f743fd5d2739b88866e327e38b720e2b3bf0d6e72d6512279ef539b181790ff0

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
Size 9.7MB
Sample261018-2rb9rabw2v
SHA256 f743fd5d2739b88866e327e38b720e2b3bf0d6e72d6512279ef539b181790ff0
MD5 a0afd71ed966204617b4d4bd2412f32f
SHA1 255456e2d0f24c4d8a921294da2ab38a0d1b8964
SHA512 b7dfa1cdf487303de8f61d89f1c6f12a033c3571ee0b0994d92d1e30f16cd1a7dc7529eb119b727b850bffd47b79cbd6d89344e34e392e5e50dc3fd976a8e4fb
SSDEEP 196608:wk6vguX23N99IAP3VZthxaKkBw99BCKgdA3SMhhZZiyc4ooKoC51ANDVa4yBoGO8:wbo423T9H3GoAOOBB
TLSH
T143A6AE2A77E400F0D1736331891696AAE5F67D215B3086DF51903E792F339A28D3EB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4872	elevation_service.exe
1332	elevation_service.exe
2352	OSE.EXE
360	PerceptionSimulationService.exe
804	perfhost.exe
5408	SensorDataService.exe
1520	ssh-agent.exe
2028	AgentService.exe
3700	SearchIndexer.exe
3400	maintenanceservice.exe
3520	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\beecaf2ef1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	maintenanceservice.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SYSTEM32\LOGL2DI_COINST.DAT	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000093a7-489.dat	upx
behavioral2/files/0x0001000000009323-488.dat	upx
behavioral2/files/0x000100000000994d-490.dat	upx
behavioral2/files/0x0001000000009cfa-493.dat	upx
behavioral2/files/0x000100000000ba3b-497.dat	upx
behavioral2/files/0x0001000000009352-500.dat	upx
behavioral2/files/0x000100000000a1d0-499.dat	upx
behavioral2/files/0x000100000000a0c9-498.dat	upx
behavioral2/files/0x0001000000006211-496.dat	upx
behavioral2/files/0x0001000000009b8e-495.dat	upx
behavioral2/files/0x0001000000009fd0-494.dat	upx
behavioral2/files/0x0001000000009cd2-492.dat	upx
behavioral2/files/0x000100000001b9a6-491.dat	upx
behavioral2/memory/3400-589-0x0000000140000000-0x0000000140192000-memory.dmp	upx
behavioral2/memory/3400-604-0x0000000140000000-0x0000000140192000-memory.dmp	upx
behavioral2/memory/3520-605-0x0000000140000000-0x0000000140388000-memory.dmp	upx
behavioral2/memory/3520-627-0x0000000140000000-0x0000000140388000-memory.dmp	upx
behavioral2/memory/3520-640-0x0000000140000000-0x0000000140388000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	ReFsDedupSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	ReFsDedupSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	ReFsDedupSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	ReFsDedupSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	ReFsDedupSvc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	ReFsDedupSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	ReFsDedupSvc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	ReFsDedupSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	ReFsDedupSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	ReFsDedupSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	ReFsDedupSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	ReFsDedupSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\java.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ReFsDedupSvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 40 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5084be3525fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042337e23535fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005feea024535fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d527323535fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acb5fce2525fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef403ae4525fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002eee8e23535fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070dccbe2525fdd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2928	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
2928	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
2928	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
2928	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2928	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
Token: SeLoadDriverPrivilege	2928	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	2028	AgentService.exe
Token: 33	3700	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3700	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3700	SearchIndexer.exe
Token: SeDebugPrivilege	4872	elevation_service.exe
Token: SeBackupPrivilege	3520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3520	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1332	elevation_service.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2928	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
2928	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
2928	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
2928	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
2928	2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 720	3700	SearchIndexer.exe	99
PID 3700 wrote to memory of 5024	3700	SearchIndexer.exe	100
PID 3700 wrote to memory of 5448	3700	SearchIndexer.exe	102
PID 3700 wrote to memory of 892	3700	SearchIndexer.exe	103
PID 3700 wrote to memory of 4412	3700	SearchIndexer.exe	108
PID 3700 wrote to memory of 6076	3700	SearchIndexer.exe	109
PID 3700 wrote to memory of 4256	3700	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:360

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:804

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5408

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1520

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5024
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:3400

