgBCaX+arSj8RoTCCT0hxSMmT8oWgBCaX:t+M4FHX+JTP0+M4FHX
TLSH
T145D5237A678860F9D9274338EDB25605ABE23D9DA31203CF4E751AAC2F36DD51D39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 7.9MB
SHA256 64f1c73b50a8aad9984c3313f2b696624b75bcbcfd069604c202b98becd0308d
MD5 8b2858f8e3158ebe1ce8e510839ade3d
SHA1 f2b1a8766338eb3464c1a061940b334adfd8a1e1
SHA512 f98f9414cbc08a92fac663a6d9b6c70d08371c407ab942d98006c2981469cc475280f4fe703b5483fb29355d9f6e8152e22c280f07f77c021c332a439cf76734
SSDEEP 98304:fQRQyi36YOcPELvw2gAf+PN3z+M4FHX+JTP0+M4FHX:uQyiKaGX+PNH4sJrQ4
TLSH
T195869D13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 7.9MB
SHA256 7033cd5b6b6d0af3e819359913cd9dd153f8658ac8fd2eff72147f1e3f26cf83
MD5 bd00b393cb4b7bdd6440d8609d0d6292
SHA1 82d355e404eb6dc29be8c8c8960a411ec2c2650f
SHA512 93584ede0c7dcedcb7a2848c6e883a69756c9844c3c685123c2b859f0e6ff8b89e60ae6412df39e4b2751b6c42630e616fb9763e7724faff5742c4a577b73a53
SSDEEP 98304:sQRQyi36YOcPELvw2gAf+PN3z+M4FHXrJTP0+M4FHX:zQyiKaGX+PNH45JrQ4
TLSH
T145869D13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.6MB
SHA256 eb700886588c7cc7dea7e40c62445c687e574905fbbe221c77d4b641041bb818
MD5 6668295448611b60e36128b6efeda534
SHA1 68723c0f30082c738153388cecf3e61ce879603d
SHA512 d620757552c70b3e6da78feb33243f317a6a4dea580660ab0295b1d082f4ff1d531c68124c9d476b51683c3e1092bc9884c8f2b47e5da7b2ee0f8be556dfcf21
SSDEEP 49152:068Qg55nhSeWu7PNU3/JhxSMmT8oWgBCaX9arSj8RoTCCT0hxSMmT8oWgBCaX:ethVRc/J+M4FHX9JTP0+M4FHX
TLSH
T11006AD33B2E600A9C44DE1369F46872196D27C75CFE1E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.3MB
SHA256 bd6193b3657a57408f07a80b1994829324d8ca6ccf31ac947aa34d57788964bb
MD5 57bcee236b9934dad03bf828de9b7009
SHA1 9a814ca418c9e7c20ec53c229ae8fc8756ffa5a9
SHA512 03e9b9f3d9dedcbb44ae37cb079acb76b4acfb9cce24aa3603d97942453ad56bb6e27e505058b9133186179f356333f3ce0121ade7e271612f579762afe1cd98
SSDEEP 98304:Gy5112gYy5azzVvf69nLKnhZi+M4FHXzJTP0+M4FHX:3LIHSWh44tJrQ4
TLSH
T11B46AD13F69900E8D01DD179874A9232EAB2BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 38846f40509cb3e2312cc5b62308c3bb2fad941866c50eb91ac90427c9f56207
MD5 197d1f0e2ff11b2d94d0cfbcc4a301ca
SHA1 5135bdd2e05caaf0ee49e9f986d66854f5f4ad1e
SHA512 78c480a6126c8a5e7e229530637764db384358e90fae5179afd386bbdede3c05008aebb1381bc5623cef9caaf2fa04b6243aebe0e216e450f826885101aa3f99
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glLhxSMmT8oWgBCaX:Pu6JmVxd2dL+M4FHX
TLSH
T1E3D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.5MB
SHA256 f23db64d83e46547136efbe9663ed649c9701eae463daee9843cf4dc759065b8
MD5 2ce1f5057e1f6031645cfb2955e6a2d3
SHA1 1e19381c71fae40a7eb9edfdd4540e0b39b9c5a3
SHA512 e463356c476a1bd75fb820548557558ca5db68b749710291e6d486d1e72194998204c787e43a875d26cbef283f8d5d54162a522a9977206cac2679d0c36280ff
SSDEEP 49152:b1hpsNoJpF1A6tU44CwH7R4xPhxSMmT8oWgBCaXEarSj8RoTCCT0hxSMmT8oWgB3:bmifPgRE+M4FHXEJTP0+M4FHX
TLSH
T1C7F5E013F2D900E8D06ED17887569632EA62BC490B21B6DF0A90B7952F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 3.7MB
SHA256 1098ab7665bd03dafe0de909e7c5b4da4f9240765878446454db5248a060bdd0
MD5 e42eefac81e2e730f41d5e9c8af44f64
SHA1 902076fd445970625cd299828bff6b4b22d3cd9a
SHA512 9954a575dd81a3ed3b979867db5592d08d954fdc689234172b81233efb6829a1172978d64737403c3ab1daeb45c59dc757d03f359cd1537bc7e3a20942f020e0
SSDEEP 49152:pSuZQIY0Be2KWRVtOnks6NMHqehxSMmT8oWgBCaXZarSj8RoTCCT0hxSMmT8oWgh:n5dKEi61e+M4FHXZJTP0+M4FHX
TLSH
T1C506E013F2E940E8E0BED6748B669232EA72BC454B34A6DF065072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.3MB
SHA256 c938a5a29ec69e4e9a644cf742127ed3b1905f4f0d0cc20e67813900a6dc35ee
MD5 9df6b7fef653313b1a7c0d9438a5ec00
SHA1 eda36289caad3e9e1999637aba51e1010f34b0dc
SHA512 fe05af331dfd0f09673bbb28ee23df6d8040307972266e16ae742fa4182b0ee434938d6aabe915cd06308e60cf03484242ca54c243ef5fee13fd8eeaeb266976
SSDEEP 49152:XhtSn8EApI0figmgiDn0AP5wbhxSMmT8oWgBCaXTarSj8RoTCCT0hxSMmT8oWgB3:GX2i/phY+M4FHXTJTP0+M4FHX
TLSH
T1ACF5F013F2C900E8D06ED178C7568632E962BC154B25AAEF0A90B7552F7BFE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 2.2MB
