dbd9a536fd8b3c79309696b6c817df70c870bfcdc2c47aa238027a79d7b1a624

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 2.8MB
Sample261001-hvx6vashph
SHA256 dbd9a536fd8b3c79309696b6c817df70c870bfcdc2c47aa238027a79d7b1a624
MD5 bcf26f494f13156522ce1e075a2810e0
SHA1 86fb7dba2b8001fc6414f3a6c0d4b336a1315bd7
SHA512 8708ecc4f2485f14601c5c26ce05ec0eb0419603b9f07d1b92ddb5a91ce50b4657ef67a36d23e0e119db2eeda36c028b580483ca2529ea5aa4c8ab00367b8ceb
SSDEEP 49152:LrxRP9sg+K/V2c+JXA9n/TDbXNKdR0t8zbL6AIxi37+A9n/TDbXNKd:L3MGV2+fb9sR0tUaAIxsnfb9s
TLSH
T1CCD5CF0277F98179F2F37BB19EB893655A77BC71AD39C50E2281215E09B4A40DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5904	elevation_service.exe
2748	elevation_service.exe
5372	maintenanceservice.exe
4248	OSE.EXE
4984	PerceptionSimulationService.exe
3348	perfhost.exe
6132	ReFsDedupSvc.exe
5864	SensorDataService.exe
4636	ssh-agent.exe
5948	AgentService.exe
3916	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
	\??\F:\	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d948a5213a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000000934f-476.dat	upx
behavioral2/files/0x00010000000093de-477.dat	upx
behavioral2/files/0x0001000000009952-478.dat	upx
behavioral2/files/0x0001000000009cd6-481.dat	upx
behavioral2/files/0x0001000000009cfe-482.dat	upx
behavioral2/files/0x000100000000ba34-487.dat	upx
behavioral2/files/0x000100000000a0ce-488.dat	upx
behavioral2/files/0x000100000000a1d4-489.dat	upx
behavioral2/files/0x0001000000006223-494.dat	upx
behavioral2/files/0x0002000000019c8b-504.dat	upx
behavioral2/files/0x00030000000184ba-509.dat	upx
behavioral2/files/0x000100000001ae47-508.dat	upx
behavioral2/files/0x000100000001aefa-507.dat	upx
behavioral2/files/0x0002000000019c91-506.dat	upx
behavioral2/files/0x0002000000019c8c-505.dat	upx
behavioral2/files/0x0002000000019c56-503.dat	upx
behavioral2/files/0x0002000000019c47-501.dat	upx
behavioral2/files/0x000400000001b22b-500.dat	upx
behavioral2/files/0x000100000000627a-496.dat	upx
behavioral2/files/0x000100000000bd44-495.dat	upx
behavioral2/files/0x000100000000a319-493.dat	upx
behavioral2/files/0x000100000000a304-492.dat	upx
behavioral2/files/0x000100000000a2c1-491.dat	upx
behavioral2/files/0x0001000000009396-490.dat	upx
behavioral2/files/0x0001000000006215-485.dat	upx
behavioral2/files/0x0001000000009b92-484.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067f6695d7351dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d9ac05d7351dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000d4bd357351dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000adb24c337351dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d1870347351dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a546ce267351dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a280c7327351dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000990252337351dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056f65d317351dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004286c1337351dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5904	elevation_service.exe
5904	elevation_service.exe
5904	elevation_service.exe
5904	elevation_service.exe
5904	elevation_service.exe
5904	elevation_service.exe
5904	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	5948	AgentService.exe
Token: 33	3916	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3916	SearchIndexer.exe
Token: SeBackupPrivilege	6132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6132	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5904	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5872	2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 2588	3916	SearchIndexer.exe	102
PID 3916 wrote to memory of 2704	3916	SearchIndexer.exe	104
PID 3916 wrote to memory of 2828	3916	SearchIndexer.exe	105
PID 3916 wrote to memory of 4784	3916	SearchIndexer.exe	106
PID 3916 wrote to memory of 3400	3916	SearchIndexer.exe	107
PID 3916 wrote to memory of 5032	3916	SearchIndexer.exe	108
PID 3916 wrote to memory of 1656	3916	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_bcf26f494f13156522ce1e075a2810e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2748