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d9262cf79129c5694046407ac964b9ce0c21ab4fb319df4056047c6f10397aed
MD5 ab922306f2c8b022af215eb0ef6214c4
SHA1 3a78065b4b3dfacc1556104af0cfdb1c937f2802
SHA512 8fd53356eb05ddd6650623ca377ce5eae77079b90cdd763d3a0428b5dd9122392d7f25e07c7a21e417ff0b2dba24260a0b904f9c652487b2e712c8a0c5978b5e
SSDEEP 49152:Lb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn3Dmg27RnWGj:Z3q6sjBsD527BWG
TLSH
T1CCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1017KB
SHA256 4bb623e5ef55f508aba9e8360b795385b36ce6083293b515937e3263e01ce77d
MD5 50858d69aa48e660a2d59801f71bbf5d
SHA1 093ce8d950960ac314c53c3f55e7043e13832ace
SHA512 5f01dee5954827ba5684dfecf3eca99c986779f7a630ed8ab478996df52bbaed8ba285bf741e193ecdfe1d5a86e0c0d31bef97d0a774974411cc13f67fcb3a35
SSDEEP 24576:bXYs8KczA+oFaoMBO7wUlDCPIEwfOJxVgt74l6:cKcSFD8Pdbfe4
TLSH
T1CD251229A7D004F9ED67827DC8A1C915DA733C568364E78B03A48A790F137D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 fbfd18f0f931559ae5074892e99c07ca1293fc3e83902fe95e2a6d72c58fc04b
MD5 d4d31acfa05c91ce59c92cb952ce7e3b
SHA1 93e85e9e2565da1b12c8cf31e9434c90d8363031
SHA512 a359d074286afdc788271e8321deb898c7cc751674398df9350da61e9228afcf60f9a89eff07f9216cc116a980f62567631ecd95456458f94aa49bc6b686b023
SSDEEP 24576:S0Le5ji0hmxxrMbsqjnhMgeiCl7G0nehbGZpbD:SPji0Aj2Dmg27RnWGj
TLSH
T161859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d67631169e943bdb4cba3d9a4722180afa39f97d008605926997fae891636e5a
MD5 45665dd48f50607abaa000980b08162b
SHA1 a3a97649cc8524db7ebb148e0184747fa5a24781
SHA512 ac9fa209f539b10f3c92adc56a734cbf56f4608a74e75e0b5df6d3c3652d0509d79b45391d795b01f0ec9bbb56952497ac02a99c6fe8d26cfcdcf1f02fb420c6
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWn6q8wyuFsqjnhMgeiCl7G0nehbGZpbD:F/ezSC6vUzPveHjySDmg27RnWGj
TLSH
T169755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 872d0c2e1e434b8f79092d746382ba05e933ce420c435e9359937f2c3f3f1c03
MD5 5f36415b560c1f5e5a2a217f4e731a77
SHA1 fda1e61ab2394632c4ea811eaff7bd787cf11e28
SHA512 e42b593dbf660fe8ba4b87e45edb91f7a57ae9025a732c6d06568a98fba33ab3f6b8b6d8decbbac61cb79626f1c88a3bba8cd5e5540af47553d078e56e6baffb
SSDEEP 24576:3VbqPb88hv/l+YAsqjnhMgeiCl7G0nehbGZpbD:3VO88hXl+hDmg27RnWGj
TLSH
T1DC559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3a306c37c2a19186482aeaf4c32f43a4e6d59fd0862d8dd15292e22dded2abcd
MD5 35e4a000b7a7881293af23d85cac4830
SHA1 df548fc8aae91d5e38a7b0af878b98925068b3cd
SHA512 5af57803a804b18518aa3241151f302d597945e78c5c5cf96e9d2572f01b2ed30dce3fec02d8b66eac34c635324a980bb066798f301af59cf40b932f4701688a
SSDEEP 12288:WLfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WLfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BE824C11CAEA7708B5C3E9F55DAC177E5698200C436AA37DFDE6B5464CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ef5dc5ada888c7f9de8df49db94f945be325d30d3447ce1769a984f32626374f
MD5 33667eca44d3592a5c83e3be761dad66
SHA1 8811edf7cfc9af729033b66ae385df2f0ee7f281
SHA512 371d1982fbb4efd3e77930239dfb3f5d23c88f00cc9c0efa45c0eed8bc953124271ae7a2cbc8ab05a54dcb6712e4fb0dd53cd5ae3ccf3fd2eef48bbde0788dc0
SSDEEP 12288:DeBNUbTVO86UIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:DJIUIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15565CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ef34cdee6d757f62280f35a89d86c2229eb5fb3395ef0708fb5b58f619e14293
MD5 98a33dcd19b2a7cc70afeb9bf84bee7c
SHA1 f02cf679b3adf66e314b61153b2445fb48543a21
SHA512 073b7cfcd188e1d6b71dbcf219387c62f1fa88d4f2ef2c51df34afe7f42797bb5c08f96b6a2717b4e2df34aafe9db12e4728602a7782f59575fa8d6bf7f8704d
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THn:mQvGAdlCEL8c/DRNw5CJD527BWG
TLSH
T1DC266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 7ee516208d5526cb18a9c4db06ffe1b50ef67b07675628ef2535305dadc92929
MD5 20c3de97fe7d4e9b1082854970135a90
SHA1 40990511393ffd5e4df331ead1f8ad5cd2832d28
SHA512 e225adc7149f89fd0dfbe8bfdf5f10c3818047964135faac24724f96b4accd98794ac7c36c9f097c96b565fa7b1f13dc499523f01412fc17e003b7a114a5d529
SSDEEP 12288:1AwSfxL/2Dc3RDLLmt0LDQewsAjCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:W0ewsAjCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14875E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2324357405dd46a9e01607eda898ffdbb4ccdc73fe002219faa3512ccdbeae54
MD5 c56ac7cd050bf0dd44bf9aa201825c2d
SHA1 41b6749e22dff973b76283d4f8d808975b3b7733
SHA512 ca8ab13c2ee814ac1eebdcb3a74b0681d31dad4e8fa34a471dcc21cba2396bcdc46981e7c2987d675ae1b3bef8fcd4076ee4cf7e24a42a5eaf6f6e3055095aaa
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHOVQBWG:yUEtQevvqc2W1cpV2tI32BB
TLSH
T16A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b3e7bd2e7be49e4c5db203a949c1f49e72c57b1358246e115a447782e482e5b8
MD5 21f1375c87ed520573b0af9bdee206d7
SHA1 3ce388deee62bc426111c07326657742f2386939
SHA512 393cbdcb41bfe98aa284328992ec5778f2afb34a1f052e0c7a4fad071431d2f5a971f1deb144e7a94f552b7c0a23cf23cc1312a12cc7d8eab6261da36d9e2048
SSDEEP 49152:OCbRquA/m2yL5zTfFiV+XenmE3/zmDmg27RnWGj:joquVjnm1D527BWG
TLSH
T185D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 284c9fa7d7da788a1239d213b0d16c679d32b6ff5c87df722bfaa78496a48a06
MD5 55dc482a797c7d44fe6e97df1221efcf
SHA1 b01a0dc26dc1d2405916ba75c9251a53181cca1f
SHA512 ad47262e24b960c7b467cf9ec0b031d8a91f61dbba1731569705688fef53230435482086cb7ea0102029822726d1bfa8ce83bdf5d261919b3f55043ea475f4e8
SSDEEP 24576:MAhGL3IFoiwtA5l7S53BsqjnhMgeiCl7G0nehbGZpbD:MAMUFoiq5FDmg27RnWGj
TLSH
T1F5359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2e12c74efce8da6f82f02580357acb7fd6dbd8140b3deb0531321fadd54df3d6