SHA256 8981f4b36fc18b74a17c359ad0aed21d1501291a9ee7bb280573c295bce2d438
MD5 b9aa2e0d32599f8525eae2401452c6ff
SHA1 75ada10cf63ec9a06b52eeb73f8d137f4bc7a5d6
SHA512 b7b623d39c5bdadddbfa7c092eb858b7efb27072cc44c10ad7d2089d5a2a2415cf1b5d0fea1e92d01f5ce5bce239cd32400abbad6e029a9f5b27a4df21fd3736
SSDEEP 24576:2LrKhxr+EHNmT8oW4ll1JCrLKXIgaKngL2jdshRTdG1YxITqvfPkbIcbjLm:zhxSMmT8oWgBCaX7arSj8RoTCCW
TLSH
T164B533BADF8A89A5DD1B5734BDB39A0D2CD62FDCE003061ECEB52E5C397AA951139100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 cf0bfd1ab2715a4a426acb34dd24b67c5ff4c89f782fe972a0077250b901bae9
MD5 0cd4705eb02b7179a5db356909fb7e65
SHA1 44ec5c1708b5c68df60bcf30600c26b1ac23d68e
SHA512 4ee985bccfdf666d57aab1cbcb43acfff73c7242ec9eeafb3f5747fd0f9a43ea313b334777c06f2b4390c42a93d692138fcac7e83a370528ace19810261594b8
SSDEEP 12288:OCJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:OSrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T164652375AF0F54ABED2AC335E8624716D99C0DDDF2021A3BAF3E2E683B31C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 7ecb3b843b0937c2fa8e72be56b3b67b43beb4ec4782cc00386bbce75b915900
MD5 a35616c835cd8e4673f531ea2ad6e3cf
SHA1 a81599fce60f7d45d960911436c9c387db12e456
SHA512 c9bc98058ae08a557c963a7c0be0c6c81c9c553fec37329ddf66e7efaabd5ee6918de16d25eec0afc3a7b4bc20964354e4344bcc1ecbd2cb31493f2ad99c76bd
SSDEEP 12288:eYJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:e0rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1F6652375AF0F549BED2AC335E8624716D9DC0DDDF242263FAF3E2E683A31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 c42586e0fbdf4c1383069048bd0f0e723dce72b8ff666d42c958a88d6579b11d
MD5 6461b5fcea10b45e4140c4235a7339bc
SHA1 889963ddf687d531f82c727afe0f9124e6af35c6
SHA512 94c09be0b1e70aa48869b35029c86e4ba067830e801bdcc2552e42f70200d10c08a5501901907e3780d9148d54f7f09256716bb517473e62c911a7bab2fdb100
SSDEEP 12288:6V7JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:SrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1656523656B0E50DBEC27C338D8724612D6F93CDCE322277F9F251E682E31A996931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5db6eb520435e84486c7018ab973efc0c53d5317d5324f84de39024ae42610ef
MD5 9e0280addfb1ebecb66ca63d398b8569
SHA1 0ae0078648dfd25eeaee38db4801a8c5cffb6021
SHA512 88ff1f58f2e7bdeb04342c0f1f86d69e2f0d93530771ca299acf0ff87495f426e8bccafe1ec14b3268c9ddb4aa5f423cdfb349a040d4314043fe078df46f895a
SSDEEP 12288:vjJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:vlrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T18C652375AF0F949BED2A8335E8620716D9DC0DDDF242263FAF3E2E683B31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 5667c3413f1779102c632ffdf369fc9acfe352c2b4b6b53a7ffa879509546829
MD5 c60c415360b10716c988240f6198b628
SHA1 8ac895bdbd8d4365d1a1ef9d91fff860c5fce8d3
SHA512 4ec6b6322a07016c90e8018a0a2685ef9a1babfafb7ca0dcc73bd42c82cd0ea459d2b749b664044409743bbaf721b1f9ce736321c527165cbb485aa024499fd1
SSDEEP 12288:6OJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:6OrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D5652375AF0F54ABED2AC335E8624716D99C0DDDF202163FAF3E2E683B31C5A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 635aaab85c6fb727329deefadee570b0e92a356066210efc2561fc8722095336
MD5 65777f2314b5f29e6a92bd3110ad89b3
SHA1 6aa11d049213d3f2049ce49cce8dfbe74326cbd4
SHA512 6d9981f21fde815c08958bdfa57272e5b45da46a5ce37f431ffc64550eb9ea9d1ffafb91193ada5562edc083870f3f494ab045fba469e064d0925a56e09b9976
SSDEEP 12288:fqJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:farKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CA652375AF0F54ABED2A8335E9624715C9DC0DDDF2021A3FAF3E2E683B31C1A1052621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 bb93c50536a09d3e0bbf5c88321e197870339c36a6aac36121cc10110d1de94c
MD5 77e2faca2b63b66abfd53742d1bca491
SHA1 99ba619b764ed771165d08550dec893911fe8a82
SHA512 3164a427045270e22c3280647547edc4cfcf0d90499e858565057b4c735ef10062cfccddb0fca1a863a11b2500f70ca2fb9c1b8bfb56ee3b9c5d0a390444fb5b
