932c86f01df9bebc9088112f6df15855df57d2715b295e86ae6d435fa12e5b0e

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 2.8MB
Sample260930-fj83vsfa79
SHA256 932c86f01df9bebc9088112f6df15855df57d2715b295e86ae6d435fa12e5b0e
MD5 19b1f3cf42326f310bead5e12a2b7bd9
SHA1 22c53b264d495ab73c64f69ed692ae671c747aef
SHA512 0504c96f7b5de9d74aeb59efeb9fabeebb0bf7f97ab465a907fac3f45a57bd2cafff864578522443c687fac8ec2962e4d591214666a40176024eae38243190e9
SSDEEP 49152:crxRP9sg+B/V2j+J6hxSMmT8oWgBCaXLarSj8RoTCCQhxSMmT8oWgBCaX:c3MBV2V+M4FHXLJTU+M4FHX
TLSH
T136D5CF1277F99129F1F37B71EEB883645A77BCB5AD39C50E6280215E09B4A40DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan upx

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4724	elevation_service.exe
4892	elevation_service.exe
3132	maintenanceservice.exe
4244	OSE.EXE
5820	PerceptionSimulationService.exe
5872	perfhost.exe
4896	ReFsDedupSvc.exe
2812	SensorDataService.exe
1036	ssh-agent.exe
880	AgentService.exe
988	SearchIndexer.exe
2840	maintenanceservice.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	maintenanceservice.exe
File opened for modification	C:\Windows\System32\vds.exe	maintenanceservice.exe
File opened for modification	C:\Windows\system32\vssvc.exe	maintenanceservice.exe
File opened for modification	C:\Windows\system32\wbengine.exe	maintenanceservice.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	maintenanceservice.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	maintenanceservice.exe
File opened for modification	C:\Windows\system32\locator.exe	maintenanceservice.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	maintenanceservice.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	maintenanceservice.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	maintenanceservice.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	maintenanceservice.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	maintenanceservice.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2866501b227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	maintenanceservice.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	maintenanceservice.exe
File opened for modification	C:\Windows\system32\AgentService.exe	maintenanceservice.exe

UPX packed file 36 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000000932b-462.dat	upx
behavioral2/files/0x00010000000093c2-463.dat	upx
behavioral2/files/0x0001000000009952-464.dat	upx
behavioral2/files/0x000100000001b991-466.dat	upx
behavioral2/memory/2840-469-0x0000000140000000-0x0000000140300000-memory.dmp	upx
behavioral2/files/0x0001000000009cd6-497.dat	upx
behavioral2/files/0x000100000000a0ce-504.dat	upx
behavioral2/files/0x000100000000a1d4-505.dat	upx
behavioral2/files/0x000100000000a2c1-507.dat	upx
behavioral2/files/0x0001000000006223-510.dat	upx
behavioral2/files/0x000100000000627a-512.dat	upx
behavioral2/files/0x0002000000019c50-518.dat	upx
behavioral2/files/0x0002000000019c41-517.dat	upx
behavioral2/files/0x000200000001b2c2-516.dat	upx
behavioral2/files/0x0002000000019c86-521.dat	upx
behavioral2/files/0x000100000001ae42-525.dat	upx
behavioral2/files/0x000100000001aef7-524.dat	upx
behavioral2/files/0x00030000000184bc-527.dat	upx
behavioral2/files/0x000100000000bd44-511.dat	upx
behavioral2/files/0x000100000000a319-509.dat	upx
behavioral2/files/0x0004000000018a5c-551.dat	upx
behavioral2/files/0x0012000000018a5b-550.dat	upx
behavioral2/files/0x0003000000018a59-549.dat	upx
behavioral2/files/0x00040000000189ec-548.dat	upx
behavioral2/files/0x00030000000189eb-547.dat	upx
behavioral2/files/0x000300000001897f-546.dat	upx
behavioral2/files/0x000300000001897d-545.dat	upx
behavioral2/files/0x000300000001897b-544.dat	upx
behavioral2/files/0x000100000000a304-508.dat	upx
behavioral2/files/0x000100000000936d-506.dat	upx
behavioral2/files/0x000100000000ba34-503.dat	upx
behavioral2/files/0x0001000000006215-500.dat	upx
behavioral2/files/0x0001000000009b92-499.dat	upx
behavioral2/files/0x0001000000009cfe-498.dat	upx
behavioral2/files/0x000100000001b991-468.dat	upx
behavioral2/memory/2840-561-0x0000000140000000-0x0000000140300000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	maintenanceservice.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	maintenanceservice.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000128c6f49750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054bbb8f69750dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000f6f5bf89750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000176fe4f89750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000005bed069850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe
4724	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	880	AgentService.exe
Token: 33	988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	988	SearchIndexer.exe
Token: SeBackupPrivilege	4896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4896	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4724	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4580	2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 500	988	SearchIndexer.exe	102
PID 988 wrote to memory of 4080	988	SearchIndexer.exe	103
PID 988 wrote to memory of 4800	988	SearchIndexer.exe	104
PID 988 wrote to memory of 2928	988	SearchIndexer.exe	105
PID 988 wrote to memory of 3000	988	SearchIndexer.exe	108
PID 988 wrote to memory of 2696	988	SearchIndexer.exe	109
PID 988 wrote to memory of 5860	988	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_19b1f3cf42326f310bead5e12a2b7bd9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4892

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3132

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5820

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5872

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2812

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1036

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5860

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d287ae4e6efbcd0e1135e63fa5aaf4d430d4edc950fbc5f6b2eba952aecf2fc7
MD5 7409e25d738482edfef211988e20f71f
SHA1 8462f97177c8b7732568df3cbd9db248a2932eba
SHA512 2a1145e28ac7316418352bfd9062ce83261580c030e3a3367e8c72c423dff88e4891280d4afc8cab93aa5990968153c61ad0ccec3da7b16838708ffa0736991e
SSDEEP 49152:Eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnghxSMmT8oWgBCaX:+3q6HjBp+M4FHX
TLSH
T1E1D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.log