MD5 40e2bc97c0aaa029b297aa12878b0d31
SHA1 795f52b4e3c7f82c38f03afa90e67610559be101
SHA512 6396d28b16ee45470e3f49947c08e9f93e5e9a76537d89e3a37377ea893a88f37bc44da5db198378191de0092c6a441d1f5387cc5e1a2a82d1f9b8197a3d1e5a
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+ClXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:/wu4OWesqjnhMgeiCl7G0nehbGZpbD
TLSH
T11965F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0f602df0a49fccd08d9aa713f68dfa9eb8cf945f15353eb8bc50b40b691b77c4
MD5 1b40cca8bec7c5e8edf255844c6d8199
SHA1 a7e8227c7549264da630839bd93b9c51c3f93314
SHA512 a4d4c1e898ce690951143124ce048009ef1c60361fad44cab7e4ea61b7139671ce8484b6363fc562c7ccaf39714135a2ddb4ee0c0c3a150e440aa330c8892d9d
SSDEEP 12288:SeZ1IySXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/ZuDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A25512AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 37f20416175c11a1eb579725ae0634d6b6bdc5191fe14a7b2352a00b464ee9d7
MD5 3ac27bb5331423e86191073302e536b6
SHA1 c7c718ffb59230bb11b033a9f04838318578ba52
SHA512 9f9bf40e8e4e5404b7848e6bd4865e9720eb0064393fd70fd46cc740f223656a21bb94715462a8282f0f102564e9fa1eab2686f7c360b39462140eb7503e1730
SSDEEP 98304:2QRQyi36YOcPbLvw2gAf+PN3wD527BWG:9QyiKa/X+PNgVQBWG
TLSH
T168667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b9e7169d3206bf7e3cde3b432a719e55d01986cd4361f28cd3e472bd4c2bb42c
MD5 be0b9c4200b02dd4b75d88ea3ad802a0
SHA1 fde53d65ce6ed35d0307fe44276d282f087348c3
SHA512 e7239b176cb08343d97c51fb01e6727e35513f3d0b96350617bf59d5215ba0226e44a1278f3f86608e34461bf36b25333a39cdb460adf8807055c1f488981fc5
SSDEEP 98304:EQRQyi36YOcPbLvw2gAf+PN3wD527BWG:LQyiKa/X+PNgVQBWG
TLSH
T184667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4059862fb12a5e7637c6664f43fe606d33d7376bfc1b9805b4e35a97e873d71c
MD5 02165e2233ec1590d15bb5503aeb3eb9
SHA1 ca1adcd022e828f094e029a0208325761e8b4130
SHA512 24909ee04868b915e767975a5d365f215d2ccdb3515674dc91ea79f92d6b094c92729c2533cd411ad98f45285ca0725504cbd9b9e52e83a3eb438afc231cee68
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0zsqjnhMgeiCl7Ge:i68Qg55nhceWu7PNU3/2Dmg27RnWGj
TLSH
T1DAB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ef86967a5a0e38f8f23ccf86257b9888fe45e4bedd93d36f07c355060593932a
MD5 f7a85784ab206a5fce2a1c0de4b3d6d4
SHA1 3df09958a7889577c11b15a3d2338733162cf1da
SHA512 769e4bd26e7aeccc661caa6b529d3d2d45f1357d51d1a883a272d860d74f3eb8681e55c1a61e485a1aceb944ba61ebe0c3680bc7d62691dde43384994076b265
SSDEEP 98304:ey5112gYy5azzVvt69nLKnhZDD527BWG:PLIHEWh9VQBWG
TLSH
T1C4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7d4f65ef308ad894abdfade46a11175f30b021f800270f75634d08e8b9ab2d3f
MD5 f8f3d190b638401ee566310f407fa9ac
SHA1 fa7eb373e82257d1b1b797b8e1f5da9f85465ab6
SHA512 c0e67e6a2b112f15fece49a6a647bcf0d2488c5af6f7e95a0d057eb8e06a4ab2046ce8a079c2ced32871f1d4b76e9cb1f7c9b3bdd48765a713868e5c83c4af3e
SSDEEP 49152:qB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gloDmg27RnWGj:4u6Jmdxd2doD527BWG
TLSH
T197D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 77df489cadcbf0db94791c483fd9fbb6530325357a300bb0321614edd73821aa
MD5 e867984b9cd5754b5e379cbb79441e7f
SHA1 9eee7d3f210ff1c560a3bee153d0fa96caddc976
SHA512 045f1ced244ee600dced05a1d5c78e937141116bf5c876ee82dca1d128d5246cb60f8286a3f2881008b3f226b57482b921f2566782a36a6cc12be183b07f16ab
SSDEEP 49152:s1hpsNoJpF1A63U44CwH7R4xUDmg27RnWGj:smifPWR1D527BWG
TLSH
T1BDB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4cbbbd91b7b4e8af3c3fe7c418e2ebcb6a3ef7740171ba7e39b1d3b327e5e2ba
MD5 f05f78bc47375293c02033f93c5eb89e
SHA1 2cce1f7dfeb63ec81d27bd593bc6d66b20d134ab
SHA512 f767058cf0ec5d2fe73d65814ff20a2077258609263eaf619ac88b11c9fbee39328bc3d02872f91d972651ad3013ff091f31fd67ede882ca8ccc4e1bcf0bfdfa
SSDEEP 49152:8SuZQIY0Be2KcRVtOnks6NMHqHDmg27RnWGj:+5dKii61HD527BWG
TLSH
T15BC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6550c644884886754f480435cb0487e5811cb2c697b9166381426557ffa036f3
MD5 eefc12ac110ad3f7e51e8a5d28b46754
SHA1 01f140e696e7b2a283463c61dfa581cff84a4440
SHA512 54227634fb9a9fd3fe7ea8d42318d0a29dd6d385b041aa48cf118edb11be341ca739dd70838135e95a3c9a2eb615c9021cbc5d3f40027d847c6a68e3b27dc899
SSDEEP 49152:qhtSn8EApI0fig3giDn0AP5w4Dmg27RnWGj:LX2imphxD527BWG
TLSH
T1C395BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1be53b86abc13c5b85473a1037254b63616bfdd301459581ed1a80cbd1bd24c9
MD5 f610871f2460bdaeec05d00749087248
SHA1 9291e03be5575668a637aa527be5df0c5b28472c
SHA512 cc80da1ed2c2ab4f4cf5e93935a40cffba55bf19b7e4a9967216a2c16c515d9d09c7990da7211825b8c43200975f437205f05e6ccfc2f853fa887977f02a2214
SSDEEP 12288:tHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C4523BE955C01CBE92248B5C3E5F14DAC173E67E92004837B9778BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 214a1a7aef68fde885d84359d2e0fcc521d20ceb5ff237a2b0248df91d260125
MD5 36a516bcaba1130b8e327cf92a4ff1c3
SHA1 9717c74fd9f0a9aca8f7d0f7edfe1b84a18da2be
SHA512 a714a5e004cea66671146f2605848cc989dd80fcb17baaa04bdec508f7836729b28b9b35a408a1d28431732419b62d510a1390b742fa39f0ae784136ed8e88a7
SSDEEP 12288:S2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:S2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C34523BE915C01CBE92248B5C3E5F15DAC173E67E92004837B97B8B9F7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3e9d5637682b5aa8b91a40bed5ff4ceb8ec72da0a3f44c58dc8d622f0cb24aab
MD5 cf3ee328c89301617269098bbc55def0
SHA1 5c414e9e33658c29ea0329ad797184cfc74fb241
SHA512 d84eb2ed4e770f52f5dd38e9027b4288040302f2c0c135c709a47109e2a81bd5771887ee471dc5af30b72b9c5f6770e6bd7346080f6c2ae6bc1aa392ffc1bad4