SSDEEP 24576:3ZMEzFVSOyrKhxr+EHNmT8oW4ll1JCrLKXI:3ZMEzfBhxSMmT8oWgBCaX
TLSH
T1488502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 7fdc6ad7eaaf16cb6c16615f29880f6574bb5fd71fe3c1eafc8575bc7b2e27be
MD5 4585222efa0ec6b53a8c1e8444975b82
SHA1 35abe1ea6a9102bb702205c4578dbbe184199283
SHA512 98e0bdc6f96c3f4e0ebc8e6636896517928bfe4fc8cc625be0e83924b920531303dd6cf48440722df6d1a4a324b806729b057b0a17a483804005ac8d6b07f54d
SSDEEP 12288:jZJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:jPrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T100652375AF0F549BED2A8339E8624716CDDC0DDDF242263BAF3E2E683B31C5A1156211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 151eb3a26d63966384c10b65889ffdef32ddd9bbd49dfda577a2fe0d67a486cf
MD5 adafdf1b8a5f0b9f0038fd338c3d0486
SHA1 3b96dcde0d016a9b8b0ce4620dc5eda0f02f0fe9
SHA512 01e999d1e4c328871f7d153c483e2a0dfce2e121232c58bf6b459be4c184f77e7949163cd7f285d2b88a06212d085d8a73f36a939cee59d153b9f5e718039e00
SSDEEP 12288:oNJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:oDrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T194652375AF0F54ABED2A8335E9624716D9DC0DDDF102263BAF3E2E683B31C1A1156221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 fcbce2bb983bd8e48a7ccdb239e4665534e4f5b08a7563cf1ae0b5f9e9dcae9d
MD5 bd8bde6924df9a863406f0375719303b
SHA1 225481ec01f000d3fb19f101c6eee3d63608e483
SHA512 512e96868c98483d2c5f6871b91abf5f4eee6e4ff172510e5d66a3f801e58c56f21ac5acf072991386f303deaefcd8d2c0a5295281b1dd4c7b6dec65af3c1fa4
SSDEEP 12288:byPz5L8GJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:WzymrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19A751217779630F9D5378238C8621A02F7B57C7953209BAF5B640B7A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 cb80c392c5080d5ec0947c3837a6b02f6b265ee045261eeeb30a52c456096603
MD5 5e5020235741673709368e558b124dc3
SHA1 ae4dadace319c42f15961449bfa2cfba0296ce60
SHA512 1c78048b325611c7c8ed0c6e704d8ba87fdd37125787ec56dbdc7d8dd41ba3592ce567410f55ba9508b7a4de7ee2ce28cd8f5677569de17337abb87d5230ff19
SSDEEP 12288:8ZJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:8PrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T107652375AF0F549BED2A8339E8624716CDDC0DDDF242263BAF3E2E683B31C5A1156211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 4f177d79e8e3a1e2f41c57bd2c2e68b0a851f6d2ecb36441f47bafcb0243b3e5
MD5 aacfab6c7c5db28bde83778d3b0dd687
SHA1 473989601e716e283cf079f2de20fb898f5af26a
SHA512 35159ffa658b2eff8c34cc3938e8aed45abf9fc4c28601f892405acc8008cb46836aa8de9c521f554a516088a22cc59bcc24fc74210b1b0fc6908595ca58056a
SSDEEP 12288:+ZJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:+PrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T177652375AF0F54DBED2A8339E8624716D9DC0DDDF142263BAF3E2E683B31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 18aa0c95e3fa8c59fbdfefa87d66f83cf7d76b5f7179272365078d564e4e7582
MD5 6f774f51043f1521e577687daa785919
SHA1 4b91637a4b6a00650ea9469f5dfd212ad6f486e3
SHA512 17d5b2b0b412b6349a2a8e9647ff93582bf063574773c4df2bf284714d28e4721b3309835cae5c54bb338ff8d2fdba82fe1e3bfe97a4496ebb811ce16d9ddf5c
SSDEEP 12288:SyPz5L8GJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CXD:PzymrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1E4751217779630F9D5378238C8621A02F7B57C7953208BAF5B640B7A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 2365ec8b0c5c251ea9e7c412e8b724bcdbeeff5856dddf38cc234c962b05d27e
MD5 895449ea0ae65a8630e925efd339a526
SHA1 32e7e6bfacfb1ed51d2e28e146e03fd16c782f32
SHA512 4e871b922c8419594efd699e5313a1efd04eb57a72c8ac58b773fff2c449ed631507a3aede1e03688de8770dbd48d35c75ee8615a0a5e0b2c3554d2d43e9c875
SSDEEP 24576:HTdaLl3z0zDErKhxr+EHNmT8oW4ll1JCrLKXI:HTwLljghxSMmT8oWgBCaX
TLSH
T1518502A5B35018F9EC67823ECC628906D6F27C5A4760C61F07B8366A5F337A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 21c216eee4f1603035d0c81669af965ce404692736a47d2b775f9935036c7968
MD5 b616fd32b12630788e25c769dfef09ef
SHA1 4fba3f77664bfb10fa64880d81e0f9ad6025ff13