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log
Size 3KB
SHA256 118feff92f3d1faad43c07c1d528aff41d9255737dba798d6e220df7234ac520
MD5 06958ff960fed8554132b8351d2284ea
SHA1 c2b823b7d50010669ba6ae5a1627cd4feafca542
SHA512 0a1c06d1b55037b5ec1fa92a2404de8133dd8c5ebdae07a4db43b05fb7580c44b8b83b9e892910749f955dae8696c05cc948dd4a0f355fd743621a82dcb35984
TLSH
T12251AEB6153DB966440AEF84EDDCBD3D666C310D74FD55B432A6AEBC0AB808CE5C3224
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b34f670a410b5c95bb4e90c0b4592446ea638024ca3d735e376bba787ca45460
MD5 ef6219c2af23e0e4e6efdba19af6167f
SHA1 26ef1cc2321500966894f63cc13fc5804cb7524c
SHA512 528558d9b46e87dec75a55dca008f5ffe4f55b8b5b69e72089ad179bb55eb3cfff03e0241a7b6771cd4491e64c7c9efe448b7020c94087b9ce50386e232e3629
SSDEEP 24576:fXYfDtczAyrKhxr+EHNmT8oW4ll1JCrLKXI:qtc2hxSMmT8oWgBCaX
TLSH
T14285012877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 4f8a1b60a6701f9ffdbfc6515250365a68011ba1177205530a96843cef6d0669
MD5 4f2d42f720ca0c65ec11778ae089241b
SHA1 8f2ce05ce0b075901397bac59f2cd59676269494
SHA512 553892f20cabd13d015590a763e8463c2270335e6a7c1d829f249b7de74cd5fcaac2955e37338211ee60c320515e18fa8f0445f45a28324becce2eb5d6edb402
SSDEEP 49152:xkc2hxSMmT8oWgBCaXyarSj8RoTCCqhxSMmT8oWgBCaX:x++M4FHXyJTO+M4FHX
TLSH
T15DE52339A78548F9EC2B833CDDA28505EA733C988351E75F47B49A681F336D81A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 afe02031cb89df8b80d26f29efda2eadb19a6e60d1594c2dd296827b76ee4bc1
MD5 8a9afc168747b2c64889ad74e812ec90
SHA1 0789cdc9c3860165772289854d7895be78390840
SHA512 76501d326ecb27a4e348c578841aaef5ad40130f20bd086e89aafe1d5aa99d5fecfddbc00fdf54f2a8dbe3c4d67cc5b5b8586237029514f7451531efa10230c2
SSDEEP 49152:4kc2hxSMmT8oWgBCaXyarSj8RoTCCqhxSMmT8oWgBCaX:4++M4FHXyJTO+M4FHX
TLSH
T183E52339A78548F9EC2B833CDDA28505EA733C988351E75F47B49A681F336D81A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.7MB
SHA256 1269198cedc9b610fcee7c82842a4f07f2524b1f659aa02696c43e653b5d6695
MD5 f8b2cddc450af1f544e1ee478d9b14be
SHA1 dfecc5f65d3d28e3a9f090b238e34b6941cf2f86
SHA512 239ad0df87bffea14f3afba1468b7469aea724dac8ee4a123ef2c05b1bc3e2aa5416462f010fe44cdfbde702073651776dc6a764fec6bfac4fbcce3a432b3881
SSDEEP 49152:bOHl0f13hxSMmT8oWgBCaXyarSj8RoTCCW:6HUh+M4FHXyJTy
TLSH
T18CD5D026F6748331D073C1B9C5D2A68EED72308557308ACB4296D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.2MB
SHA256 10fc507dfaa80f701629f278fb0de4b06dc61fd87406d61bf7c33060a09edc7d
MD5 13e1c44c17401dca37e2caf1dcd157ec
SHA1 da251e31303499b0aa0ce02605409ceab2030093
SHA512 2c66de93cb222c231aa2ed891643385abf3c742b4a8b4a1ead324db8690fb22f009030a161a2964450a0ffdec4f14298778576707df7a9e26c8dd8838c36bd6b
SSDEEP 49152:i/ezSC6vUzPv/HjyzhxSMmT8oWgBCaX+arSj8RoTCCW:GezSC6v2X/HA+M4FHX+JTy
TLSH
T106B5AF25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.0MB
SHA256 d486df51e681729825a04d9e1a4a55a4ebafdc9a1d006baa1ab2fe976d2f375d
MD5 3f64fd1e7be3191b2f922fa07b074146
SHA1 021757d82002901acd2482e9615424adde0f1d18
SHA512 1d4644ffbe5a265e0f6254c523054655804bc7d7b261ae0a045e4f1118a2ddabf4825319432bde2af71b548181d2f3b8b04490ce624536559fff0a869c25c95a
SSDEEP 49152:JaSVdrXl+KhxSMmT8oWgBCaXUarSj8RoTCCW:BTr1+K+M4FHXUJTy
TLSH
T1F6A5D066F6748331D073C07AC5D2AA9AEE3234415B318ACB0246D76C3E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.2MB
SHA256 83aa75d19ac2767cbcafb2f412f27c57885aa38b6aeea4ea0bf59f5dabdfe9c1
MD5 9b3331bdf963fb18d129c437fd559fcd
SHA1 5f32959a8a2d1af50f9c9607d20b3351be170ae1
SHA512 a08b8f6c04ccba9a8df3cf5dcbd4ecf08e1aa0597dabadb39edf16f7d67badf184d5ea34336b6ea039b1aa2e25d78d209a9617b09aa323493fac768771b58d1c
SSDEEP 24576:OvVrKhxr+EHNmT8oW4ll1JCrLKXIJJaKngL2jdshRTdG1YxITqvfPkbIcbjLm:dhxSMmT8oWgBCaXAarSj8RoTCCW
TLSH
T189B533BBDF8989A4DE2B5734BDB6A9092CD32FDCD0034A1ECDB43E9C2979AD55139100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 2.4MB
SHA256 48896b34df144dc01031ada787854fda6cc1ce62af3f8f50cc7f30a54ff5e39c
MD5 436b114f3fcaf02fb3950779324c3259
SHA1 db75a713740c6d6fb21557c1a854f9700ba40fc7
SHA512 7464feb80266c39ae99affd8c5e927af44286ebd21451f0df5d8baf1d791e1c6012bbff1bd637f21f10ca126bde3987d33cb29faa100f7b40856e5e516f6bd3b
SSDEEP 24576:IJIU+rKhxr+EHNmT8oW4ll1JCrLKXIZaKngL2jdshRTdG1YxITqvfPkbIcbjLm:IJIUBhxSMmT8oWgBCaXearSj8RoTCCW
TLSH
T1B1C5017BEE28FCE1C67E9E785A91C600A7B278708B1293CBD175830D9E235E15E79C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 5.9MB
SHA256 8c80784dfae0525bd69297386d4fd55def5d10f36d1422c83a3dd76ad88f9177
MD5 d4f30df8b4882b75316e419d142a21cc
SHA1 057b5212ee83b85f1feaf3cab0406194c3338965
SHA512 ac4de678d8b5370490dab6c79467e9e8878dc54a313fac044bb78d7941463e33f60946c97d36bd20bad0fdb93d7d56b3c2efa7f1d620f7455116fbdc97ac6162
SSDEEP 98304:HQvGAdlCEL8c/TRNm5CW+M4FHXBJTO+M4FHX:wvyEYc/T3m8m4rJS4
TLSH
T1CF569E656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 5.9MB
SHA256 0f9ad0be8911a0d2febc3d6f69a5c0dcd04f403cc9a15315b2767eff58843fd7
MD5 274f6e1f600518686269a2de77a4124c
SHA1 4628e152795910ccbb25c7fb734014ff915c33bd
SHA512 23c2a87f4c2666b04582661ba7bac2216430d7a53a66011288d5c16a5c0b8da03660a9efa9f72d230746d0b627e931e1b963647c935d0340fae95567c883bebb
SSDEEP 98304:TQvGAdlCEL8c/TRNm5CW+M4FHXBJTO+M4FHX:8vyEYc/T3m8m4rJS4
TLSH