SSDEEP 12288:UwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1914523BE915C01CBE92648B5C3E5E15DAC173E57F9200483BA9778B9F7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d30cfd51157bcbf246d3271b12c390f9108c578a4670e882ebef64687a95d425
MD5 d94118bcb2838a8918934afcc15ef0bf
SHA1 cf9be2f5369f166f29c6a76ed65361add420a1c3
SHA512 5f5492f4ca438a17ddaa747c7a9df9784226c6cfcbf492ebd5bda3e6dd7e32f673a38d9d09b973efae660a455bda2127fdc008ffec91869ccc373649296eba38
SSDEEP 12288:CVhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:usqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C45236E535C01C6E83285B4C2E5E11DE8237D57E73015DB6B531CBEAFB26948F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5b77b0ea939db3d6c22ab890c04cb48107474b8cbe1b207e894dbfb07afeb63f
MD5 44c4d8d55e112705eb03774bc5863a8b
SHA1 80811c580ce3355f7728683f77783a02b68f4310
SHA512 eb4f0811850a32d4b2b1a0839cc14e2c63d4794d1457632d2db75e106f070a4a380122bb8a6e7756d547a6350bba9553e170e6897c3df74f1bd167586dea5d01
SSDEEP 12288:QZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1264523BE915C01CBE92648B5C3E5F15DAC173E57F9200483BA9B78B9F7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a4bf7c3d9b833667aa240979e088a58f1e1258798d291f8210b29a775bd474d7
MD5 a647af1920e5e11d01dfb078110eb3ec
SHA1 baaa2b02ed7626fca9e6a8ce2a96ee75e6b7d3fd
SHA512 d5b3461f87a93e8c132736feb72a1d2f7b1052d81181825e1ec45d345ae702bc1a0ecccf8952b12948b123c93bc5ea7cb826dda3df6f389efb8ed2c2faaf68e0
SSDEEP 12288:CKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1384523BE915C01CBE92648B5C3E5F15DAC173E67E92004837B97B8B9F7F24684B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 34ed9a7b1ba35e46d4c3cd09c4f0fdff2342bdafe4feaabb80bd03346e390a57
MD5 2a0c1a9c281c87bf498e083db2daf824
SHA1 67406d6194fd7ffd5baebd7bda17f2bc1f8e5dcb
SHA512 da4a30664a8d8c98fcc7cbdc72c01767027bd881a53e6ac14920d34907c761e8e846846284ecc2cbf35ff0ffdfd9dd5e4f51872d35627d7d88b425ee563874fd
SSDEEP 12288:zOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1294523BE955C01CBE92644B5C3E5F15DAC173E67E9200483BB97B8B9F7F24684B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9e2d25b9814a79908bb1ee89b8a08a5417078d6e179faa5125f2ec84f8376a51
MD5 3a31607b489dbb241ab7d1a1a742a40a
SHA1 b746d9e4ec85baf5ebebc3ff65b79c9b73370d90
SHA512 6380178af69ceef594210f1735b78592682df4da9bea8424002b93d3bd5e1f301d4129844f1b2c608eee5bf1f8efe9b4acd25f92ec873f0a7affe10dec4774ee
SSDEEP 24576:QZMRzFVSOWsqjnhMgeiCl7G0nehbGZpbD:QZMRzfuDmg27RnWGj
TLSH
T1FF6501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b452dc793f74f4ba4d67c7483c8c367b19d0e1d8dd3e8b97be1d051103765d47
MD5 45b5065506778a318450516ed9e0e6ed
SHA1 9b6e45e211d41c0b70e43612ab53a9cae5c7a9bb
SHA512 8a036ee472c40f34da8d245fdcf4fb2087f2d50f7c3142dcef102c7eb4658b94b0233ea5d4ffbc49cd08e0a9722e8f9fa9ff134081380e9089f9f2a98bdf0e44
SSDEEP 12288:qTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C14523BE915C01CAE92608B5C3E5E15DAC173E57F9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 82042aa7d00b12ff5da8f03d158226b9527a1f3baeeb397597b23f8f64f5a417
MD5 69e89cdef17b708d39b9c2074c1a9273
SHA1 754d6dee244e44c60b84868c57c23329b2f9987c
SHA512 62c74fdab116ba83ff945141a4f7f35e2ef335081e54f4ec19e0428d99773a41d6b83e7eb23c539649e25c25dcabfbd9529d437911d02c340cdef5fb907fcf77
SSDEEP 12288:rvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C4523BE915C01CBE92244B5C3E5E15DAC173E67F9200483BA5BB8B9F7F24684B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 26ffee8e1b567129d761ddb9451134c98da452680bee9bf8afcfcbbaf6d1500b
MD5 3c867228aa82fc0592598c2d4baf9196
SHA1 95fffcfc318764828ac95315f103e110cfd59ae1
SHA512 70010dd3d1af2640f09c8379c924aeb395ce376ad431606be410170f7aec0f1c4b24d8e1fa235db7a610168eb5f872c9bb32fd52b9d83dc9d359ba67530d995c
SSDEEP 12288:TyPz5L8SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ezySsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F255025B73A530F9D1378178C5A29A06F7337C3257204A9F17A506BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b247c9598b3acaddff70c6094f0842d549ac8df569aef8077252f1c064305805
MD5 0968a7e21a7d39ee4ba94c7ebbccc7a4
SHA1 72761d4ff5d6e389bc20ae1819ade9604b82c8eb
SHA512 1899711e4ab6f0a6f8d1bb32994d3c615cbc97c190b2b6bea45ba9bb43850c2c867ff57e974fe3a150278d8d9e6dfb87d86a92dea617affa08d386e7dfb9cd1f
SSDEEP 12288:mTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D4523BE915C11CBE92608B5C3E5E15DAC173E57F9200483BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 88ebd67bb9f45efa73ee307b21f17720b8c894aa92ccb1e3ed3506d7edffbf7e
MD5 7dbc7f7ef975e6970f6ec9dc5ebbe84e
SHA1 fe44687fe321f421ecd29b0013591616da09ec66
SHA512 08907f27febaf55716422f4b142204d96c5d5015b18a40423d712de9f15fd14ca58ae7913fe66dad62fe9755c52f796388de701e5be1f45225cb3b46b34ebeee
SSDEEP 12288:qTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1574523BE915C11CBE92608B5C3E5E15DAC173E57F9200483BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 818cfca09082fd1340ac9508cc8f5e714b04aec9daf33cf01cb538cc5f90a366
MD5 aac7f39f596e97a6b072baed0f93ea6a
SHA1 1b9ee63a9bee8d7fef96aadaa4aeed1ea11d7490
SHA512 003a7a4c84cf75a212daf3ce8d828a3ea46dd7a9d10db73ede1c07163f43e5e61a5000dedbc0a4ff2cde87b4be136752161b33f08307e4f88d0da826829057a9
SSDEEP 12288:fyPz5L8SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SzySsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16055025B73A530F9D1368138C5A29A06F7337C3257204A9F17A546BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c93a91b675c1a7a98295b82894ad2cfc981c974476c36f01f85b9a46876f5d97
MD5 804d493c005e02f4e7d349bd243ee6b0
SHA1 c79cf810d23fe8a0c39a24c5485e8851e73eee94