SHA512 e35ef3e6e62b6194ba62708cf8ef7a6f043d5d8363012a8c872cabd83dc1a5fcf7f3bbcc057b5b4403c07a59f1a489c2d2cfe6f8f7d5de8f223d818307bd0b11
SSDEEP 24576:J35d9CHKy7GZgrKhxr+EHNmT8oW4ll1JCrLKXI:Z5d9CHKyaBhxSMmT8oWgBCaX
TLSH
T15F95CF90F3E414E9F0B78A35CD724511DAB67C995B21DE8F03A8265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 e49401b9a7882b9fdbb2b5ad4da54a427bce49c0a7d6a829bfd137ab36793a87
MD5 6380498cd6c8707ba0409689467455c7
SHA1 922be91bc10de69b6f761a9fc28edd7afaf76a1c
SHA512 8173957da83de0aa2db746b1da604a85df9ccf4b5bec7d3dc3ea2800ce2bc231bf5316091d87df6f12a66ae95bc0c62e7f977334d020237aa1d6acbc2da8b29a
SSDEEP 12288:z4JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:zUrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T116652375AF0F549BED2A8335E8624716D9DC0DDDF2022A3FAF3E2E683B31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 206dcafb4b2876bc712a7583d1d0d0f3b9e3311a6927c53b3e8e1b3a9b541e52
MD5 89092433a1459973f5c00748ba58f489
SHA1 317c1ab93f82c69add890a6c4695b8514e553849
SHA512 bd4f3f93a6e32220dfaf22b68a8d35dd968a89beb6e66fe247eeeb53c4a84706adb4df24f97e1337746c3fffbe9b3c83f9e5e7c355f25f4f13ddfce8f04968a7
SSDEEP 12288:CmJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:CGrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T13C652375AF0F54EBED2AC335E862471299DC0DDDF1021A3BAF3E2E683B35C5A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 918ba469d05ffcbbabb9358f141533dff2a6bbdd293468a8970bbedf93ad8bc8
MD5 d975801f58b4dd316f40db6f7fd06531
SHA1 ad2040f00e7cbacee232f77c1c8d13ec076c1408
SHA512 de408c4b663c2de34901830df3f8e75c746352592e7277f0ef28e8f86bfd74c54990be96c44a8e124bdd6cacaab0ef8a872e7741617843bc75cf6c4953ed6391
SSDEEP 12288:jfJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:jhrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T148652375AF0F54ABED2A8339E9620716DDDC0DDDF142263BAF3E2E683B31C1A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 881ae06ca4f4db56853b60be348c37385c3e03ae4b1eb70d21a2384d3c04d689
MD5 0f168539d5b1b370bda17f51e76d182f
SHA1 8ff693ef9f003553f3abf680c8fc65f4b0f0def5
SHA512 106d060be2bffa0dc1f093a07b2e527a8671d1a87e2c07016c145f93b34eb8709039fabe0482ba2bda1788a78d12eaef08194fd81b56d2d1fad359e614ec660b
SSDEEP 12288:QZJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:QPrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1AC652375AF0F549BED2A8339E8624716CDDC0DDDF1422A3BAF3E2E683B31C5A1156211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 536dbc39d3cb2f1e947a0a63ad30a8346aa82b045b11fec87f47a3237e3724f8
MD5 9f4f14df1aadb8dd37a0472d2a6a23bf
SHA1 b6eca308b7a97cd9d487ae87e0a71a4fb3e5f625
SHA512 9f79071d4aad298d83b243c41bd9f75a791e7637b1307a8786ce4efe070e55682b95eb81e13d17c1abceb383a4109b773687b41b83da30cbe4a981813eab45b1
SSDEEP 12288:T4JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:TUrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T143652375AF0F549BED2A8339E8624716D9DC0DDDF2421A3FAF3E2E683B31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 39f87c4c3f6dd95b32ab115602ae4836da3208c35f4cc154c04a3f4ce22739da
MD5 030ed7300af35cc015e2c31bea032897
SHA1 8a29c28eba6fa7e556d4baa77ca36bc1163a002c
SHA512 2e83712b54ec4025aff8b8f5b2f7b822c260a1753ef31ee78f9118de415badba992543508eab43bcbfb920f0a4bcf9a1be69eb99ae1fa03fc5fa62d1950b359e
SSDEEP 24576:B2wvik9RX6wkyAIzrKhxr+EHNmT8oW4ll1JCrLKXIuaKngL2jdshRTdG1YxITqv3:yMnYIChxSMmT8oWgBCaXlarSj8RoTCCW
TLSH
T118D5F129EBC848E5E177923C99B3460AF6B1785C5B32C2CF06AA53AD0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 9f218d031e356f48cbbff817c81472586d2fed4f45803ff07144c8da2d1cd2e9
MD5 03f253fff1bb1eadc225371ea31eacbd
SHA1 90e90af8ff52b97a263c798e64589373ac1495c8
SHA512 55ec9cb1cc9508f52db91256d9c5a5d6bffca3fba4729e37c49e69abeeafd049aba57c37c1c81620a7793cea7765f380d10221ee00999bea6afbb5ad4e19eb40
SSDEEP 49152:vYVeNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07hxSMmT8oWgBI:jySzPT+M4FHX7JTy
TLSH
T1ED269E96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 367bac7af75d27af1e1414d1a427ad4d8a5e9c53eb50ee6540fd3d67943276ab
MD5 f00e28e31ddee1353c3e894bcf83af74