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4248

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4984

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3348

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5864

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4636

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5948

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3da43145bf0e5ab1d9b6cf349111f5ff6ce785f3b1f4043d389db33833b43b85
MD5 d4176bf473d47e1ef41727ec64f10d24
SHA1 8fe842d13b8f08098090c60dd08fd613c6fd82dd
SHA512 94d8da4c79906f3ea00e87a1d62b181beaf3e963ac36b06d5a1f37e405657a6e62de1a014ff6f29b8e5a68b3ac37324002bd7cbdd808b63b8364304ae9bec120
SSDEEP 49152:Zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxntA9n/TDbXNKd:v3q6sjBvfb9s
TLSH
T19ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 44bbc3e1fc564c1c112396e23ae99a9a2222e8c4356378611594f6b478e9babd
MD5 1b69230ed05fac7e47bd50472174a9ea
SHA1 733e1a945519361766c3501962cf9d957b27c04f
SHA512 9cf93fab308672bdb511ae6e334b68e96126edeeac4e2469d8e7e84dfbfa90f7adc67782f6decf0ae144c205f2fc9d7bcabd1ea9402631d6785a7dc4ca0d16a8
SSDEEP 24576:rXYfDtczAAUeA9n/TM4NZYeNm+9MhUwd:utcjA9n/TDbXNKd
TLSH
T1AB85022867E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333D85E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.7MB
SHA256 83fe622de9cfa2ab26e549e3a6243cce3533ac1d70ba50fb88cbe049ed3c6f76
MD5 1782718990131cd241af57eac754f4f2
SHA1 744a2adf0d030aeacaff2c04b9c884ba58f87c5f
SHA512 d4f33a25fe115df292cf27fb32d8bcea6019847006d8fa044dbe3f52ea193ccd96e7683d644cf60210d118cccbb9e61ae50820656a7b73a69c6a8aa9338707cd
SSDEEP 49152:16K10dS0A9n/TDbXNKdS0t8zbL6AIxi37J:QKGmfb9sS0tUaAIxsJ
TLSH
T13CD5D015F6B88731D073C0B9C5D2A68EE971348557308ACB4286D77C3F67AE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.2MB
SHA256 b1e865360bf58a1e3d4180b87a74a30fd3a1be63562e68b4a63cea00408b588f
MD5 61b02171315bd311a597be97b2b444d0
SHA1 7abece32735ed99b410013d5463d029fd53e1453
SHA512 de7e756a5f4e5715e8a11029280024e1e9808c1c27c1199c694bd6fcfd7b653e98103622d2fb24ba32fcf939c87b34d9433a239b04af538a34eb4a9c8cdcc329
SSDEEP 49152:GoezSC6vUzPvcHjyAA9n/TDbXNKdM/aOzB7yGmTK3Aa08+:hezSC6v2XcHefb9sCaO9eGmhXP
TLSH
T19FB5AE15F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.0MB
SHA256 3f788d32649c9b13276a236e71920c524818c113b8600c1060c76e95c31d3e16
MD5 622f8ddb990316c9ddb082b024930d99
SHA1 5b676d25e461ba40de00759bb8ba58c038cd95a6
SHA512 7126964a0fb9ff776e4da152ca53b677b1bb30a5e677acdcc7f5d534bf6f3e6cfbdcb702d8321129bc9b74aada4c66b1b2a139055725eef2476bb65892dc644c
SSDEEP 49152:SaOoopXl+tA9n/TDbXNKdR/aOzB7yGmTK3Aa08+:+zp1++fb9sJaO9eGmhXP
TLSH
T1D9A5D066F6748331D073C0B9C5D3AA9AEE3234425B318ACB1246D76C3E276E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.2MB
SHA256 5f3e3a129e6b0d4eebbc01c82a093f1e18c6f3c96fa1ca42de766499f5285faf
MD5 21367acd981bdcbe5d32a2e4f584a634
SHA1 0e9cbc0f31e60aeb3082262e8fad8c6738cf479d
SHA512 a9b6e1a613ad8ab1313059aba3399d85a993f7f9ebd7b1522d32ca87c290e8b7d1bbf659b80974d7ee4d9536772c4fa61308d5337d2a0f082e5af454f4530e5c
SSDEEP 24576:IfdUeA9n/TM4NZYeNm+9MhUwdca/3aOCcyIXBBZyGmYUKFDZAa08+:gA9n/TDbXNKdN/aOzB7yGmTK3Aa08+
TLSH
T177B533828BA800F2CB4F6A34149E7B086D57EE8EFDD1563A5106B3653D304BAD67274F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 2.4MB
SHA256 592169080c96fb0e4d1233e114d1bf172b49ad42bb82dc31f5719234e0b5fa92
MD5 ba862b086888e47a1016f32346cfeaba
SHA1 bf838246b08cccb63cb7bff84fe15cae87e66a3e
SHA512 df4376be4d9fe7b1d892368f77c0ac38444287803710323c405fe227bf8bcbfbf5a3e5a3bcd1cdbf76ec0136308f3576958b56620a700b38eb9863ef371be16f
SSDEEP 49152:CJIU+A9n/TDbXNKde/aOzB7yGmTK3Aa08+:Mfb9sEaO9eGmhXP
TLSH
T1EDC50127EE28ECE2C27E8D7856918700E772B8318F51A3CBD125C30E9E235E55E76D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 5.4MB
SHA256 ab99ab5616aacda4ab4b53b842e30289409dc17e652c4edad15899fb9f7575b8
MD5 f92b6caab65bf13b1877341042816b98
SHA1 3ff1c19be010712ecb4ae71c85a9796250b350a6
SHA512 3e17b6dd128a4e35af06d36276942b679cad6151f4158627937db5e947396c0efbd97a128cab04034a9c349d0bf44b92ea3299b8aa9def57bd7948ea135d6f5f
SSDEEP 98304:9QvGAdlCEL8c/6RNw5CIfb9sSaO9eGmhXP:6vyEYc/63w8S9SGy
TLSH
T1DB469E656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 2.5MB
SHA256 7ac5072e6d1a050cb79396adf7797fb8085284d58c3226b63e77dd7cb540f9a6
MD5 ca9fdd1500ba05173506b589cce1411b
SHA1 ff4f14bef6db6653b4d7aa3ef76dbc427f874fa5
SHA512 6b83d77384b982f1a32206dcff600c1b78168ef806baa23fc4cab239ca7c36b0d061819d545af728be9b99aa043577fe8b741585709dfc2167693da7d3bbe628
SSDEEP 49152:oljkA9n/TDbXNKd9/aOzB7yGmTK3Aa08+:Efb9s1aO9eGmhXP
TLSH
T174C50131FB74D032C77F0DB21B2AD706586DBE604F911AC3E3A89A9D59301D22776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.7MB
SHA256 9b330fd0f0c55215a462682dbb608cae7d0bdcc6f335d14399ac8c80eb45a4c1
MD5 5e70d0fba187c7838a5ff00cf0219074
SHA1 c88a80d6e8072e12c8a76e3fa19527371119c5e1
SHA512 6fe303849a84486c7c09cd5de699b3794c3cbe0206eb56e09590695b7eb9c907f500de0d55e47f3548c5f85d48376cf7c208be9df899863817db4763f12217a7
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLytJldPlbuJHx9iGy:QUEtQevvqc2W1cpV2tJ32m