SHA512 e54d0178e4a9598ac31a96c6c3c4813b16c5e80932614cf9d9f1b3f86fd75d54433e15bb882e22857322d6d1908f0d46f755782a270d2d658b77b9021151b50c
SSDEEP 24576:lTDaLl3z0zDgsqjnhMgeiCl7G0nehbGZpbD:lTuLlj5Dmg27RnWGj
TLSH
T1A96501A9B35018F8EC67813EC965D90AD5B37C5A0B70CA1F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 aee958fc39006701c63bfc943cc02769605411fd6167fcf375edd9d6763c106e
MD5 4bf887dd54784ee3fd656319b3791c85
SHA1 89e424090d4ad27b2e0ed6c757232f2949382c1c
SHA512 3d591b806fffaa818abb69203fd99c937a4ec50d171136862ab30728fd88598eb34c8a2f4270e1a14a390a56d2de1e2ccd28cadd6f920c7dd4eea36d69184981
SSDEEP 24576:u3vd9CHKy7GZ0sqjnhMgeiCl7G0nehbGZpbD:wvd9CHKyauDmg27RnWGj
TLSH
T11E75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5400be45c50fb2678bb9be5178b695d81c36caf14970121796b0b94c181a6913
MD5 d54b2c45a8b80fd6f4ed13038063eaa9
SHA1 636fc0796d4380c7081c5a8129ecd15e58768eaf
SHA512 905933a657c6095f0ca8161a367b3a28ce6712ee285a37562c75f4a8746adefac0f548541106268321749a386a32bb24d4a4775cd306b6344b2c518a73b6ee3f
SSDEEP 12288:fQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1114523BE915C01CBE92648B5C3E5F15DAC173E57F9200483BA9778B9F7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 84a1aed05d57fb9b85505263cb3d450a26f2c47bd24ad692322d7d0657d84210
MD5 530be68e23e20888d85144fa25eb6287
SHA1 db9ee39947df3d39b9dbd06c0ed08e05240f5509
SHA512 2c86625e19a5c7485139b8fbd88c80b2ad9019b0e13dbcb16c5389df176e682a1928452b16b5489b16c49e03e51bf36d512c5d5496a1a85e91fd00a5135fd765
SSDEEP 12288:kyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kysqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C4523BE915C01CBE92644B5C3E5E15DAC173E67E9200483BB9778B9F7F24688B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7dc8820ca679113a3f27ecbd7b0e5e65c038d0cf78a215d084404d0e6db5acc0
MD5 852b18a7bef6e557883014e7c9b2c253
SHA1 7dd7199e44a0367edfc36ba5438c0c28715ce9b4
SHA512 fa8d777a95273f2e2e0560cfc56b30b9e431454966c7d03d4871e17e4b0377e08d6a25dd96d37745be661bc2fb3d2ee8015a519e5d494f3be7915e871923388c
SSDEEP 12288:HdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC4523BE915C01CBE92608B5C3E5E15DAC173E57F9200483BA9778BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.4MB
SHA256 3f70db6f306afbf79503186174f4ea7ba76cb98d08a9b207cfc8615818739f1f
MD5 2aab6f3bb836f5d083a312dd044f62bd
SHA1 5f6450395cfaac1c678874f31583c12bf68cbff9
SHA512 9bddf3de059317d1a347cc9a2dcbc1bbd190b4a410c757c3c931ac425f90b0de25b55d0d9a763a6437b6fab17a05ce02d004c19ec720527b8eff6dbaa23ffbff
SSDEEP 24576:q4wvwk9RX6wkyAI/sqjnhMgeiCl7G0nehbGZpbD8oFaoMBO7wUlDCPIEwfOJxVg5:7MnYIjDmg27RnWGjZFD8Pdbfe4
TLSH
T1E5C5F12DEACC44D1E177913C89B7860AF6B278295B31C2CF125A53AD0E37ED49E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e353176565b0654cdfddaab77dd9ca45f413b968b2fd8dd5afb6652e2f67bcd3
MD5 c354eb9e48af13516b6907c49883940f
SHA1 948524d5d0dbf41c7bd325b9ee237daed85f7acf
SHA512 b67b4a20130c0aeaf793f887637ef3e0a99f313ac49903147db12deaefb0ea4795f67dad06906df1b9b8a64c50dd435ad00ca74330ceef4c99c923f45b31f5f9
SSDEEP 49152:hYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YDmg27RnWGj:sySzPQD527BWG
TLSH
T1CF066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 232523b7a76234f86d1b5a4e0301d6f0bf586f611e94ce66007090cb2704f7ef
MD5 9e5590300b61398ed91310a10ee28a4a
SHA1 f6677368fda590003b972d115b5028305bb5901e
SHA512 b2756475f2ee6b40c51734d07eaa1ea031ee7f6abf50120cbaf01c9323b966cbafd842bfc524738b2896c33a9af727b78101ca7299866e455070abd27cdd3810
SSDEEP 24576:t47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYmsqjnhMgeiCl7G0nehbGZpbD:t47JUQjTirIhCnDHUPfF/oDmg27RnWGj
TLSH
T15165AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 48c96f23c57ae7b647a7a13f404207f4f8db06e243ec2e5ba8c0794a242d2402
MD5 c0d47e38a69737c812d221c48b747e04
SHA1 b5216d6aecfbded3425d484182be29fba0a5cd55
SHA512 94468b2190c9922d9f5b48373a6e6b98ca76c76c039fbcc210ed1786cd8e54a05517064068396cb2376ba4a18ba8ddb4fd382ec0d90e01c1832ebc661ee667c0
SSDEEP 12288:+bsfDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 9fe7ad2ba4d661f359afe161a12c298bdaf8c88c7a6743e7db60573351e68919
MD5 c22670ca90cd056d150f649deb5fb7ac
SHA1 fe9eb42ba30474d38660ab0ba17a00c2aab402b4
SHA512 a72a5339df7e9b7aa6ba132ca56233c8e5b6bcc7fc40e3585ae18b2a4fa96903469229dd4113a5603a075b0fb3a5b1d4d63c63d289938cc7f3ed9869228b535a
SSDEEP 12288:r98wPvpU3fFaBMN5ZcxmU5f9azcpWRMXOTqL8rjH:r9hPhUPRuf96cpWRMXCqL8r
TLSH
T19F2519117666DB4FC66940321E37C2CCAB707D46FE45AB0372C9872FC576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 997KB
SHA256 b5b69d31672f507484868caed9dcca2690bf8523a78eb03cb7a15db4ef5f68cd
MD5 4766955be47582f78c7004dfebc1cb89
SHA1 8bd8326c948c062c5e6cdf358100797deb1cc41b
SHA512 982014597e92747f5a32b0e90bdef84e32bf4ffa30de9611c495c32de44bcbe5e6727c733f15cd113d3d813f10c028c341abf9cafe4b2312d849de2173a90332
SSDEEP 6144:FfY34ndctcLExAzr/FkV73hH44xatMxgNYWccgpZ0O:FfY34ndctyEx0uV7RYGpZv
TLSH
T17C25A441A536A7CFD0B72031072A5B4CABA4ED07B7095F26B3D9453EC86BB51A0BC3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 4328ed5f9a6427128812670fd1cfaf00d03f64a7210a73c2c6b0f1e705c87d7e
MD5 c91c1ff4a4ed38e6ea677bd1750dd1f1
SHA1 74d38789fd1dfde9c702f6a205889ecf9d0d9e26
SHA512 50067ea204471513e77e6c893a8f8878597e3754bf291dbc0de2a75e1e6e438b33c9cdc5017f03f5259e9cb7a2036dfcc699790a727eb243ec2aab72f423dd6e
SSDEEP 384:AoRVllFVllEmlTwsoRVllFVll6+soRVllFVllJ:AoRVllFVllEmlTwsoRVllFVll6+soRVF
TLSH
T12672DFDCF760E662C8B306318DEDD7E86739FD7D2E8107037189239CDCA8946ADA9580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIU_INSTALL64.2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stopexe.LOG