T1CD569E656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 3.1MB
SHA256 02797c0b55b3cdb01716a948058a955464c71c1f6b2577a0bee3ce0a72518b20
MD5 9572bedcda246b29520311bd7d8312eb
SHA1 678320779f816ca377566586c56c7b547532ba19
SHA512 0a9a59d83d6bca5c5c54858238fbe4261a3ee36d9fe48f9411421fadbc59fef19b0ba5cee2ebc96402223b88c9cd415d41740d483e18bdf0244f12e507eaeb7c
SSDEEP 49152:EljHhxSMmT8oWgBCaXDarSj8RoTCCqhxSMmT8oWgBCaX:m+M4FHXDJTO+M4FHX
TLSH
T117E51231FF75E436CA7F0E356B32C706186D2E608B421AC7E7B85E9C59346D22376A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.7MB
SHA256 b12a711c66e58103a32c465cf2faa89f94b131f44eb950f676ff922d6eaa720c
MD5 a6e894d48352a01e8d4ac691ac9ef542
SHA1 a839bbde82a55ed2f191275acdbf52fca856c0db
SHA512 2d67d5aae498f53cd23c0755c75c446aba6da125159735cf2c85e1210baf3ba588a90a34985283d12a5531dc39918cb33007641e3e4dc106a272b1e091494e34
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLyEr7dPlbuJHj4sJ+:SUEtQevvqc2W1cpV2Erp2j4sc
TLSH
T1E0475B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 3.4MB
SHA256 d5038e4017e93e43cd96e6cb12f340b151c1b6a0a2d4bee3511b5d68dea0a49d
MD5 b476bbfb9e63ec39e7bc4d469e0d367d
SHA1 0366f075a0a4ee4b310aab71606db2776d053485
SHA512 14d27ee3055d1425d7caed69a9dcc7741414a4de5fe5b595deba1df9709d6d5e0caf5369fc5881c7e00c29ee558f5074fe38f22e848abd44b0acd225e510a5c9
SSDEEP 49152:sAbRquA/m2yL5zUfFiV+XenmE3/znhxSMmT8oWgBCaXnarSj8RoTCCW:zoqlVjnmi+M4FHXnJTy
TLSH
T1C6F5BF1976A8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.8MB
SHA256 b0562928a23051428b9890f8d52b1b5e537c6b69830d97af4d973d4616a155c4
MD5 7768cfc111c4d5510bebb523d8641e32
SHA1 145fa983b1dc68af2b8d8e36ee003186f7899631
SHA512 512aabe6a9c131c355e36c6ebeef01dfb465fe9c18b883ec8bc6f97ddbd7a84cb9d3cc10c90a5875a75f99ddee73e187822b9ef846bb74bb910dad932c86e713
SSDEEP 49152:LAMbFoiq5yhxSMmT8oWgBCaXparSj8RoTCCW:ZqE+M4FHXpJTy
TLSH
T1CC95E091EBF945D4F5B3AB78A9B68570E9B2BCA95E31C20F1160D11F1E33E409D24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 3fedcbad9422c8206b94ebdddd2cce11966edeef80d263d08368cf0f9d78c825
MD5 6f1aa6a4cd0db608498eba717d8846f6
SHA1 16b9a7770265251c3dd4f11004650e118cb2678d
SHA512 5e43e0f68ae72b3869a1903624b7de63c4533379deb28dc8684d85a9a786376d01198913b16dda6186856244e4844a16feaae79739f009dc32cabfa462bf8227
SSDEEP 24576:ywuSOWgrKhxr+EHNmT8oW4ll1JCrLKXI:yw9OOhxSMmT8oWgBCaX
TLSH
T15485F14677A91CF9E9678238C557C136F7F2BC052621DB2F1770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 2.8MB
SHA256 30142c25ae0bc8b65806b2a90020c1f815cf85b6ea1551fe806118e7da83f322
MD5 3b6908c884da3fdf0e2734dcc97d9ab7
SHA1 32992ba93b4c97e95d09c0bfa834f19e447fb38f
SHA512 7ee1215fab8a08db4afce9ed3166b77812e494d9b0a241d08c0a77f7ef0ef756f58701348baf9df2f65a802ffbd3b093efb4edcb5c433c4a27e3349e861439a6
SSDEEP 49152:whxSMmT8oWgBCaXVarSj8RoTCCqhxSMmT8oWgBCaX:w+M4FHXVJTO+M4FHX
TLSH
T16CD523BA6B8960F9D927433CEDB256059BA23D9CA31203CF4E751AAC2F36DD51D39310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 7.9MB
SHA256 e79942adf9fc961f4432d608738962899edac7743e25363f987f35efbd84d908
MD5 c41efe1bca628aba21b9f0524a8c583b
SHA1 99aaa6ef027b4fc2ef88b920f5484794ede16944
SHA512 7c55f4de4b233903bf9f6d7260c4b6470c59e6db8b8d1b0ac6e106a3cdf4782b7c9475b3d8b486ebf79e4cd6aac64e16d02ae48af71e834557d227732b163843
SSDEEP 98304:eQRQyi36YOcPELvw2gAf+PN3N+M4FHXiJTO+M4FHX:FQyiKaGX+PNt4IJS4
TLSH
T161869D13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 7.9MB
SHA256 b72490799a79da0fa0c6b184505ce519451f1a20841e73ca53c58d0c3c085355
MD5 cc121a1b0b96605e9e669081fb207ba6
SHA1 1ac6b0821e5b7133a56f37817d424c6323536a9e
SHA512 02af3b1b4a372da0482ce7bdb448d7fa6ba5c85b3addf8ecd4ecda2059f406080d01a69bcf14fa8f452b5e0bacc978b83c40e0c78bb373259bf662650e1a083b
SSDEEP 98304:2QRQyi36YOcPELvw2gAf+PN3N+M4FHXvJTO+M4FHX:9QyiKaGX+PNt41JS4
TLSH
T102869D13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.6MB
SHA256 3a0c0cf38b9658ad97d936ce8bbf5ee20227ab8480652c3d180483ddd237cdd7
MD5 aefe8534f8443ae7ae28fbc05193acb0
SHA1 7d95490f17f9721375a08828b4a0c3e65bee07f1
SHA512 cf0d3f0fc1c5f3015ccb56347f8b34c88547d725faeb8c28ba3f1961e26a6685ac2fa8bd5af8fac98041cbb70f6079f87d50135b1e087a88e0e52e5bb67f79aa
SSDEEP 49152:C68Qg55nhSeWu7PNU3/3hxSMmT8oWgBCaXGarSj8RoTCCqhxSMmT8oWgBCaX:AthVRc/3+M4FHXGJTO+M4FHX
TLSH
T1ED06AD33B2E600A9C44DE1769F46872196D27C75CFE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.3MB
SHA256 0ba1e93112bfc1dd5c7909d2089838e40f1dc7c5388f00a7337d2a071b509ffb
MD5 f2fe8fd8ef1c262beace5c4de3b10382
SHA1 47c415c729116c91d37684f90bfe7946010d08bf
SHA512 0d4b74344b1a746f9ff24c99d3a86432ad8456450a639749e3c862b07bfc2341d8da833e802f03f7af29eb09507f1a0ae6c87693eb84fd8095b0b9167abfb348
SSDEEP 98304:ly5112gYy5azzVvf69nLKnhZ8+M4FHXLJTO+M4FHX:ILIHSWha4JJS4
TLSH
T14446AD13F69900E8D01DD179874A9232EAB2BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cf51696dcc4d92210d2ecb96b7a4a61790720abb47b4f5bb77760d4f2290a6e9
MD5 86b90d305b92c870f997445200c303a9
SHA1 d94b0f96253abd6df42c8f3594270393548a2114
SHA512 0eb47708bf21db049ffcd535c8a74c497e421f481c1587a2b98554eebd88664a20e5c1a4bf7e4e7e6b7dcde9abb6bcebe46a15f0341511d979186fc3680a2043
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl1hxSMmT8oWgBCaX:Yu6JmVxd2d1+M4FHX
TLSH
T1DED59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.5MB