SHA1 422d8c228f29d57f8fb5ef823faf93b535b6293c
SHA512 54ca003e3b6d04af06cb2d4d231bfabcad8f50f1829b1f1e7954679d6cc5957bdffe6afe3b0d95a8c0f97afccea17837d0f8e178ccad911d11459478290d7081
SSDEEP 49152:zX7JUQj7irIhCnDHUPfF/LhxSMmT8oWgBCaXOarSj8RoTCCW:HJ5glD0Pd+M4FHXOJTy
TLSH
T1DCB5D01EA3DC01E5E1BAD23885558A1AEA71782D5B32CACF12B0437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.3MB
SHA256 b36d817660bfe8d9eb0d3888105adbc8b047344e03076ccec089ae5943ace717
MD5 9192f0afea53d5307bf01da790a64224
SHA1 05c90915365f83b93874996678139a1f16b699bd
SHA512 e5c4e50ba8bdbf90fc6c55a7c362263dcf0da35d0df202721fd54311c0390225c61f89db34183e79cd69c952286bc3f6c93f7896b66d1ac050bab877cfb97af3
SSDEEP 24576:4frKhxr+EHNmT8oW4ll1JCrLKXIJaKngL2jdshRTdG1YxITqvfPkbIcbjLm:7hxSMmT8oWgBCaXiarSj8RoTCCW
TLSH
T1B9B5226AD78802E8C42E6334DB525A05B7733D6892D2C38F8AE0F97D1F766905DE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 121e10739aaa8856b11f653382ce827a233864d780ad873d9473a476df73b1c0
MD5 3b5651a3a856e783c205477dc382bcaf
SHA1 30ec5c24f96deae1ecd45eb4d2dbeb3f10420780
SHA512 f489dbe586ecfe7abbbf9c5058313f31920f341543e2fe244cfacc7d81b3136d7b19740925fe4650c2c1d3426285546fbb6b15a0f8259a01abec44afd09c1ed7
SSDEEP 12288:JcCXhBq+zcBwLsH4koLr+7W9rvaJqrHv57UqaRBv5s:Jvh2BIYWCJiHvKqaRBv5
TLSH
T1484517107666CB4FC6A980325E36D5CCAB707D01EE056F0373C9873F9576A59BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a67f0953b27f11b6ee60c2ba3214f9384f8239d07b7df3fdbcb1ba88eb199b43
MD5 41c0079e6c318009f235485b2354f08f
SHA1 9babefe3274284f01e6cf961ef7032b8082fc7e0
SHA512 9be542fbfef78f4c4e878bbe780b17cc17340720a6006d141d557f2d5e5d3d95b2c25b80602054abb6222212882e8a3c4a5c689d4d88fce8b11956982f7e4bd9
SSDEEP 6144:EvHYl5y9I14I1l7WYBg9fKKDeoH5MGKKDeoH2McD9MrBNxEgABjruCwO+K/v:dl0E7WYBg5xMGuMDNCgABHGXK3
TLSH
T1F765F9805136E78FD1B7603203295B8CB764EC06B7466F26B3C9457AD86AB56B0FD3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 899eaf91c21680e8e6c61c10e649ae2221fd702fb2fb0c974f9ff28b68574907
MD5 fe5b81145bde24f029eb0708e343dc34
SHA1 bbb5ac241a3eb70c1abfeb2ef64fa04fc613e690
SHA512 a2ddd2ee223e4c3175192f0a4dc07ed5deeb9f0ab8c281796a3ed51dde2d6bd6e257c8cb6d02fdf19ec58fafacc2a0fdfbf7cb80fdf76509a6380f1271cd340a
SSDEEP 12288:NO7xJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:AHrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CA6523719B0E985BFC3A8334E86783215A5D2DACD30055FBEF2A2BA87931CC55D72712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1e07a36f24383c6e04031d582de9c8ffdd50f07e3738e7bbc8f96a7a5ef20c96
MD5 020ed810241c6494d0e5a17b03f356a7
SHA1 abb957691a321395ca5a14419f001d030938a159
SHA512 00cf0ba49878db8018cea97ca9d2fa367ae9ebeff27847f7d50b75c1391916da76b8ab84e95472fd6219d5f44eae3e5b0471873d87b764a4c34f7c8f36900c40
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYZrKhxr+EHNmT8oW4ll1JCrLKXI:hgb4mBIBhGFVhxSMmT8oWgBCaX
TLSH
T1DB659E1E22EC02F5E0FAD2B8DDA64417D6B278161331D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 b6aea53eb1817ad955277764abf12f608197d7cc89637534a5945a1338af2311
MD5 5955b75214b87c3971371e5c8e2f8999
SHA1 7f3169c93f5b725d6a09e0d1623de1bb8de5d5be
SHA512 9bd6109b8db4ba0f8fa9d96575bb4ff7276ab7c169f05b39418c180c42e9b9062e3f62815cd07c18171ff721b6dabc4aca366ff578caf3e136e736d0ad9448b7
SSDEEP 24576:TG8QaKngL2jdshRTdG1YxITqvfPkbIcbjLm:TG8QarSj8RoTCCW
TLSH
T1EA05237EA7C56694C43B977829B6A84A3CF33758970A46DF8CE0957C4F6A7E0263CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 12b421989da42037ea614aafe5fd539c1a55ad22275ecae76fec8801ab24855c
MD5 1a26532a41f80165810b2d9d48d62830
SHA1 63b7685140f8908131843f7a24ca97c130992049
SHA512 fb084b62254e981b4b7450f766c84fe4b095f932e702d86c38956d6fb0c4f6716c251221cbb24d4c29f0706abbd304a6361d7f62cce1485974e943fe3cc846dc
SSDEEP 24576:/G88u8FpJqH1hzria7/myrKhxr+EHNmT8oW4ll1JCrLKXI:O7ZFPqVoa7/IhxSMmT8oWgBCaX
TLSH
T19295F16577E101F1D47BD138C9824663F6B2B8251360EBDF0BA88B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 acce39da787ebde9c34daeba2cf9c138d33c26cec028f7119bc5b2a3a4051c2c
MD5 5da825d5712d602d13b5816895d19d00