Path C:\ProgramData\UIU\InstallerLogs\UIU_INSTALL64.2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stopexe.LOG
Size 11KB
SHA256 dd41487604aaefe79c6bbbf78373792655147c2dde384e58f22f23336b9ebdbb
MD5 342e9fb7682960019a94ef2a6094543c
SHA1 cbe0737e57a944eebf4177414018b0756e08331a
SHA512 9ffbe0e5cce6acfc2269326f581891e9b50d74ea810a3e4aa754f3a93bb1917369e3d3dbe3b2c48d4debabb5b8dc921240cc0980748f423a545f9382f380bf6d
SSDEEP 192:4I2JeK3UKKkoYUEzTAfjrZiHJxoyNA//rmF4TZoaaVyqeog9OsHZHuSgpfQzw:P/EUKKkoYTn
TLSH
T1A442F2CECB29E95DB8424A770139CF2594503C4C1901BBFA396CDB8A8785134BEBB779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIU_INSTALL64.2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stopexe.LOG

Path C:\ProgramData\UIU\InstallerLogs\UIU_INSTALL64.2026-10-17_a0afd71ed966204617b4d4bd2412f32f_darkgate_rhadamanthys_smoke-loader_stopexe.LOG
Size 1KB
SHA256 526d52b341f945af86c9f569883582b15ab470a8ac6485a7845b842a62c21b23
MD5 8f96d457e1b838f5cf16c8beb90890ac
SHA1 f7493bfb3ef0e1a3da73444a3f18e2786266d48f
SHA512 dcf0d09a94fe71c22fffe0fa8e155ce97b8cd7c0bfb35f89f35d5ea24a44eb0775998d1cf3d5ab8faa69752e0e3a194ca5fda1f9412a7cd4d578b6657ee8bd06
TLSH
T1C54102DDD529F85CF5024A320274CF24C844BE5E68423AEA79ACDE83D7441B0E66F779
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 67cf5935d0f1eceaf2eb08a79eac24416318c51f519e30a2709f4d35f5a17864
MD5 53d24b07e2c34caeae41755e58398dc3
SHA1 4632078d1b737ff15fc5d76ae92b586d289bd5ee
SHA512 c1ba9594c3bc46de8b940e551822c5289957151172827e90f879908867e8bd97454eb54dab26f81a239cb3391997d472ab353ddc34a76ad6f558faf553a767c6
SSDEEP 12288:a077Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:b7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE45237A834C118BF93609B482E9E12D681B7E669F2004C3BA5778FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 85bbeb56c45669d7289d233c24c37addeea3652e03cc0d1ec82c07e7d567f886
MD5 69e07e38e812c8dc99d4e37073042503
SHA1 25af2374e487612fa71b8497da21f6cc53abf166
SHA512 95df21994f193165421f2fb78f4ac7d9be5d7ca7ba456cc5840b655e4be1a71ab39339191931f9b2012ac7f0db000e999aa7f15167be0dac151a5d3d39b105ba
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYFsqjnhMgeiCl7G0nehbGZpbD:hgb4mBIBhGFqDmg27RnWGj
TLSH
T143659E1E22EC02E5E0F6D2B8CDAA4417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 af2ab42f328301c49dead326f0a8194ce9fe3eb0459b2d73786f44643e27c491
MD5 01cbd1f5c2e469c507eecfdd655900ca
SHA1 cfdedfa241d168e5680a2f598c449303aadb7abe
SHA512 70213ae4ecd09ca28f1d073f591d2dda15a61234b365a1b4e5534f65a222a47dc990cdd328a5b4ca5655b20575dd92c9ff53f256c52752a5124fa43f79bf0ce3
SSDEEP 12288:axGpoWcaoR6T0fUm+WWPnLeg47wUGx/S1MKXSPTPotEelN9vPaPJauktK+6DgeGb:qGpoFaoMBO7wUlDCPIEwfOJxVgt74l6
TLSH
T1EF05233D54D06080C33BC675A07899EAB5823C25A72891EF0A91DBB94F0ADD4AF7DDC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 068c212da999b8be4a29fe6d0a8ede415e66e8a9a8aa61ebf8b8e02fbdb92aeb
MD5 755a44a46c817fb043fa5a91882f5d06
SHA1 7ac3e99963a2d953bec6660928b5bd31137f1bf4
SHA512 b362d8e787420675ecbc2420b7179c927fa99892718eee4178079eec9a27bcf2f81fe0eb4245af8968ac6d0cf682ab74931b2c3031f307e6eac5920b6e861167
SSDEEP 24576:qG88u8FpJqH1bzria7/mWsqjnhMgeiCl7G0nehbGZpbD:R7ZFPqVea7/hDmg27RnWGj
TLSH
T18B85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 2cad0f10711c72eff1c09e5a458fc30cf7eeb18787202bb108823aa9a4fb636e
MD5 a1290cdb3ba5d0f0547fc2af65db1304
SHA1 481070442d83b93619bd429be81401a967f3dd3f
SHA512 58f058c4d26adc9fa7c7381df419b3ebab2073b2cf8e12b9d0e745d7c6ab0ea8ccc6df2688ffa18326b910385c019543ee960a8623224f89a3acb2c93e31e4bc
SSDEEP 12288:4HvUrBFrEjwaQaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:4PUr+NQasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF65F12F62AC18E5E676A17C8682C60DF6727862171192CF02E1817E5F73DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.8MB
SHA256 3fc9fb8deee1ef702ac8c74373efd7ddf98b32463f984b54f9a7ba873a117feb
MD5 0dd1366589f8f6540684f4733bc6bc68
SHA1 783ac6dfedddaa202e13a21d7abedcaf4bcfab2a
SHA512 8afb5c7a6bb514c5e421c275e4f3a21206dc43ba4ce7265668e3274a152ce42adbdae641a86c79054db29104ae2300c1cbb955bec24f600baaa64c00d10d07c0
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLFD8Pdbfe4:eG05lO43bhPdzl
TLSH
T13BD5C06E62EC11F5D1BBC17CD9C64A0BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e6e01ad2d09d3e1e3d033c47d77373870960fd9521cbd7d87d6ad25d1212bacb
MD5 fee2a113f99b05b4ef2a6c2c76561a46
SHA1 e84c9cb81a4b8ee0a3f110227f3ddd631095ea23
SHA512 760987b5069b201ba5e0cad20119705faf0e09100fccd48a9b46cbdd07da4a56617df96e1a4c585efbf00536541aaa0f8482605e5e2c5294a13498ea0967c2cc
SSDEEP 24576:Efa5POZ3dpuWVM50JicR2hG0lasx2+47eidnssqjnhMgeiCl7G0nehbGZpbD:ca5POZ3BJt2pasx2+m2Dmg27RnWGj
TLSH
T18465BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c04b4336f2680c713a4ef8934fa3c8306b82c0c5368c492781a13104aefe98d5
MD5 d395b5cb38b1f8021f09386f9496a667
SHA1 cdccead7efeda1067e6286df4480d000a0b30e51
SHA512 4459da74b585d6c6ac9c76c0522ca97f39fadcc95117c5a1a28278d81eb3c4ab1338c84a6dc4b86c33410c4b4ca89183c071a024aec661b11e7077d3c14021d0