TLSH
T143475B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 4.0MB
SHA256 1b126fbea082f9a2c2877e9c1a48ab5da6e9ef80f04d73fabd49eeac4d148d77
MD5 450a6c1469c98f75b10f28a9b174dc90
SHA1 008b3130a371618239e38c84d679aac35997b92b
SHA512 14fe7799f310c6718e7fe63bcc32e6454ec962abb5161f2a292af2660e85c7e0dd19626854f4df64f06e955f56f08c0eb04caf8e20894d5a3bc38250695f041f
SSDEEP 49152:UzbRquA/m2yL5zwfFiV+XenmE3/zEA9n/TDbXNKdM/aOzB7yGmTK3Aa08+2A9n/W:6oq1Vjnmcfb9sCaO9eGmhXPPfb9s
TLSH
T13316CF0976B8C1E4D1F6C77886A2C647F37178158B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.8MB
SHA256 b440829332345bd6372ad1ead171e741937bb1c8d5064e22e1e274f00971f7b5
MD5 93fc5845d1cd2e7f033829cbe92bcfb5
SHA1 03e96501558f0967b1073c1787d405f18a2ec3a3
SHA512 a6096ded176700ee2e34a191f77d457c4b345bc409954e8a744aeef5db2c04c10b6b1ffbc9d7e4f3be7a73f9ab7963e93eeb7d8ec541be0ec87ba0c851d89419
SSDEEP 49152:pAM5Foiq5PA9n/TDbXNKdj/aOzB7yGmTK3Aa08+:dq6fb9s7aO9eGmhXP
TLSH
T1D195E081E7F945E0F5B3AA7899B69170EA76BCAA5E31C20F2150D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 6db7f52ea74f47b343010d24bb02963ead9e15960c49d08338280b0e722f60aa
MD5 67e70c59c5f34782288035e7936d8fa8
SHA1 94dade751c7190ac59dbe7c1a878018967fa02b1
SHA512 5ef68cb66e2cf80d6c2a70f3f37a62a097c43f7558165a7caaf2c201c125391dfd16cd7b26fad62fc1f439cde29be6312b45d39acc478033fe466db421217b70
SSDEEP 12288:Umw5HEjsChNPBFgl0WDm+C/BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:RwuWOW2UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E485F14637E80CF9DAA742398597D535EBF2BC062A25C71F0760C61B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 2.3MB
SHA256 c0b5d4d3f01cc7610ac28ff09646eea6089aff179337f10f154f195b73ed6bae
MD5 0b99d06e8209d154702593c178b8b71f
SHA1 d3f42f4fe8b30ab4ffc31f45df424d2adb9810ac
SHA512 b0a080421c313790fdd10f67fdee969a19b20d131eee3c46ec38f4e7ff0999f6ea031be36578dae7b80bbdcdb3ac9bef29e2a2013a672c11de99696571e9a9d9
SSDEEP 24576:TNu1UeA9n/TM4NZYeNm+9MhUwdgT/3aOCcyIXBBZyGmYUKFDZAa08+:0A9n/TDbXNKdc/aOzB7yGmTK3Aa08+
TLSH
T108B5238227E800F2C787563888E96A04EB63FC5BBB7143DF121593652F329D65E3671B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 7.3MB
SHA256 7c14ac2281fc2de12033fe37d5ef7afb0f0545c6fabf36b498b0d542d812871f
MD5 00961e6b9d827db33b956b8151edbce0
SHA1 5d9dd980de2352bdb97b56e9a15eab71667df331
SHA512 f80c50a9f6904b184070d8f504839143efada1bb7859271e023e3156f101bb182d05fce3f2ca971f65089c9ae3917534160781475feb91f635da68775597a7d7
SSDEEP 98304:5QRQyi36YOcPtLvw2gAf+PN3rfb9s1aO9eGmhXP:wQyiKatX+PN39jGy
TLSH
T180768C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2357ade7b86c1affd960989637e9be0d03b146488ee3d7a44184fb5cab95bd3d
MD5 0097404fa848b87b6ac6d074ebe36c30
SHA1 eb226c23254f3a341742396fdc05ed9b34dd38d9
SHA512 5a8ec0e85178828c2f3230ea0959bf2b426343b4362a5c1b227bcbb5eabafd059b9410f804d76a216a590cf22b90c03f1558c1139b86f4d4c3fbbe5b006c888c
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uy:nQRQyi36YOcPbLvw2gAf+PN3rfb9s
TLSH
T194666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.0MB
SHA256 a3ed48161fd8e5f92680cde1dd7d2c3458746586de5e926346f805f5963dcbdf
MD5 5c245b580dccf7bd35adc8e5420a9a80
SHA1 4f76961080d018c1aeba24488c2dfd70497c6ef3
SHA512 4babaf002cfc76562844769a643885f4b5e3aeef86931c7c6302d1c941d8a80d0745200f34440bd212e3dd56cb405f3a7d4a9820a2f4e20d9c66f8f263456069
SSDEEP 49152:w68Qg55nhgeWu7PNU3/0A9n/TDbXNKdp/aOzB7yGmTK3Aa08+:qth/Rc/Rfb9sxaO9eGmhXP
TLSH
T1E8E58C33B2F600A9C44DE1769F4A972196D27C758FE0E3DB850172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.7MB
SHA256 73d3ca7efdad157fab11d4f87ddf10d0d4ac332e2aa21353d03251263cad9fa5
MD5 de1b212edc364e66c47caea2bcb3e01b
SHA1 3e1102a1b510191c147006a5649e4e14e4fc4c90
SHA512 3a563b7997d90962df7b0334b660f72eeb6bec0cb6c32b0fc1b1fc3b5dcb99fc936f4fcadf89dd61f2b36df3cb4c7ee73ced4051d6f60d0618320f95f1150cc6
SSDEEP 98304:By5112gYy5azzVvj69nLKnhZyfb9s4aO9eGmhXP:cLIHSWhu9QGy
TLSH
T141369C13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f72e01941119c1dbc2bff9140bb666b44e77848ee56cb958a5e6335fa3444430
MD5 0fae4818d72fe678c5072c0598bcc942
SHA1 4b2d151ee826554cbd3533bf17551c3dba5f4ce4
SHA512 5915c4b0878d8edd5800b2cc0b87708cb273240660a48d5f040eb15bd59583707e4de3d99ebd044ba6e2f2d60b1fdc15f982764ee89ede74b588569c347a11e7
SSDEEP 49152:8B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glSA9n/TDbXNKd:Wu6Jmdxd2dTfb9s
TLSH
T1E6D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4b9fcf01f749d61ba7213d727d8a37a2b96a692848752446cab8def82fb1cc38
MD5 774ac83f5d6331bfe7c2493e68fc6d6f
SHA1 5e64e52bd7b14b0a6bc699377911b6622a4fe324
SHA512 31e842628b274615cc48bfb61d8035b9071183fa4f10bb2f1606cb28abcb49d4cc582c2c69bfbf3abb27d4d2b78d705d5f5980a2938da2e4f8149097280cbac8
SSDEEP 49152:K1hpsNoJpF1A63U44CwH7R4xeA9n/TDbXNKd:KmifPWRcfb9s
TLSH
T1B2B5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 75196012bb2af9e20b3ca1e02e36a82da71ba432a53daa43c58b6d3631abe1ac
MD5 8012ed9bd2250d1f837a982d691e2ee2
SHA1 00484bdd66b2763dd7809eac0656f69188c70d86
SHA512 ebb729bb033f717f6f45f8690f89dd3e4330c3ccd19d5df5e8ea026a958b6e041d6b9db235711c7b1da0e2c12d8bfd3f1372388cea3bc93dea12c174d51df84f