SHA1 c2bcd6544d56bff6258843646cd3918eae1fcb7c
SHA512 e62257ec04c265cd2d6782bec454d5f6b19c641cfa46a1ef680b4526208f0e45b10b49da855dbbdb24de04a0e8dd33b1a4c49d4cad89f19a49afb85868549e7a
SSDEEP 24576:bPUr+NQ+rKhxr+EHNmT8oW4ll1JCrLKXI:bJQBhxSMmT8oWgBCaX
TLSH
T1BC85F12F269D18E5E67AE13DC9828719F7717866131292DF02A1817E5F23DE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2b0b5e8aa785712e98504e9b74c2de8d30739b2e0d0a16d77fc535d29af81f3c
MD5 18cbc694f473818bd0cb5a5769b9e181
SHA1 f7b8f3ada2c6f7cd9d876cdd7bc280b1a46354aa
SHA512 03689e82afd81fc72bbc2ad0bebc1c9b7f086bcecc54766a77490d47922465bf273e1caa7039d3cf1751ddf689f8ba649e3a063ab626b01c99c4e5dd5edfec3f
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxhxSMmT8oWgBCaX:gG05lO43bq+M4FHX
TLSH
T1D3D5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cbef8f4e8f46b6d4adae44e2d8147be5cd167e234d0c91c194e0e7cbba9cb0af
MD5 ee59c9f1d4f2b8456c761b2e9322adc2
SHA1 11cc069d66baaff439ccf35509512c57ef471dd6
SHA512 b8593da93bcc6f7f9d71b15c6307ee1b1dbafc572f0cdc415124bd60290f5a4b7cef0ab7247c8bd1a965d1aa4bbeaf292accbf7c9b28ee060547b03143dcb927
SSDEEP 24576:dfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnIrKhxr+EHNmT8oW4ll1JCrLKXI:ta5POZ3+Jt2pasx2+mJhxSMmT8oWgBC8
TLSH
T1C465AE5EA7EC00D5D579D17DC583861AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e5369dbd5498bf46d8353284e80a108a45f47a729a66e0aab6175ce72c407d23
MD5 fff2edca903c9e93413adb31a491d1b9
SHA1 8d3856f7245b701e8d6737c2ba53655854d63125
SHA512 05f9ee99c6bbac619c824558e09dea2076461e53524bed4d495758ec9a74e6e44197b5ea90fd85620af6408b9db5f6a926316a71075abe126e332caee17bf8ea
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkqrKhxr+EHNmT8oW4ll1JCrLKXI:RNc/zEOVHFohxSMmT8oWgBCaX
TLSH
T1F4858B2623E900E4E5BBE1BE89779546FA717869533086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 a53a69159d33f6d971d3fa080370e698baeea12e79c28e975808f9f45b028828
MD5 7fae6089d783a1e30e5d7c49be03d5da
SHA1 a3dc1547ad369bcb68a3f79f8f6883a06a6c7671
SHA512 6e991e7f4dcf96f339d98bc6f9f5f42b6decdcdf0fc41d70256e93e26ce8a9688ffc184cc17ba0458802166244a1b0d66ff9f78f4b53a7a05b9b2cbcf983170e
SSDEEP 24576:t6DIwcaKngL2jdshRTdG1YxITqvfPkbIcbjLm:t6DIzarSj8RoTCCW
TLSH
T1BA25126D63AA01F4D06BE13D96934506E5B2B5B483074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 b7d40648974e7fd612d1793dc16ce53fe709bc486b72f7645a2648fbd8d9a7ff
MD5 5feb52576f90434761f9cdaca010191d
SHA1 d1248483ed8754575ef692d5aa3f4425cd511c96
SHA512 9901524ca9fa9f0ec501bae3d5ad07b0db0218627d9d0d4a678e43e37fabb209c4b5325b3f8e0209212230c3b442a39bbe1cf1e97e96af07dd9350f6c7a88521
SSDEEP 24576:NtyxaKngL2jdshRTdG1YxITqvfPkbIcbjLm:NtGarSj8RoTCCW
TLSH
T10F15231AD7C456D4E97A27786EB385886D727E249B0783CF89E0E63D2F367D06934B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 6882ef3c5c0a30dcc48c0a82bbae56faad50b7c8ae1bd23d7be8c9aeb862eeaa
MD5 cc6d85f7d2269692b506734c89ce504b
SHA1 af13baaf63cf7a012687254ec90fb4a73e949c12
SHA512 8f271336c7ef7dec0f7c501ab902bd3ce80598c030b31ada409e024c7d1b05e3279321953f22048ceb5652e4c9aa678dad7bd00a0fb8e190d1c40500c2e97d40
SSDEEP 24576:ieaKngL2jdshRTdG1YxITqvfPkbIcbjLm:iearSj8RoTCCW
TLSH
T1BF0523BEDBC55B60D81A7BB43AA6A94D38B3376C970B46CF8CE0557C4E7A7D01638900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 1d24ca49d7e7a5e8cace24bd48ce3ce3eb8d96c1a3bc1aed787c8a156c0c3e40
MD5 54becb424d7dabfd8d0062d9f298c0e5
SHA1 cbc94bbf67b1fdb8ccb255f309da8aca2d8842ca
SHA512 6583e5a7ab122621db642f22a63541ebe736747f25b172d63ca9e9cf432079128612e4e0f2a83b6470f3bc314e0cc60e1e83bf37685ea99e5f99dc61ae3406f8
SSDEEP 24576:INgdLoTfaidZOaKngL2jdshRTdG1YxITqvfPkbIcbjLm:IgyTrZOarSj8RoTCCW
TLSH
T12665AD1DA7EA06CAE2B2D675D8725483D633B4315772C6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 bc84ce927b3a0163ced8417d042de45cd386000151cc86b8a0b77b8781e8cb60
MD5 1882c168053dc99a63d5e4210f094cc9
SHA1 823889ec332a029b5a3468ff086ecd605ecb1c7b
SHA512 e78601a0c8a61645832c0df4080166dac43529f0f2df2fd97aec361214efe0283746ba376321774c07784971ef45d92a8475df6658eed035cbe60622ba2fa62c