SHA256 15f983121e41d359dacf366e68602b83d490ea2771cb90e9df4f750b465677c1
MD5 3859e837a8836941e210f2182ec1ef38
SHA1 6072f3c2301159fccf8ce421d0a9cac7fea1eea6
SHA512 0fc33ae66d493ce553b7ecfb58813d965c94bfefa200b6393fd5cb2d8ce716e54181f9073bcd5a7e23a3b5e1b06358e6059653e52504770e52b356573938bf35
SSDEEP 49152:b1hpsNoJpF1A6tU44CwH7R4xhhxSMmT8oWgBCaX8arSj8RoTCCqhxSMmT8oWgBC8:bmifPgRi+M4FHX8JTO+M4FHX
TLSH
T17BF5E013F2D900E8D06ED17887569632EA62BC490B21B6DF0A90B7952F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 3.7MB
SHA256 abbc89729a78faed69cbf282216e40ccd22635d7e6f0a180bff69af99d2f0628
MD5 8e45fa9e3c0ae60e59343344fe03a313
SHA1 8e177ef59afd2ed9c2978d1c65cb41c4410a3b09
SHA512 de14f291c5cc2dee53f6cb86ade982a944aed8ffbbcc61884528d0b301d3252087f510c0ea762142d371d45ac57915bf688e09bfa8d44871483db71e60744f17
SSDEEP 49152:ASuZQIY0Be2KWRVtOnks6NMHqwhxSMmT8oWgBCaXXarSj8RoTCCqhxSMmT8oWgB3:a5dKEi61w+M4FHXXJTO+M4FHX
TLSH
T1FD06E013F2E940E8E0BED6748B669232EA72BC454B34A6DF065072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.3MB
SHA256 c60215c29b0c0cb6537ca56575a892c3c3b10d27562a4a378562ab060208899e
MD5 3d3547fb1d0d7f8b7ed55ca76e0b5998
SHA1 7757f0991c9c514a8561cb2f0c2186b938166eed
SHA512 84a10666889f4006a8d8e8d498e75ad2612dcbd5d1f3846e282d01abb33b6136aa07b1f12fe69bc0c6b88dba9d10fb4e98b221bf33881ada21f5e10a125373fa
SSDEEP 49152:ihtSn8EApI0figmgiDn0AP5wFhxSMmT8oWgBCaXcvarSj8RoTCCqhxSMmT8oWgB3:DX2i/phu+M4FHXcvJTO+M4FHX
TLSH
T18FF5F013F2C900E8D06ED178C7568632E962BC154B25AAEF0A90B7552F7BFE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 2.2MB
SHA256 477960cb514fdb76026b9450fa00c5d6c9201302bc09fb07e2f55e420b9f992c
MD5 4a0a890c942d8371edc33aab3fcf588c
SHA1 859387d1803ae578a8516f756f90211893c374a9
SHA512 9c388ae8824b568a1b5ba1279340c4177e0b6cf941a7d69a347e93cc1e06660ef774af5e31eae38d25ce5cec16cc2a26e4705b0b88c8c7ac0514c9b4300ca8b2
SSDEEP 24576:M9rKhxr+EHNmT8oW4ll1JCrLKXIyaKngL2jdshRTdG1YxITqvfPkbIcbjLm:bhxSMmT8oWgBCaX5arSj8RoTCCW
TLSH
T1D5B533BFDF8A89A4DD1B5734BDB29A0D2CD62FDCE003061ECEB52E5C797AAD51129100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 2.2MB
SHA256 3d132f96552870febe9eeb4e4b3a8730fb82c0eb2ca60482fe593b42fc417d18
MD5 b5ac496238370957c3d2348e11da768a
SHA1 823c70f063dc6daadb5627df2aa2ecdfed62d033
SHA512 e77fc2508c889cf2c583f06ce84f3baa9f606ca8c39f6f869c575a5cf2827cd1086f5a730759fe9ff11499f7f16557b2cf60e9d77000a94b404e150a947cd818
SSDEEP 24576:sYrKhxr+EHNmT8oW4ll1JCrLKXIGaKngL2jdshRTdG1YxITqvfPkbIcbjLm:EhxSMmT8oWgBCaXFarSj8RoTCCW
TLSH
T14BB533BBDF8A89A4DD1B5734BEB29A0D2CD62FDDE003061ECEB52D5C3979AD51129100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 2.2MB
SHA256 b0442dd412167ba10449f41e0e380869954d39622f5aae9a323dc2227f4b0129
MD5 f644b928487e3cc635e0f06c4df5364b
SHA1 3ba6fb04bb99a60846c50993169192c5d5995d1c
SHA512 93e8e71a570d535a9e658e5482a05e198f98e4a453c0683540eda30ff7eb35c04b75108deacebed47aeb9be0f9ee79dda680d9353c6a6873cf82ed36d1ec035c
SSDEEP 24576:3mrKhxr+EHNmT8oW4ll1JCrLKXIgaKngL2jdshRTdG1YxITqvfPkbIcbjLm:ZhxSMmT8oWgBCaXnarSj8RoTCCW
TLSH
T19EB533BADF8E8994DD1A5734FEA39A0D2CD62FDCE003071ECEB52D9C797AAD51129100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 2.2MB
SHA256 c4597f1e3046f7191d8f4cdd57200c21b30cfc3a317760b5299fc92de002badb
MD5 837166cf2ced8b613ab353278c007411
SHA1 5eee8889b900650d88de54d714fccb79d5b29005
SHA512 428917568e3101fa3a968fdfaa8dca34cd75c3e65b34673df14cca7dc3089a84a558563287bfb3b26192ec19e5dfe2960e8a0a8c2645817a030aa4a1c45dce10
SSDEEP 24576:2rKhxr+EHNmT8oW4ll1JCrLKXI8aKngL2jdshRTdG1YxITqvfPkbIcbjLm:ZhxSMmT8oWgBCaXzarSj8RoTCCW
TLSH
T1B2B5237A9F8A45D4DC2B9738EDB29A096CE23FDCE103471FCE601E9C2E76B951539600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 2.2MB
SHA256 e757f37a24479c2c0dded09267591d9a5b4d19ad80db07c2d99e85a1ceeedf3a
MD5 1322cb1847550a39caaba10510f375f4
SHA1 5e2d5e97c5cf4242573c1e5c71b6288d3a462bf1
SHA512 9465d792331694ffa4b51f9b2bbfa8de7b2a0becbec8a337014d66d7fde760457edacccd674d53290af4400aa4598b48d146dfae52f80ef770b6e21605a700e5
SSDEEP 24576:grrKhxr+EHNmT8oW4ll1JCrLKXIVaKngL2jdshRTdG1YxITqvfPkbIcbjLm:jhxSMmT8oWgBCaXSarSj8RoTCCW
TLSH
T121B533BBDF8A89A4DD1B5734BEB39A0D2CD62FDCE003461ECEB52D5C397AAD51129100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 2.2MB
SHA256 7e17b562ffb3c7b4532dc7f1c81ace34d6839dccd4e4d63fda8565286ea40e6d
MD5 8f95ffef64231eb53a21bef5cf7d0bf9
SHA1 f31391ace34303ced1ae292bb4523908ddcf0d56
SHA512 c860d3bd87884764c73149ce25b71b8af5e8279016cd278e582f419bc5ff9b9122f3019c1daae2162a42fe1e112f33f2bf988abb67a732bff56b00a18e60b5f4
SSDEEP 24576:J8rKhxr+EHNmT8oW4ll1JCrLKXIZ0aKngL2jdshRTdG1YxITqvfPkbIcbjLm:NhxSMmT8oWgBCaX1arSj8RoTCCW
TLSH
T12EB533BBDF8A8994DD2B5734BEB39A0D2CD62FDCE003471ECEB52D5C397AA951129100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 2.2MB
SHA256 2c7cd2b2041613016546b89d7664b7ad46d2c0cf082a4caac8d1b54a557b06bb
MD5 e75e3b2e03fa17a74a48f824647d2e9b
SHA1 83417c475088953792741275b620c01b08847bf8
SHA512 1ebfcd5fb2f94dddb858209c6b881ef1c831c3a77690f23238833652b1a5e4d23430b95ae4ce04f02f88db595eba7eed24ddfa29df8c8f0a9ebff47b2507ecb9
SSDEEP 24576:vwrKhxr+EHNmT8oW4ll1JCrLKXIBaKngL2jdshRTdG1YxITqvfPkbIcbjLm:LhxSMmT8oWgBCaXGarSj8RoTCCW
TLSH