SSDEEP 49152:bSuZQIY0Be2KcRVtOnks6NMHqdA9n/TDbXNKd:J5dKii61ufb9s
TLSH
T170C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 56a7a7e30c91b2655d0828ad0617f7dfcd6e7ed92a42a8eb944b2b8fc01ff273
MD5 201423cc5ac0468acc93d9a68a1b47cf
SHA1 f5b7e2ba8e5ac4f3cf5670aba2bcd369a86db210
SHA512 16a2afb6eca43f8bc18342e2aa78ba9d83fd497d904e893a09999e334c58486525399a2edb14114d0c59813f55183c51934af50ea5049053c1b53dd764c58c26
SSDEEP 49152:JhtSn8EApI0fig3giDn0AP5wCA9n/TDbXNKd:4X2imphAfb9s
TLSH
T1FC95BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 df205cd67f3811822b9d2c9ff4199bab59346bda5dfc63cd4db75007cf99c462
MD5 06f4811a87cab94a18c6f2c57dc260a4
SHA1 614fb55299bd99889a994883d8b2857c0b87c658
SHA512 d40d417a10eab81e01946a0e3e80929331f7d7c92b7b942430278df30323f6187c00bf1e1bde7f4c5bbd3dc916c8d4bc6ad9554112a4d034f328a605ff6a9ef5
SSDEEP 12288:OVBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dS:OVUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1286523824FFC09F5C74A0AB581A57B0CCD92BD4FF686439E470D722A5B345C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 208cb900f2c7e7ef7ede86eaa8b0d0f3c23bc6c2206937800e10faa3738cdd42
MD5 c3cfefc3d81939a7743e9d24113d75a9
SHA1 421e4b3e0dc8c61fada1384d6a858ff85e10095b
SHA512 bc6b413c8fd07a5b89d57d5d3eca1066d8010f567fa2cbe0c8b535ecdf62dee60bbc9fcede1536f0533b2701b530dacada50f861a74aba33f5fd44d0e4549e94
SSDEEP 12288:0eBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dl:0eUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17E6523824FFC09F5C74A06B581A57B0CCD92BE4FF686439E471D712A5B346C6CA168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 1c87cacb12743dfb0a08584e734256f9346ad87e73a59c9f6a21ad4b11684785
MD5 0118ab74b812bb5b88cf1f918f6c8cfb
SHA1 ca27bd0d7253817efb71f783b6e68bbb89b5a102
SHA512 09e3fa4d50849575ca4df789f1f2f02fc4e0034ffee4345e5e9b2538b795eec1bb9764c52b83f5f564a87e9adaa5151444f53aea7ffd8d800d3ab78e46a2d63b
SSDEEP 12288:I0BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dj:I0UeA9n/TM4NZYeNm+9MhUwd
TLSH
T16D6523824FFC09F5C7490AB581A67B0CCDA2BD4FF685439E470E712A5B345C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 fb6d68e812120161f099e18c4f27e717eefda6ef659c5e24dead341de32fd56e
MD5 f767766d503a4baa8e6417ce63610404
SHA1 9d8416d92e826f4ee494f235c9f5a1768fc13e45
SHA512 90c9b491d46f5ecf584477487d47c23456d4bfe9f8160e47ad8ef4380a0572451ea442bb7d79b13616623a92b02a3e08346dbfdfac6e66bf9de48d3c77768454
SSDEEP 12288:EVbBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dU:IUeA9n/TM4NZYeNm+9MhUwd
TLSH
T19E6522821BFC04F1C74A5679C4A6A708DAB2BD8EF76683DF4705251A1F302C5DD35A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 7ad17f0a58bbfd345115f935dfb85dad545a5c06eaf3885f1df9541151450b98
MD5 988043e5d1874a4f4b88536de7dba74e
SHA1 a377a527d94adfa1521c84debebccc182c490d84
SHA512 f41c8972e91edbd5e948da43ad3b8a35c80b9811b142a4598c2dffafccc533218e2f25672fc2215e0ede6e0761dd2f4619089c331062e758ec2e40118e9ab806
SSDEEP 12288:1jBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d1:1jUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D36523824FFC09F5C74906B581A67B0CCD92BD4FF685439E470E712A5B345C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 69ba88af7ec3f063e9adde7664983a11e2a8978cdc63d30b514de299ec26332a
MD5 8fbd5708d397a92c3dbaea28d1972e1e
SHA1 306e14e2bb2149680a161db9144d5d42060bd4d8
SHA512 6ba4e0cd9362ce1b33e9c95706f6fb1b35ecd7af6a6e1e8027e286c8aa9a98b0e963845beba139562686b8cccc9b13e590c539078f1a038387ec257f3b62c970
SSDEEP 12288:liBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dA:liUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1EA6523824FFC09F5C74A06B585A57B0CCD92BE4FF686439E470D722A5B346C6CA168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 1ddf933664446423d5addafedf92d48c385eaa01e512b092e7dc7d0dcb39f21b
MD5 7b21e3b90617fbd22e1b8f02abd44482
SHA1 c61a4af1a8fd3956be5e05221fdc54c1e671353a
SHA512 8663c67e4468f6418534608401a5fb0699a1c9b2578a5734988da8e4f65261a30582127de4f316a46882a1de70dab9850fa866a39d855f89662c295fe48ac90b
SSDEEP 12288:lGBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dO:lGUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1976523824FFC09F5C74A06B581A57B0CCD92BE4FF685839E470D712A6B345D6CA168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 cbb7bca3640013d050e07a3df932bc1e47bf98008fe6f4b57d6466c6f842a30f
MD5 df0517bfefe36ce4971222113e87ebc9
SHA1 4b66af56cb7c6d52e80120829bcb6fbaba1d56ce
SHA512 7344980122aeb8ecbabe5f5df560b64ef693f5f004f28540fb9eae3df56f08b066744810deb0d5e5b7d45b83753bfc11335bd3e1161dfe16677680f9155891d3
SSDEEP 24576:/ZMrzFVSO+UeA9n/TM4NZYeNm+9MhUwd:/ZMrzfMA9n/TDbXNKd
TLSH
T109850295B3A00CF4DD67423EC8659A05D6B2BC1A5760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 85f75b005fe52f9ec1e26de8ab2db68356eb49aa13215dafd47208f6625e60b5
MD5 0fd6abb4b33949e8f1045dbc2dc5e5a2
SHA1 fa76b91bf6b8ea9c6f90bde4aeb91fd9d5af273f
SHA512 99a106719bfd5f5efad93aea678a4ab35bcf4ae5ff61ba4d960a3bdbfcc82e8b52404893db6c9c6d7099a1dc722f8290d48facc3a0835c20cecec78befefeb6d