SSDEEP 49152:dgb4mBIBhGFVhxSMmT8oWgBCaXFarSj8RoTCCW:dtY+M4FHXFJTy
TLSH
T111A5D01E22EC02F5E0FAE3B89DA64407D6B278165332D2DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 6cb5260fe5538785a56dffae96cb4c963ab498ead2ef0d1b30532046f513d700
MD5 5a970096edd8c03545b3498ee7d6a231
SHA1 9bc05334be1fa90fcf6ad91a08ebb3ba42f0518e
SHA512 5ca428ff19958bf45e6fcdd16397fecd2063d80e21be1fcf51b9755058b94e436717d536b349d53b8d1ad34493b3d59d01ce14f9867732a01cf9063a0f7423bd
SSDEEP 49152:9DMwBtOm/hxSMmT8oWgBCaXlarSj8RoTCCW:5F3+M4FHXlJTy
TLSH
T1A5A5D16EBBE846E4D1BEC674DD238512EA727861133253CF8290C13E1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 6e5ee8efb9879227779582382ae04cb02fe26af71725bf51da2b8adff6803089
MD5 0a066d1f9b2a771c54c3eb48392da7c3
SHA1 907f3b042cce86e5649605c761f4768992c5ca89
SHA512 36956a50ea9fd90307c7d8f9f7420f3c28ed29f579947e765d2ff2e8227faf2acb800b094ce2b0daabf618d04d51adfd938c66ae9902056b014a68a2db385e61
SSDEEP 49152:rDVHeBIAA6hxSMmT8oWgBCaXwarSj8RoTCCW:I+M4FHXwJTy
TLSH
T1ECC5027EEB5C04E4D57BD27CDA638A06E6B138AD031256CF06D481B91F6BEE42D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 c4558225f833a54eb917c4107ddbdc65f0179cd27a328e76e5e99925fc3d4775
MD5 539098139c867e6cf865bbe631537a11
SHA1 aae0d5bbe9a96d3eebc5e8496acb67ea2d915e8d
SHA512 84611deb5fde668b6dd728c7bf0b552038c466b5c362443fee9a7d6b99e25700a83f98fdd6560824371641524c93e9fb2408f645272f64dd5581300ba043696c
SSDEEP 24576:wJnJPbzB4SdaKngL2jdshRTdG1YxITqvfPkbIcbjLm:wJnJv6SdarSj8RoTCCW
TLSH
T1E435F13DD29810E8E4B7C2B4815A1B5ABE71387D2F1669CB59B4D4343F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 3ae36f867257f6dc53e571987f8655bb4c35590ccd214ffdaf1e0115bfc2ddac
MD5 88ae8d3222f24df077623a4c5d3930eb
SHA1 6cda91cc7b819ca0ac59c817b8ee818e4306772d
SHA512 e1c5877b9c0831c520c790ddf8de6610a39acbf54d1390a9a5c3f371bb579b251aaee9eae513a97fac058fe34c02184ae4b9ed27d9807d9a93e24f2b74aba91c
SSDEEP 24576:S8aKngL2jdshRTdG1YxITqvfPkbIcbjLm:S8arSj8RoTCCW
TLSH
T1CB0523AFDBC48B90D55A3B743AA7A84D3CA33B5D974B47CFC8E0159C19AA7D1263C440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 673d8fe5cc6635221973015ab86c0c94cd9ce1c48f36440643a19fe3dc824782
MD5 d124ed86278681be0c411ae146153237
SHA1 dd3be63522f04ffe1148e934e8098e4070088d9f
SHA512 d46b804c4053f5090fd98904b836f0600f63481c5e584c842d018048d553ed2893189ce6cf150f1089a62c84d537debf9396a8b1c6d52e4bf9d21664ba86ac03
SSDEEP 24576:k6UqjpUvhaKngL2jdshRTdG1YxITqvfPkbIcbjLm:k6U9vharSj8RoTCCW
TLSH
T1D415236F97C419E4E03A2334AAB6C10918B27E7A035B86DF65D4967E4F36BC0953EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 871c3b197de121524180bd2b06e3bc75bf5e79682388ef3426e217944830aaef
MD5 85f8a14b6ce88e6cac5b5df6741715a1
SHA1 dd67b28e7d22ec3feab455a7fdd9dfb3169247de
SHA512 02dd5015a87013e8f74406c451628575636ed30bc62101c083465b4c4d395dd88589528d59df1dec62eb9999c1240a1b49c781e1b1caea5fb81d30f9f1a5abcc
SSDEEP 24576:lCLHGL0MoeVtFumTijCmlKQWDk2aKngL2jdshRTdG1YxITqvfPkbIcbjLm:lCLHGeeV5ijCmlDWDk2arSj8RoTCCW
TLSH
T15CA57C05E7EB4284E8F3CAF5CA2694169A327C549B34F7DF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 fbbe6da0cfb97df4289b9425000c002c33b835fd7bc39e7cf13e8f0c1098d97a
MD5 8fbc7708328cc2c95bc59d561a4d66eb
SHA1 86c2268dc2262eead14622c3903ee204fbad6584
SHA512 c10b8ec257da98a69f8efd1af5ee77f50299cb6beaa07a85a681c4723209eb2524d9229b8b588cfb8486516a04edd5405ae0117b15aadca4cf88c8a02c0c8578
SSDEEP 24576:lrcmRRaKngL2jdshRTdG1YxITqvfPkbIcbjLm:xcmRRarSj8RoTCCW
TLSH
T1D425015EB7AE00E5E1BB923C89828549FAB37534530257CF46E0877D4E67AE97D38B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 0e4a2343c39e0c019e848e5a502a67f62bca60e83d7f78908379b50560b473af
MD5 8e3e0286c5a4b503f025db23205b6abe
SHA1 77b5e050a565e97732750fdcbceab926dd0805c0
SHA512 4cb92c3086d13332c1be48bdd523d4daf0c15704db4bbaf1e40954bd81a1204663cf74037b42b58afc60aebcf0c0b7cba0f3add608ffc49ccc5a52c6ee9bf1b2
SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3DarSj8RoTCCW:j3Upow8sBqJTy
TLSH
T159B59C3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-527-0x00000239C76C0000-0x00000239C7D40000-memory.dmp