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7Fk+sqjnhMgeiCl7G0nehbGZpbD:sNc/zEOVHFBDmg27RnWGj
TLSH
T17A857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 5c4875eb792fe718c3001c62745274ce6d619c7d7c4a2b10354b6e5a0e42c1e4
MD5 031512fb9738c65e9abfe2f01870405d
SHA1 ef4293db51814961f2037e5832a5668026cab906
SHA512 ff4f4eb0e4e8d711b7dbad052c5926a166867c790ec2b7707a05fc9d3e99770a263378fe2cf25e1f55cc553858601d00c71c69f6035ab5ffc4d9ffc625928ce9
SSDEEP 24576:2TDI7oFaoMBO7wUlDCPIEwfOJxVgt74l6:2TDI8FD8Pdbfe4
TLSH
T13725022D63A600F5D16BD03ED2824546D2B27435D32656DF0B94CAB94F93ECCBA3DE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 4d0a0e37d6db0d9e8a52b1693f80c225c55bbdb805b940c23012572f4382b0cc
MD5 570778e6fa44095c84a384cd69dbb38d
SHA1 f65cfc8d412265301541d224880edb5b682fb055
SHA512 9cb8570ae7a2ea89c1c3bd1705b1f911fd9ae2bbc88d0971b3701f98c1412ded2124ec25cf9ffb1c36af9de853303a5bc74b9b473e2ed3f040025dc1d89ff913
SSDEEP 24576:3tyLoFaoMBO7wUlDCPIEwfOJxVgt74l6:3tDFD8Pdbfe4
TLSH
T16B15231553805080E37A4674E67681E88A663C25A73583DF1691EB7E1F3BFC8ED35B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 dbc5c1c32b7fe3ca175ccf565b9cd52fc165f20cd97e4167ef32ba0cf70d6d03
MD5 c743045d4924e19d8948ad3b57556481
SHA1 4b6bffb6f28824fc5135c68a43f81f6d2664e6ae
SHA512 3b9e636e83a1fb65b160b98564d20dc2fbc9c793062a9aa2fb1b4b499a58ce75b6e60ff214504247de3047dcb1fd16c54ee1aa67716320d33cb4b2d0113726a4
SSDEEP 12288:QoRoWcaoR6T0fUm+WWPnLeg47wUGx/S1MKXSPTPotEelN9vPaPJauktK+6DgeG73:fRoFaoMBO7wUlDCPIEwfOJxVgt74l6
TLSH
T1E905233D84805041D3169AB171AC9ED981873C2AB72A92DB2A56CFF4470FDC9DE7ADC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 9180e994c73cbb9d4d26d3b27f00a32f7e80c28b6f3ff9bf8cd10391cfaae61a
MD5 d0f6f585330005ba84d33ce21d75c36a
SHA1 9f99bb1c4b6d6fc25ce6ac5217c09917dff669a6
SHA512 706e1354bc7c3a332e0a4d59baf99f94adb95daa96d2c48fb40b50993ec9b6b202c789d473ca97d9c602db071089c902178dacd9ace64d83856ef5669063cfc7
SSDEEP 49152:Mgb4mBIBhGFqDmg27RnWGjWHFD8Pdbfe4:MtxD527BWGRPdzl
TLSH
T1F7A5D01E22EC02E5E1F6D2B8CDAA4417D6B378161731D2CF1251427D2F2BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 217f3962a624025a4c30e64af5e00ef97598319637db0af4285b1e846f8a4989
MD5 306715a5a142b9b7cd7bfd8e6479035e
SHA1 263c07ab258c935311af3e5d1f7245dd430b671c
SHA512 64bb67e4834020087a7f131ca4816e885d095ece3dc8b1de8bce21dd1f38b17ba4ea464c61eedc3a249859e180ecdae95790c4f98b7623a380528a931f421d4b
SSDEEP 24576:zTkNvNnaFeYhJNtmZBmsoFaoMBO7wUlDCPIEwfOJxVgt74l6:zTMwBtOmxFD8Pdbfe4
TLSH
T14575C02EAAF845E4D1FEC6B4DD238512E6727861173293CB5390C13E0E179D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.3MB
SHA256 5bd3f3038bcbe47ea9954aa03999a0fe62cfa32ed021f1e6ce2de29deb3a18ea
MD5 529f5405520ebed458ad9074f25e6a76
SHA1 9c858fd34c3f5fb4e0530cc76c316e568a4ba2e5
SHA512 bc6d99585f008553faf0e34116910f552edf16dbaab18d4e591807d2c25bb6bcc0fc8274183d1d52a6ce6402e819c14ce31da44871abc101d611edc7499ce153
SSDEEP 24576:sD3FHshBIYQgAnsqjnhMgeiCl7G0nehbGZpbD4oFaoMBO7wUlDCPIEwfOJxVgt7j:sDVHeBIAA7Dmg27RnWGjlFD8Pdbfe4
TLSH
T181B5023EE69C00D4E57BC1BCC6A3CA0AE67238A9032155CB1695C1BA5F5BEE46D3DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 662b49a6de2ccd014fceb9bd335996cf1c698ae368db11a2d4dd77b357e03b0a
MD5 f1ed2b2e24e921f6c8dea16e82335b1f
SHA1 2dfe5d6212ecb038b5b7a1e9d54562d7b6cc9a89
SHA512 c8f2d0e86901ac217f6c04e89c09233cfd28c3234b67cfcc2246d33708a246d74688a905e61dd99471361b30a64bf27e19c1a0d4592745b0e74865f7e27d9fd2
SSDEEP 24576:GJnJPbzB4SzoFaoMBO7wUlDCPIEwfOJxVgt74l6:GJnJv6S0FD8Pdbfe4
TLSH
T1A835F13DD2A810D4E4B7C2B4815A1B9AFF31383D2B2569C719B4D5343F02EE0AA79F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 9a9c6352cf163d97705ad572c55a1b29f53953f269272c72eb5c684655f12ec7
MD5 3a994842aa053d889beb61509f42d33b
SHA1 0a126285d8494d9ebfa544f60de31d564e8ac13b
SHA512 ce48ed46aab3df6500bc6a30ba2ee1c9be34d228e08fddb3cf9ce90bc13c60c61c9163c88eaef3b6c2acac5cb0ef7e32f6b6af26f71b31a5b5e7c763237f04f6
SSDEEP 12288:3foWcaoR6T0fUm+WWPnLeg47wUGx/S1MKXSPTPotEelN9vPaPJauktK+6DgeG7/v:3foFaoMBO7wUlDCPIEwfOJxVgt74l6
TLSH
T1C305232A84408041D3679AB2B1A89DDD46863C1BF32DD2C72A169BE5070FCDDDF7A9C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 f4a2bdbfd5611467bc7315ca1d878fc88f7e66f195173e8cf583bc3c8a4b93fb
MD5 61a467060f251c65a3213ef1e574c23b
SHA1 eb68d25764d9476437464b4d4c21c977ae267631
SHA512 bed7113fc905a758d72147899e818615eaa7259bf4d89236ca91ebca3ca4496f83766d8b1c97692feb211a41578b295d26cf1cba2010d1131b6b7c8811e13cd0
SSDEEP 24576:t6UqjpnoFaoMBO7wUlDCPIEwfOJxVgt74l6:t6U9FD8Pdbfe4
TLSH
T1EA25231E55C050D1E23A4670E565816981923C37237992EF36D8CBBE4B36EC8DA3FF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/360-83-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/360-543-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/360-91-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/360-85-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/804-105-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/804-547-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/892-570-0x000001BF0D620000-0x000001BF0DCA0000-memory.dmp