SSDEEP 12288:YBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dk:YBUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1026523824FFC09F5C74A06B581A57B0CCD92BD4FF686439E471E722A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ff88f51716dd4168e777f8bff7d0889a6c6217fc958bfc93d27bdce4b13bc10b
MD5 119d76af582a2a0835ab969856ca1678
SHA1 df3f27a0cdc153dd35fbd737ad4618102f9c1dc6
SHA512 bcbd764de543cdefcc83d42150cda37b49f5ffcee90aaf10ea0df266e7138c025639d96f82aafca11e1acef367ff12e8643789710f93d0f655bec1b7ea4fe80e
SSDEEP 12288:ONBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d/:ONUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1676523824FFC09F5C74A06B581A57B0CCD91BE4FF686439E471D722A6B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2e7b66f08eda89a70887fcc70432413854b324e53e2a3952e8a3000f8e8a2e4e
MD5 bba33ef8ad26de778b2d4007bf8897f6
SHA1 b4b646fb84285aee40ccd3053620188b83b97911
SHA512 b06212c0801a8d8f197b6b2bad16469e10051b9caf70aedcdee4c0b6267f451c19cc6fb3b631a81b143e6e694853cd13ef15465d738c5b76e0a25fb29066e43a
SSDEEP 12288:YyPz5L8aBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dz:5zyaUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CF75024767B420F9C2664239C8A21B05F772BC3A57208BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 85a11cc3ddc3beae068203e0e1601e686d43e20d280574660b5df119f0664ba6
MD5 7a7b339053dc42209e2482a58f5ec60d
SHA1 276d9657d9a5420f87b47dbdb728fd9577138551
SHA512 34cf8e936f154a2cdcd8c8a9f02639e8547c5c3ec10f66c69365da4ccdc8074c202b71f7895bd1338291c7acdf455be8306eb006e2e5599b75982a203977ec61
SSDEEP 12288:hBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dz:hBUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E06523824FFC09F5C74A06B581A67B0CCD92BD4FF686439E471E722A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 7c9bda8ed0f4a58f141c78e348d13b8d00aaa9e71a9f698518cd9d075e22efda
MD5 b6f45bca5ff1ef118246fc43fe61c901
SHA1 5f57dd2ccb8705153812d7b3d0928a02ce67c11d
SHA512 f18714a25e08c56b5078b97447913bc51bfc7d51ce20cca12b295f346622f72ed6846b9ca54752c383205ff736674d76f583bc648f832251d6cf415978f45623
SSDEEP 24576:pjwv6k9RX6wkyAI9UeA9n/TM4NZYeNm+9MhUwd2PzGztMU3kzbeODph8WkANKEw6:VMnYI5A9n/TDbXNKd20t8zbL6AIxi37J
TLSH
T13DD5F129EBDC48E1E1B7927899B3460BF2B178585B7182CF025A536D0E33EE45E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 2e93c7d9f1a7b9fe83870946f46816cb60a7b5ee1d4254bde0b46e26ca4cd203
MD5 8f0cdae91bd2df86aa62d30ec24fb94e
SHA1 7a78e65d166a18366ddd32e6b254739323c782d6
SHA512 3b1d0cf6b99c0dbc4a82455d73ec8e20c803522a40e6496308e4db79d06aca880243df1bdc2ab4705586ba5fc3597eb015612b7dbd306e5fa0d81a0c0103fcfa
SSDEEP 49152:cYw+Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iA9n/TDbXNKde:hySzPLfb9sU0tUaAIxsJ
TLSH
T1A7269E56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 e74c78e80b24b8eeaba85a19c9d9ba16f64e9182ac4ce51aec523ab156482b8d
MD5 583fa364bddb89e806ae3f5af948c01b
SHA1 8ad3aeefbb477e2ff8c890367f56ec9745f87ff8
SHA512 18536ddc35ca86341cc9524137433ca648cbea6687fcb4d02956b9566189c64e946aac3fd4a6fcb6fb0cdd9af4f5c4ab571234a776af8293367a114f97147424
SSDEEP 49152:1o7JUQjdirIhCnDHUPfF/SA9n/TDbXNKdq0t8zbL6AIxi37J:WJnglD0PFfb9sq0tUaAIxsJ
TLSH
T116B5E01DA3EC01E5E1BA927885155A1BEA71782D1F318ACF1270837D6F63ED48F36B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.3MB
SHA256 0872065e469e9ca59048ddb6aeec706823aed0c4ea56819978bfcb1f1fe0a1a7
MD5 3a4262991555cfd3e4dc02eea68e536c
SHA1 97bb44d745a05cb77d633b29fb6771052b7b4db3
SHA512 6a610e2359fd981743a3e6cb453a677e4cfa553101ca36f5aacfa7efd54ed24b2397fff41e5b97eb75ae444b5bca540e02293a61fb2427934b0749012520f921
SSDEEP 24576:eRUeA9n/TM4NZYeNm+9MhUwdT/3aOCcyIXBBZyGmYUKFDZAa08+:8A9n/TDbXNKdT/aOzB7yGmTK3Aa08+
TLSH
T1A9B51246D39801F1C25F6235C78A5A00F723BC5AA7E1939B12C0F23E2F355A59EE6B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 d3802f2fe2d56474d4194890b6c7d69b188ade79e8d7f8ef09f0017e80653f86
MD5 ce9cae8b2cc1dad6a721318d2e6808f3
SHA1 aa853695ac47a886e01ff842ef2eb4f01b076847
SHA512 b34296279490205a56423126a30be040184683d3ea18c03c778de910d2cef7ac9212eab64dc2bf6119b6d65c1dda0ab00bf796ae6cf3f52d77dff6fc4b8e5f22
SSDEEP 6144:ZsBC2naFI+bJOoIfKDeoHTB6I8Bq8aGIiPVn7gACYxnhxaprxZ7dspHPF0TgouwO:ucH+TBq8Z0ACYthq7dspvFWg2g
TLSH
T1DB4527007666DB4FC6A940325E33C2CCAB707D41EE456F0373C99B3F9576658BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 8ba7c8adea748512a0b7c16d9e1d65e1224d6c14f4dcff77edd0d54846c8ce7b
MD5 adaa8afd9bd7adc6ea72f172a7ab4327
SHA1 afbb80b12f43bdbcc3d5ec436668542d0c039d59
SHA512 768d2997e8a33a47f67defce3f73fa85f70bae664c6c59353feec70feb338ea952b94b647a1fe46c2d0c3782cda665303671b64c476ac713e9cb99ad22c33dcd
SSDEEP 12288:pHhpBIKBX2asVaTNGBoN6+9rWpyqhcyS+p:pHhjfeS6sgVyyS+p
TLSH
T1A975F9419536A78FC1BA2072073A5B4CAB64EC06B7495F27B3C9093AD87B745B0F97C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 8412cfbfe40790d47a13f8f5b1925ebc704f3fafcecc771063b75343453283ce
MD5 916e6946a637d8319c86ab17ad6653d5
SHA1 679cd51783294c233c211fcd417b2acc73f71bf7
SHA512 bfcbc78d8d6031c41532391dacfd308766e77b73ed82492c0e9752a177dc264255c26ed711226fdcca65347a5e5ca42b98754fb5f2a5d9f8ddc766a3d01f371e