Download

memory/252-539-0x00000239C76C0000-0x00000239C7D40000-memory.dmp

Download

memory/560-333-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/560-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/560-158-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/560-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1572-308-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1572-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1572-287-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1572-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1572-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1572-108-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2328-267-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2328-516-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2328-518-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2328-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2328-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2328-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2428-124-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2428-130-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2428-315-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2428-121-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2784-60-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2784-47-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2784-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2784-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2784-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4128-73-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4128-81-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4128-75-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4128-218-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4556-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4556-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4556-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4556-29-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4556-30-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4856-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4856-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4856-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4856-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4856-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5392-85-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5392-468-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5392-1-0x0000000002630000-0x0000000002697000-memory.dmp

Download

memory/5392-13-0x0000000002630000-0x0000000002697000-memory.dmp

Download

memory/5392-15-0x00000000030D0000-0x0000000003155000-memory.dmp

Download

memory/5392-18-0x00000000030D0000-0x0000000003155000-memory.dmp

Download

memory/5392-189-0x0000000004270000-0x00000000042D7000-memory.dmp

Download

memory/5392-16-0x0000000002E00000-0x0000000002F49000-memory.dmp

Download

memory/5392-0-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5392-185-0x0000000004270000-0x00000000042D7000-memory.dmp

Download

memory/5392-8-0x00000000030D0000-0x0000000003155000-memory.dmp

Download

memory/5392-6-0x0000000002630000-0x0000000002697000-memory.dmp

Download

memory/5600-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5600-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5600-144-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5600-142-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5600-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5688-86-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5688-243-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/6104-62-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/6104-69-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6104-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6104-196-0x0000000140000000-0x00000001401AF000-memory.dmp

Download