T18EB533BBDF898A95DD1B5734FEB29A0D2CD22FDCE003471ECEB52D9C397AA951129100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 3.0MB
SHA256 c0c754214239c7c6927abe3cb6f2d38130e3f747d171dd82f2559f52258126fe
MD5 94aea34b4f9f9e20360745bab7c762e9
SHA1 f32eb21564c4ec42900775dc024870a3003c9476
SHA512 9bd80c8737b6a6fb0fcf0c983b73864f7640091017853aa2f04268f8fb18a0f3afe517958febab38b4474b6abaa6843a721c82b27cf0b59b0723977090a38fc2
SSDEEP 49152:kZMozzjhxSMmT8oWgBCaXbarSj8RoTCCqhxSMmT8oWgBCaX:yzzj+M4FHXbJTO+M4FHX
TLSH
T1C6E523A9B74458F8EC27833DCD628906D9F23C9D5250C61F4BB83A692F337A11D2EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 2542925bbffa96b5c87bb0367721acea54653c96e81ebfc988285b83b79aabda
MD5 9c6470ea6ab827ba0489f745d0eb892f
SHA1 5a260f39d22b8f450054a52bc05e42ff9849c8b1
SHA512 060deaa13380599aac1476e4da1788b09c27eea388b1cccd77ea90617580a7f6ca098438fd211c7694ff77f239451f108058e7383c5dad83335a2039b701494d
SSDEEP 24576:f2wvik9RX6wkyAI1rKhxr+EHNmT8oW4ll1JCrLKXIRRaKngL2jdshRTdG1YxITqv:YMnYIchxSMmT8oWgBCaXAarSj8RoTCCW
TLSH
T120D5F129EBC848E5E177923C99B3460AF6B1785C5B32C2CF06AA53AD0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 ddd723a4e7ed3dd3f1cfaf53202930d66db9cce3332ee130451e76166b9b2542
MD5 638b679691ef56af1493c74ebece6cb0
SHA1 43039d5bcdbba14fda9eb201d7f47cc6ba7b0f4b
SHA512 fa2dd69c37ce33062d8a76cc392bb5d75c0fbfc261c9b9f05ac0628944822d730a9fbd371122f5e0e56667ef7237ed14214de5563247f9d1e6c746ddf7dde9c4
SSDEEP 49152:GYVeNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lhxSMmT8oWgBH:oySzPt+M4FHXkJTy
TLSH
T192269E96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 83d612edd35fcfb502b37ca39db81e7f5dbc05595107ac8e0e05375d507839b5
MD5 b9dc76dc5239ea3a57ca03d534032724
SHA1 aa5fa9e7b9b2ed5a2868bc4f1766185f2a3eadca
SHA512 08fa373bb9d32006bf520894ac77a481d9f5f796acfe4d522c5a2c9688a0359ccecab16486669c0f694e3919925f39445bf98234f0ca40743da6e0d46b4d4299
SSDEEP 49152:SX7JUQj7irIhCnDHUPfF/1hxSMmT8oWgBCaX8arSj8RoTCCW:KJ5glD0PT+M4FHX8JTy
TLSH
T126B5D01EA3DC01E5E1BAD23885558A1AEA71782D5B32CACF12B0437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.3MB
SHA256 c22cd626a8f18d6360fbd27b57cbd3c20892d65fc00ef1080fcab5ceee66fe53
MD5 f201f5b05f0637518e4fac9c9a9814cc
SHA1 03cd0ed64205fb94535a14d5d2b3bce4361cce52
SHA512 b5820447fa8e516bce30de1079c6a6cf426148bf86c229f5d95f908f474c9c9fc4f2152c2b50619298896c159135fde3f31f2af12c3f0550cafce3af89f9dcec
SSDEEP 24576:fJrKhxr+EHNmT8oW4ll1JCrLKXITaKngL2jdshRTdG1YxITqvfPkbIcbjLm:4hxSMmT8oWgBCaXoarSj8RoTCCW
TLSH
T1B7B5226AD78802E8C42E6338DB525A05B7733D6892D2C38F8AD0F97D1F766905DE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 258ba1a087a86373fbc4d99d0dc659ff8dc495b4acbe9c42ba160a536ba4dba3
MD5 3ea8ea72d60e38770fd6db548c25fc12
SHA1 9143aca550c2aace245b55cebe6e8d123aa61195
SHA512 696006adfb5a06c3478aba229af2c837b30e00e205478fe822131bc275ab2a7681f34f3ee311cc58a48b58f4e0e279a981982abf90036c4ad7dbbaedaa457c78
SSDEEP 12288:x8n1Q7UU3fefZfzxu3WTNFiUbI36OtrFNGHcI4rMZ6g:x8n15UPOZQY8UE360rFc8I4rk6
TLSH
T1F14507007666DA8FC6A940325E36D6CCA7707D02EE04AF1373C9973FD476659BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 d23391c94e9a2f1864f28dd723d9c1a4fa8abcb81de1b10544b18f2574826319
MD5 35c45714ea87961f47e039b7421a0a25
SHA1 56cfe7fedb94c0a0a496b3400fbed681e6c6d1b8
SHA512 9d999a9bebac77fccd83b5c5428b2d318f48a751d411603aef2f92b4683eebd87136460cb9900d81d806852f11894ead6e6f2907ef3d2c3b2ce162ae856cd342
SSDEEP 12288:Ak+oTbRQ++ys7CDSiPomMA8l0ygcsaoObOR6TuKm3+7aFPQ28ZyotzRHE8Lf0BN:X+oCXiPomMA8aZvNHybt/oBN
TLSH
T174550700A5B7EB4FC97E9033463286CEBB646C07F7452F0573458938986B95FB6E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 a0c0ff19324bd90fdfbe9e88004b682b6842b054b3d9094a3567b4d42399d359
MD5 90cf238fe719588dd82b738414420735
SHA1 b24c838189dd58bbde4270e2dd76735bd2844794
SHA512 9e8d4b8f9196407a3044f36624bfe7f73f650d625bbe8273c85c358f00a76f0d3155c244a4d05c7340fb5140439c99dfafb4675bfeccc5295864ec19d8a00254
SSDEEP 12288:+O7/JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:RBrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1AF6523719B0E985BFC3A8334E8664321695D2DACE30055FBEF2E2BA87931CC55D72712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e434769665be327b522971fb2986faba1dbe46457bc708af433bcbb5ed30dfd3
MD5 803b7875d4d47de4b1264f9612f6f084
SHA1 6827850408ec86516492007a1b4140bf36677c43
SHA512 d4125a8c6d60c4763b729371cdcd844799ea5e5b8c1dfce3cf753f5e17222112232a636d4cedffe6fdaf4cc5e771e4ff3b7ed53a23c0a47df22a2c7a329d74b7
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYnrKhxr+EHNmT8oW4ll1JCrLKXI:ugb4mBIBhGFbhxSMmT8oWgBCaX
TLSH
T1FA659E1E22EC02F5E0FAD2B8DDA64417D6B278161331D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 bfad9d677aa1a8ac657ede392b1d6fa5922c6395d020fbaf307b9ef3bd90a66a
MD5 7efffdf184ba805c50e31098a236f710
SHA1 c3aaa20b389108d16df5398d5157535eb146b674
SHA512 86edf96d8ba98c728df51de2a6adafb7e3bec05fa8089dfaeaee9fc85494c0d834b73ec5cc1c26c840a3fb6c8593665c2da266292245ab5c483b68cef5bb6d46
SSDEEP 24576:TGXaKngL2jdshRTdG1YxITqvfPkbIcbjLm:TGXarSj8RoTCCW
TLSH
T18605237EA7C56694C43BA77429B6A84A3CF33758870A46DF8CE0957C4F697E0263CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 2a98b6ec37e1d564a7dfba88bf7e9cd812c43d066b12aa5bf4e169cbdbd4cd70
MD5 bf0d47dc806c3bb8726fd7535244c801