SSDEEP 12288:++7ZBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2djd:dZUeA9n/TM4NZYeNm+9MhUwdh
TLSH
T12A6523824BFC0CF5C75E167440AAB7089E56FD5EEB4083DB8609722A6E345C6CE3694F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 be9bfcfb4b34f21782cfce11f07696aa76ceab61a41a7885dd28012c71e356ce
MD5 3905f137df26026bd68394f1efc3c873
SHA1 707f75d792dfaf93c77151e0c4e28d0e3177b5a8
SHA512 50468c5ad4ae8fe8dfb5c3e83feb281081ee10c57a1f7b816d57ca1fb9bac352b2d7a62c177a9a526202ce09d50ff0de8c2c85a7db9ed13465c28918f7c923e5
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYfUeA9n/TM4NZYeNm+9MhUwd:Qgb4mBIBhGFYA9n/TDbXNKd
TLSH
T11165AE1E22EC02F5E1F9D2B8CDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 02fe1d0c898cbf304c0513afcbb92ffff130a3e2eb9264be7fdffa0b6cc38ae5
MD5 5f9ad25c0afdf871cb9cda2f5795f820
SHA1 f61ccf6af8b9fcbc598c779c40a83a9a6129738d
SHA512 fae99fde4612eae87a13881b43d70ffac6651453b8bbb2dec11dd04d072ce5659a9853eed4ba8b579436f0e8defe48f3e46c9c148d73939e87087b70744a73d3
SSDEEP 24576:LG/PzGztMU3kzbeODph8WkANKEwHC3IqGyIEFJ:LG/0t8zbL6AIxi37J
TLSH
T12A05226C70F5A8A5FC71A2F4A433705331F0BA6497D511EF0986A0BC5FE25F12A3AE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 5044d0efe3ffc167ba9a1e3f07cec0ef5e6282118fd796616dd6ba5c357fa929
MD5 4dfc75c44ae4f09a431183efe20f7fb5
SHA1 cd6dd8cd9755621c9cf85a27a2820fb885daa10a
SHA512 517ab05165b1fe5a3ccc9f08953732d3101418e9d58dc5069c9c9631c4c630064a817a88ddd636abef53f70b0c94e0819305b1f3a8eb03e6c7b3f9b2b928a43e
SSDEEP 24576:4G88u8FpJqH19zria7/m+UeA9n/TM4NZYeNm+9MhUwd:77ZFPqVka7/7A9n/TDbXNKd
TLSH
T10995016567E401F0C47BD13889864663F6B2B8251364EBDF07AC8B561F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 b0f6eafd3a4993b9c07390087ff3435432c9abc65a9fcdcef028f3d96ddb23d9
MD5 b5aba4cf6e9be061f643c88af70aa6be
SHA1 98ef689d5ea0daa80ad2cea22fd667135be2c090
SHA512 a665dda4d48b2b2549ad3355d0d6bb0302aeb6934b35a72b77654bf9984545a2e55e7fbf9bb654d897455edd91d2b7419e3c6dfbf03446a833b77f0868633f11
SSDEEP 12288:vHvUrBFrEjwaQSBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dK:vPUr+NQSUeA9n/TM4NZYeNm+9MhUwd
TLSH
T12985E11F26EC08E5E67AA17D8586870DE772B8561312D2CF0290817E4F37ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 92ef8e6faf19d4737868e27155ef6d0cd2395fc4187ef10008524d1486a99e93
MD5 7ecf4d6a79744a939057a970d2f0c500
SHA1 637910deb1e01302325a07a947e0d0c61569eb76
SHA512 a1b5b4f385f6aa76f561faba7192521663aea4acd5ced62ecd06cff8977e11e467a2430eec651ad611a6fe0f705144f0cfd25a656ac57e5d7e9820dd7debef98
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcA9n/TDbXNKd:uG05lO43bqfb9s
TLSH
T1E9D5C06A62EC01F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f27b2f2b4991b8513682f5f1468ca43dfeee09c5d6286a2df86f01e3e2bfef92
MD5 5f3f7b983fe6a71cd5aa3b7dcfaa46f0
SHA1 031e5aedae80981d82f1af7e21363c85d983e581
SHA512 0d4bf232b24cc59b2d835e01821ac0ae50d5280ee5ec5d0be3adb8b90cd9b85d91028719d74b905784ace60f61b4a57ce716e368942b087fb4042705797b15cd
SSDEEP 24576:pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidngUeA9n/TM4NZYeNm+9MhUwd:5a5POZ3BJt2pasx2+m0A9n/TDbXNKd
TLSH
T13365AF5EA7FC01D5D5B9D17DC583460AE5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1d59ff3a2601e60ea23594fddaf5ec563488fcf0a79ab5080920ff74ba3c9791
MD5 8f8c42c0acdadaadfac833fd87fe42be
SHA1 88f47b54e3dcb0db5e7cce7b9160835ce158e6ad
SHA512 29895eab43011a697a4998785ef4d5171e38fe1aac4a36fb98382b37dd0e400e06d1cc5073e3ae037a1ece32680f110e2e029b8ef803eab76e295cdca7ba702e
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkWUeA9n/TM4NZYeNm+9MhUwd:RNc/zEOVHFbA9n/TDbXNKd
TLSH
T183858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 7d2ab81ae132b902c1932242eb8833751d8b1b5addcd717343b4f2f4cf36dac3
MD5 c79a22e21072462af4110386932abbf0
SHA1 540578a62e123396706f27e3e2ae069d8d455a9b
SHA512 0e0330fc721333b561ab9770e6c6df4b88da4e994dcd3ce510f5be803177ff9fba40285302a4183af205aaa821b006c48f1c1211154a58b626252109dcfccd26
SSDEEP 24576:66DImPzGztMU3kzbeODph8WkANKEwHC3IqGyIEFJ:66DIm0t8zbL6AIxi37J
TLSH
T1B325015C72FA10B6F0A7E07995931103E2F1B570879215DF0A94C4BD5FE3EE8B93AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 a74832112ecfa6292b7227769a5fb61d1e74e28b1804e46cefc477faa864b280
MD5 57d31d9e54e997a7ecb4a02ed01f8707
SHA1 fd61c1923f63b82dc87f453581ae503094579410
SHA512 86464d6280bc3259dd2e68725470fcaff42f1cbca9f2aa9def9bf025c3f7b12b6d505388df25de17fc3521ace9071304ffd8cfa76c67be03b236535356816ab2
SSDEEP 24576:KtylPzGztMU3kzbeODph8WkANKEwHC3IqGyIEFJ:Ktu0t8zbL6AIxi37J
TLSH
T120152348B2E494D1F9B452F4A933619316F4FC209BD102DF1A81E22E2FF27E56D32B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 171df529895893dd8ce2547de5f61de57110606ea61858ac55019aafaf9ed452
MD5 bdb70b082147b1365d7d4c0362faed3e
SHA1 d00192508ebc73a080a523f716c1de860449677b
SHA512 e47b1a998cc043c7a81cb39a49bd102c46bcbf63eba2648c0f643daa113fdfe405ce0a98fac5e68c55610ee75243ef8cf09871f7c03ce7ce5821a9f1d714880e
SSDEEP 24576:JdPzGztMU3kzbeODph8WkANKEwHC3IqGyIEFJ:Jd0t8zbL6AIxi37J
TLSH
T1700523ACB0F498A2FC60B2F06437714322F4BA6497D601DB1D8690AC5BD25F61E77F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 8d2353304a7e33c6ff4e24b30cfbeeb15cd8aadfcf840282f95300b2c0cc9353