Download

memory/892-634-0x000001BF0D620000-0x000001BF0DCA0000-memory.dmp

Download

memory/1332-49-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1332-50-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1332-320-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1332-58-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1520-129-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1520-121-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1520-549-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2028-141-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2028-146-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2028-135-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2028-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2028-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2352-71-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2352-78-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2352-440-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2352-72-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2928-0-0x00000000007C0000-0x00000000008E3000-memory.dmp

Download

memory/2928-478-0x00000000023D0000-0x0000000002453000-memory.dmp

Download

memory/2928-20-0x0000000002EA0000-0x0000000002F00000-memory.dmp

Download

memory/2928-14-0x0000000002EA0000-0x0000000002F00000-memory.dmp

Download

memory/2928-9-0x0000000140000000-0x00000001422AD000-memory.dmp

Download

memory/2928-5-0x00000000023D0000-0x0000000002453000-memory.dmp

Download

memory/2928-477-0x0000000002EA0000-0x0000000002F00000-memory.dmp

Download

memory/2928-81-0x0000000140000000-0x00000001422AD000-memory.dmp

Download

memory/2928-7-0x00000000023D0000-0x0000000002453000-memory.dmp

Download

memory/2928-541-0x0000000140000000-0x00000001422AD000-memory.dmp

Download

memory/3400-596-0x00000000024A0000-0x0000000002523000-memory.dmp

Download

memory/3400-589-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3400-604-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3400-601-0x00000000024A0000-0x0000000002523000-memory.dmp

Download

memory/3400-590-0x00000000024A0000-0x0000000002523000-memory.dmp

Download

memory/3520-606-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3520-605-0x0000000140000000-0x0000000140388000-memory.dmp

Download

memory/3520-640-0x0000000140000000-0x0000000140388000-memory.dmp

Download

memory/3520-638-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3520-636-0x00000000013E0000-0x0000000001463000-memory.dmp

Download

memory/3520-627-0x0000000140000000-0x0000000140388000-memory.dmp

Download

memory/3520-614-0x00000000013E0000-0x0000000001463000-memory.dmp

Download

memory/3520-620-0x00000000013E0000-0x0000000001463000-memory.dmp

Download

memory/3520-612-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3700-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3700-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3700-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3700-542-0x0000000003000000-0x000000000329E000-memory.dmp

Download

memory/3700-550-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4872-133-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4872-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4872-30-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4872-38-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5408-116-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5408-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5408-110-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5408-544-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5408-546-0x0000000140000000-0x00000001401BA000-memory.dmp

Download