SHA1 76c7ff51d55d2386c6f30826c65c9a87c37dca03
SHA512 223d9480a401e6b97dc2e3daa1214b4675a3f788af644c68bb611daa64609474a5edf2df424086fc5eb9d76c617f7a43d5970aef1b6e842750d35ed8392d228c
SSDEEP 24576:dG88u8FpJqH1hzria7/m4rKhxr+EHNmT8oW4ll1JCrLKXI:w7ZFPqVoa7/ehxSMmT8oWgBCaX
TLSH
T1A395F16567E101F1D47BD138C9824663F6B2B8251360EBDF0BAC8B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 f4ad87b162c5a5e6147d2379b2d6d8f5c5c1610c0d666b02658cdd52bbbd7ee0
MD5 62efab7c103fa1e4b0c7c425f1427331
SHA1 174eeeeb0fdc7f30882e8a8126b25787f56b1ea9
SHA512 0a2ca887cb9c5cafc8d66396500f7d9409b135bc7122e6f5a2814581ba5fe1e75cbfd25cc0174215a6eb1baad5e6aebfbe010fd3faa658d56c7ac0844a7737d9
SSDEEP 24576:4PUr+NQsrKhxr+EHNmT8oW4ll1JCrLKXI:4JQfhxSMmT8oWgBCaX
TLSH
T19385F12F269D18E5E67AE13DC9824719F7717866131292DF02A1817E5F33DE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7cd58903a7ba1e9ffae333f0212472aae28beb58ff9589870571854b976b4019
MD5 796aa24e9f82b671ca8c0e749fc69c94
SHA1 7ada608874e26a4f418e58971018c6f8f6b3158c
SHA512 f04292d23cb49680aef2f3b09ea38da4e59da3198d557ac84cb8050548df6aa4da57dbbcabbc6891d0b30860159f7f8ff3bb66461f4d059bb62ba439474b8e09
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPhxSMmT8oWgBCaX:zG05lO43bU+M4FHX
TLSH
T1C4D5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6bfdbe1c5f8b7ca736bed51a807799fbe3e4d05e92906c0cb1fa63259de9828b
MD5 b0083fc1e39565f8c68155145a26bc02
SHA1 3aabe23da62fe098e24c4b57388f97efce7cec46
SHA512 2fc7529fd14b717dfb76415ccb605c5679d44fe5147a6530ae7dbb7e8ad1e7efb16db085c15b7fcb195593996ec4ef06b545753d2d39efeff19f703386554462
SSDEEP 24576:Wfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnSrKhxr+EHNmT8oW4ll1JCrLKXI:Oa5POZ3+Jt2pasx2+m3hxSMmT8oWgBC8
TLSH
T11065AE5EA7FC00D5D579D17DC583861AE5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 78ba76691b950afb9ee728453de56c5ab47fedfce7c26d01c6a3022c94348f37
MD5 fa2300a30abd3ebf0f8754cf7bb6702a
SHA1 4652e8fd0c42d1706e4d8c827c9e036caff0c300
SHA512 551a73f777b79c29006e21df8bcd9a8a769117b3f6cdf6069927baf59cc0864fdf64ee5a93ee2ff9e7edb87f6c255cd815409d875d24501dcab8da9ee30adbba
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkArKhxr+EHNmT8oW4ll1JCrLKXI:6Nc/zEOVHF+hxSMmT8oWgBCaX
TLSH
T1AC858B2623E900E4F5BBE1BE89779546FA717869533086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 2.4MB
SHA256 a6de348d7b871a047892efb7a81cef56f4763da9ed85cdab86c82f2747f08c02
MD5 d3989bbdfb9c19c279e46097d2a167c8
SHA1 77a76ad8bb6b4cc3a7d47789f78fe48f1a2f5f64
SHA512 f14015ac3109fa6212286039bb1b1e2324e4b7df76d91d9bded83e4cf92bdac78cea4e0aa1454021f51a3af229852e763a9ad25db92089f685ac3ec6b20bb78f
SSDEEP 49152:6Nc/zEOVHF+hxSMmT8oWgBCaX4SarSj8RoTCCW:rIAI+M4FHX4SJTy
TLSH
T1F0C5BE2623E901E4F5BBE1BE89779546FAB17868533086CF0291851E1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 7d9fd8c839405c058646965315d7cda957139c6edcc5c4d6df6416abaf4209c2
MD5 dca22f60eee682ee31109feccd55c30f
SHA1 7d4e725ec0b44edb80b135c02b96070ac877ac91
SHA512 8ba17ded7e7b70c56793b363853d1e4e89d0561bd0cabba6e55314d95bbbd88f23f41adf5b8227035b967f6a07e2a9c9d3f6582b7fa449ba9edf588a0b02f2e4
SSDEEP 24576:t6DIdaKngL2jdshRTdG1YxITqvfPkbIcbjLm:t6DIdarSj8RoTCCW
TLSH
T1DE25126D63AA01F4D06BE13D96934505E5B2B6B483074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 a98dd39a345e5e573759ee6b0c7c3ea666542497f5bb65b59c392f70c2bba7ce
MD5 d1e48deb48ac7ed90a43d8518231f8ea
SHA1 89f4c992c6acd0d2067434f4171c8f319abbddb4
SHA512 1577b6e8fc3316f60f50b442bd00a6f02aa9f2da3304cc81c5fac47345fd05afd3bd14a14601c90851316dbcd0683f81599b57aeb7935804c5a902499f44dc4f
SSDEEP 24576:Ntyd+aKngL2jdshRTdG1YxITqvfPkbIcbjLm:NtvarSj8RoTCCW
TLSH
T17315231A97C456D4E57A27786EB385886D727E289B0783CF89E0E63D2F377D06934B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 17f0d60fc0ea8829e8a40d6d8f1df6712b76990e1bdde19f82b61edc83cccce8
MD5 72be510f55d352dfffeb0f6ee787059f
SHA1 e2f1fdeb97182202a40c82caf84cf08529b395a4
SHA512 9da5a046424350d97dc3b5ffc145389885b629d43dcc207de1216da5f1bf67773751d9e9b560a49664732701fadc61fb9e64731cd5321399cec3300859ef1bd5
SSDEEP 24576:ijaKngL2jdshRTdG1YxITqvfPkbIcbjLm:ijarSj8RoTCCW
TLSH
T1EC0523BEDBC55BA4D41A7B783AA6A94D3CA3376C570B46CF8CE0597C4E7A7D01638800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 73f8755f8ee7e6154048396ef1522fe1fefb4beaefcaf47a53223c7e4355719c
MD5 73ced7f8cbf343e5d4d06f09ec768279
SHA1 54fa01b99d80b6baab7dc74780ff67e1c401a41c
SHA512 c78a8bf18c22d8f15ad6dcca3448f308ec3d47d9f0b38b857dc5c7d5ea05b445303722d2557ae3af9f3e67181f089b85eeaa3e930e2e9f3da31bcf67e5a3ca45
SSDEEP 24576:INgdLoTfaidZXaKngL2jdshRTdG1YxITqvfPkbIcbjLm:IgyTrZXarSj8RoTCCW
TLSH
T15465AD1DA7EA06CAE2B2D675D8725483D633B4315772C6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 27691e25b00ca567e194248d70ee732969f2504c874fe6856d8ced1fd22f9f3d
MD5 417f0a56e99fd9184f4a8a7c9e9f660c
SHA1 905f3187934c9582398358862587bc884e4124a7
SHA512 d2f88c5efca6abc529452b79b1cabe9fa9c63db53a64ee74ce68fc49b5c1dc1bcacb45d2a30803336c1a78f2a0e97fe7a19eeeea2d2cd4bdbdcc66e50f41b0c9
SSDEEP 49152:Sgb4mBIBhGFbhxSMmT8oWgBCaX2arSj8RoTCCW:Stu+M4FHX2JTy
TLSH
T147A5D01E22EC02F5E0FAE3B89DA64407D6B278165332D2DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 39eee7c6cb2d18312f7fcb5332980b2a5a69d79856c99b7cd4cce07ce59ccb54