MD5 e93c4aad67260b5e6e6d2105be188335
SHA1 f75e57d33a91f21718548eb5683f3dceff384b86
SHA512 a759e68d990c37eaa5ea82c7d2c6b7a3be05442055538f8850ac1fad5308bdcbbb499d523486bfe364714d540a411de617db2b3256709dea3023edcdf4045c1b
SSDEEP 24576:isgILoTfaidZ2PzGztMU3kzbeODph8WkANKEwHC3IqGyIEFJ:jgHTrZ20t8zbL6AIxi37J
TLSH
T128659D1DA3EA05DAE2B2D275D8731493D633B431577286CF2448C03A4DABED8AE75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 024ae406981c1f373465f5c499f12b9afbe31ee8ca8e3f1cbdb5bb20e8d5c04f
MD5 ec3730f9d225b8c3fcbcc63ca5f176aa
SHA1 24dad6c72dc03638f8df88811d58f616dd82834e
SHA512 b97d7dae14e01ae66a82eae80ce9f0ee8ecd44cab1d72920245453690d42a11bf60717d9ce91dc587e21041cd697bc524c8be9317e13e1d56152e22d9ee18114
SSDEEP 49152:zgb4mBIBhGFYA9n/TDbXNKd10t8zbL6AIxi37J:ztAfb9s10tUaAIxsJ
TLSH
T1B4A5D01E22EC01F5E0F5E2B8DDAA4417D6B278165731D2DF0251422D2F3BEE89D3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 6d3793c2b3f705b1decf42b6e825455686d6228e232a1d87b095ecef83f86c8a
MD5 8725ed49aea248e4eea952de361f18f0
SHA1 9c00d821ad74919275a4312743bc2b5dcff0f84b
SHA512 2fe82ff838d54ac5fb79519d6191b13bf1e806fc7c90e17cda151cd69ce52512ccc435fd53c5dd388147727e8ce58bea09585bba42b6ef95ef95a7b1bd23a685
SSDEEP 49152:BAMwBtOmuA9n/TDbXNKdS0t8zbL6AIxi37J:GF/fb9sS0tUaAIxsJ
TLSH
T105A5D06EB6F845E4E1FAC6B4CD238513E6727861173253CB4290C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 ef4bf6a4cb7b0e9ed52803566cfa67a9453e46acc2cba2e0f8c8604b0dc21a8f
MD5 335e4a8dac844fbdffc85c168493abb9
SHA1 e61ce17156e8efd6e846a9966ebacb79338c3c18
SHA512 0120b13239da265d3a3542ac69b0a9d5a301dba109f72557fe01c6cac2932e3f610b99c61f07b901039f620e1fe92dcf23688b682369350e11bd560dbdf4e489
SSDEEP 49152:HDVHeBIAAxA9n/TDbXNKdO0t8zbL6AIxi37J:Ufb9sO0tUaAIxsJ
TLSH
T1EBC5127DE6EC04E4E57AD2BCD5639607E3B178AC036216CB029491B91F67EE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 4b1c93b4021258fab26cb0d08675c6784ca4b400eeef829d0a3e4d2569e4b8cf
MD5 d2bdeca04fca67f20ee34d9e02c384d3
SHA1 0d6fa4eae3f62f2c743f2e541d2a6d8abb7249f9
SHA512 d1336755f47c1c9383a7c4fee209ebc31bc6265910079de966c100a1a7114dbcf28bdd5dd7329575eee36fd6c1a461c30cf354cefc07d735676668bd319cad58
SSDEEP 24576:5JnJPbzB4SNPzGztMU3kzbeODph8WkANKEwHC3IqGyIEFJ:5JnJv6SN0t8zbL6AIxi37J
TLSH
T10835E13CD2E810E5F4B7D2B4811A2657BF71386C2B2669C719B4D4343F52EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 d121e08a16d7cf6cd81a4932293c9ec66e24b4ae6008b577bec5ce22876774d9
MD5 51ca5f1c949d4dcfd8ba7407be7f763e
SHA1 7ac81e6dfb97bc457ffcc9a34b6adf1414763be1
SHA512 d3a0fb3c079e4f19d58e5c7f5d588530e82744cfdda58c72fdfd5faaedbe8d18eacc02d563d9d9fa6481c918dd4a873d1a810b265bb3a3c4c3a04f157fe54a9d
SSDEEP 24576:xXPzGztMU3kzbeODph8WkANKEwHC3IqGyIEFJ:xX0t8zbL6AIxi37J
TLSH
T1660523ACB0F488A2FCA072F0B437714722E4FA54D7DA11C75D4AA08D1BD25F61E77A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 5b8c3c290f2d05429fbf130eb14feefd6478de36a136e66e4f4cf3e5fff5ee3c
MD5 6f43889de1fafec95a35659bb3c7b161
SHA1 c8cf4bc855458778774df4a5b54d621cb219e2e8
SHA512 70b112b26ebacfdaf2fe86de53d1c615315aa29afac6c5dc91be38934a4f48565b0885039487177edac77a1989b5e7dbf4ab79374d82b4b7cf66ebffa6cf0907
SSDEEP 24576:d6Uqjp3PzGztMU3kzbeODph8WkANKEwHC3IqGyIEFJ:d6UW0t8zbL6AIxi37J
TLSH
T1DA15125C61E458E5F87452B0E833A12711F4BC3057E611EF2AC8917E4FB2AE59A3BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 7860ef56b1564782d1bf815a45e450d27cfb1ebea12946b8dc57186bf76b2aa6
MD5 ec29d404df0618e8706fafcb9968b7f9
SHA1 b5b0e7f09f1a2626eeba3c8e023fdbb91a3610df
SHA512 3cc43f29f354f0cd2018ce41f893e4aac6cda47db70c55d009227265b1734bc7f2caf5e523a2eaa5de1ff73a34fba622148637e548154c8b8c0a6c72ac41564e
SSDEEP 49152:jCLHGeeV5ijCmlDWDkC0t8zbL6AIxi37J:+c0tUaAIxsJ
TLSH
T170A57C05A7EB4184F8F3CAF4CA2694169A327C549B34F7EF4E80C96A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 c248c04bd17938f70d82c49a819cbac9a55193656ababab8fd8fe00b41f32adc
MD5 19e4a827d4094bb6a671bb69ffc321cc
SHA1 7701dc2a5a4f240031344cabd33dca84d7c41143
SHA512 a99b355841ad8863f91d93468d17c1508a1d31df32f230d8b1ec876afec4fb8b78c91a878f2c070862f37c868d81e7693d165049556a571b8c642b52fb6d3c7f
SSDEEP 24576:VrcmRYPzGztMU3kzbeODph8WkANKEwHC3IqGyIEFJ:BcmRY0t8zbL6AIxi37J
TLSH
T16325015EB2EA00A6F4B792BC88425147F2B2B430539213CF0691C77D4FA79E97E39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 27182e593aa9bf898102cbcefa359e625519d649bf113b449b1a97265ed84185
MD5 cf8c9e8cbf7c403fc9dccfc548316b59
SHA1 b8834e95735938493d6820387448cd4569a1d172
SHA512 09b4e69ca82e5e7aa503ecba8a740cb91c479753fbab2fcf9b46cfdb5762095a3c278073798ff96309a1c1db170a535b5e4b98faa8a4d0c9629a88819643aad1
SSDEEP 49152:RDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3/0t8zbL6AIxi37J:i3Upow8sBO0tUaAIxsJ
TLSH
T157B59D3DA2E800A8D9AAC379C54223A6EA71782D3F3015DB0174C578BF1BDF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2748-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2748-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2748-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2748-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2828-448-0x000001C8C69E0000-0x000001C8C6B63000-memory.dmp