MD5 cf6d9243440edce2e3f1d8e8b95d4ab2
SHA1 9162f6b20549b29338471e00c0c0b1394f4e0540
SHA512 1e9b8214baf12eb14c9cb203e1afe5bfe5c19ba15d164d11864fa4f004da4d9d1fa879f00d791b4aac8979aba24b39f5ee86f9cd265232012cd0373c7c28e7fe
SSDEEP 49152:cDMwBtOmRhxSMmT8oWgBCaXHarSj8RoTCCW:2FZ+M4FHXHJTy
TLSH
T169A5D16EBBA846E4D1BEC674DD238512FA727861133253CF8290C13E1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 a4f6ac971c0afdca1df2762ca07cefbf38ac372a24aec37894473db4fd0c9fd3
MD5 05bf154816fb21e0a2b0b815bf8f12c7
SHA1 1a3155da399e66a0a9231effca3d961b357921b5
SHA512 01619bd197053cc6eedbe850946c1959f7796fc3eae558f8d2a806ef95ed731777a3138c39561114234dfcd6d5e0cbb986973d6924159a8cc2cd46e438047def
SSDEEP 49152:zDVHeBIAAkhxSMmT8oWgBCaXYarSj8RoTCCW:2+M4FHXYJTy
TLSH
T11AC5027EEB5C04E4D57BD27CDA638A06E6B138AD031256CF06D481B91F6BEE42D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 7aa32b4065e127aae174cba58538bf423f9fa477841a81f08a09b28297a94580
MD5 ed55439f029204457e59a38e5bff4e62
SHA1 1c488464fe7736998cc55285477f634d28f6483c
SHA512 729a460f903772441fe31db18bbffc22681767497a278fc3ac6c30eb8651585a8c63eae3197c4687fe187b746e41a7ab4381b9bd554da13d06cf36f31e833908
SSDEEP 24576:wJnJPbzB4S3aKngL2jdshRTdG1YxITqvfPkbIcbjLm:wJnJv6S3arSj8RoTCCW
TLSH
T1A935F13DD29810E8E4B7C2B4815A1B5ABE71387C2F1669CB59B4D5343F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2866501b227843b8.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\2866501b227843b8.bin
Size 12KB
SHA256 da3a67793829f068859df87b62a6fe806d29a292293ed190e25093f61eb5115b
MD5 c8eea02989feff919bacfc32fa9cecc9
SHA1 08e481d8494d8df9cecf361042fbb0e2362dff72
SHA512 1838d238c8fdbadc43b257e0ee937c033ff4d14cfa3e3bdbbede2b8b06ec009f46ba319394bf982e7df85430332e673ef45eeb6f552d7261bca1c9aaf5c8dbda
SSDEEP 384:icr0JZe3/k06p33LjhrhlNy0Kzy7uC+3msfnoA:1+J06p35DNezQvcn3
TLSH
T19142C018EEC78B83217DAAA80C86C2163D05063DA0126438865757FD575D63FF9FEE2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 7baf6c0d5380cdc68af5e9aa42a1432a7d11b8f87aaf79684110c6d5aea9eb59
MD5 85a7116677bc55cdf0eeda5b72c07f8b
SHA1 9cfe79abd702aa89b67e03cc8720ecc6add0e9c7
SHA512 364b4b05b41ec51cfde30e0897d397554459b5bfaa7d232496722988e20490660c350d73c66d05db8d9f21ebaadb15c58afc862e02b7e24a1c81d4fd7ab44d2d
SSDEEP 24576:SWaKngL2jdshRTdG1YxITqvfPkbIcbjLm:SWarSj8RoTCCW
TLSH
T13B0523AEDBC48B94D51B3B743AA7A84D3C933B5D974B47CFC8E0659C19AA7E0263C440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 af773fb5a0e7c2c07d9efb2c8fdc9bf562f007376c7670e25ae071c2a7c0334a
MD5 f9843e36c9ed963e4b31c8de9c869131
SHA1 33d2e7cf28e91e17d3c2715aff423ba93efaefeb
SHA512 fa79c76f676927e6fd75de145fb0caa22b06bd96f650126442468d13c07d0d03ef043a5450dc40f4e2e6ed3982e2036c10cf298bf7208fb598cea6705d32779c
SSDEEP 24576:k6UqjphaKngL2jdshRTdG1YxITqvfPkbIcbjLm:k6U8arSj8RoTCCW
TLSH
T18715236F97C419E4E03A2734A9B6C10918B27E7A035B82DF65E4967E4F36BC0953EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 41a5aaadf8e330ffe3227912a46dffc66c663adbb2f4141356e095a0d5636c21
MD5 8333f56ee3a9c97de36d4a10d21312ba
SHA1 a6ec83a40ac7b7d04732d243a138bf3cfa852002
SHA512 fb16bac1b533e7713744cf768753739f4f615241519bce780f8ee1af0a9f190b4f9dee74fd80f17c9e2b03c4f1d20e65aa6f62dae59cd5a93e6959622c737977
SSDEEP 24576:lCLHGL0MoeVtFumTijCmlKQWDkWaKngL2jdshRTdG1YxITqvfPkbIcbjLm:lCLHGeeV5ijCmlDWDkWarSj8RoTCCW
TLSH
T14FA57C05E7EB4284E8F3CAF5CA2694169A327C549B34F7DF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 9accbccb697d4546016e66bae5b4bc2b59215e5145ae706792b6987fd2879389
MD5 328c7de357962fd1288e5293b0160307
SHA1 93c323a03c5b2db4c3b6749e7437e183eb549077
SHA512 5c8b0590ec8112f33a86d716da54bb1f241a90d1632cda04678e343c3804d0968020f0ffa61ae3454c125f39af66ddd11a75b967df85f61d56f8d4b76ba12666
SSDEEP 24576:lrcmR2aKngL2jdshRTdG1YxITqvfPkbIcbjLm:xcmR2arSj8RoTCCW
TLSH
T11725015EB7AE00E5E1B7923C89828549FAB37534530257CF46E0877D4E6BAE97D38B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 0c690480914ff77a41836d911d9bcf91a42aa6eabe0c21d900278e9fb139fb7b
MD5 d3140b8c4d831b302a81181f15cf2f1d
SHA1 6cbafc95f0e2a642e00b821f2d4caeb8bfab06e9
SHA512 b565eba104f44cf5f2eae5f26e19d2365be2424f3a0a20ab004ad316dad59cd111e0cf7abdd15970401fd1e1d4765bdc8a9e4820e5875483463a92ff4bf3329b
SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3karSj8RoTCCW:j3Upow8sBRJTy
TLSH
T180B59C3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/880-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/880-141-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/880-147-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/880-151-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/880-149-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/988-341-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/988-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/988-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/988-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1036-118-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1036-120-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/1036-126-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/1036-318-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1036-336-0x00000000007D0000-0x00000000009A2000-memory.dmp

Download

memory/1036-360-0x00000000007D0000-0x00000000009A2000-memory.dmp

Download

memory/1036-598-0x00000000007D0000-0x00000000009A2000-memory.dmp

Download

memory/2812-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2812-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2812-315-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2812-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2812-113-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2840-559-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2840-557-0x00000000043B0000-0x0000000004410000-memory.dmp

Download

memory/2840-470-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2840-469-0x0000000140000000-0x0000000140300000-memory.dmp

Download

memory/2840-494-0x00000000043B0000-0x0000000004410000-memory.dmp

Download

memory/2840-478-0x0000000003920000-0x00000000039A3000-memory.dmp

Download

memory/2840-561-0x0000000140000000-0x0000000140300000-memory.dmp

Download

memory/2840-555-0x0000000003920000-0x00000000039A3000-memory.dmp

Download

memory/2840-485-0x00000000043B0000-0x0000000004410000-memory.dmp

Download

memory/2840-484-0x0000000003920000-0x00000000039A3000-memory.dmp

Download

memory/2840-476-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3132-60-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3132-58-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3132-47-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3132-53-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3132-54-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4244-213-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4244-63-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4244-69-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4244-62-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4580-128-0x0000000004140000-0x00000000041A7000-memory.dmp

Download

memory/4580-0-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/4580-133-0x0000000004140000-0x00000000041A7000-memory.dmp

Download

memory/4580-85-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/4580-16-0x00000000030B0000-0x0000000003135000-memory.dmp

Download

memory/4580-14-0x00000000026E0000-0x0000000002747000-memory.dmp

Download

memory/4580-8-0x00000000030B0000-0x0000000003135000-memory.dmp

Download

memory/4580-1-0x00000000026E0000-0x0000000002747000-memory.dmp

Download

memory/4580-15-0x0000000002DE0000-0x0000000002F29000-memory.dmp

Download

memory/4580-465-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/4724-29-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4724-30-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4724-28-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4724-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4724-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4892-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4892-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4892-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4892-157-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4896-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4896-99-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4896-90-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4896-287-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4896-563-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4896-565-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5820-73-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5820-75-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5820-241-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5820-81-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5872-86-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5872-265-0x0000000000400000-0x0000000000577000-memory.dmp

Download