Download

memory/2828-550-0x000001C8C69E0000-0x000001C8C6B63000-memory.dmp

Download

memory/3348-238-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3348-101-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/3348-100-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3348-106-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/3916-177-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3916-179-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3916-335-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3916-184-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4248-208-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4248-77-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4248-71-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4248-67-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4636-157-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/4636-155-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4636-309-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4636-150-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/4984-89-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4984-219-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4984-81-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4984-84-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5372-64-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5372-62-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/5372-51-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5372-53-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/5372-59-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/5864-136-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5864-291-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5864-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5864-131-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5864-126-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5864-302-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5872-479-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5872-6-0x0000000000CE0000-0x0000000000D47000-memory.dmp

Download

memory/5872-1-0x0000000000CE0000-0x0000000000D47000-memory.dmp

Download

memory/5872-94-0x0000000004070000-0x00000000040D7000-memory.dmp

Download

memory/5872-96-0x0000000004070000-0x00000000040D7000-memory.dmp

Download

memory/5872-11-0x0000000002F80000-0x0000000003005000-memory.dmp

Download

memory/5872-16-0x0000000002F80000-0x0000000003005000-memory.dmp

Download

memory/5872-15-0x0000000002CB0000-0x0000000002DF9000-memory.dmp

Download

memory/5872-0-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5872-7-0x0000000000CE0000-0x0000000000D47000-memory.dmp

Download

memory/5872-66-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5904-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5904-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5904-30-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5904-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5904-29-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5948-170-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5948-161-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5948-168-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5948-172-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5948-162-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/6132-110-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6132-117-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6132-111-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6132-255-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6132-372-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6132-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download