f50a72f3af3f5c78a4b3ce600fd7ec49e5a79b951c8853496b326c8445394592

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Size 926KB
Sample261024-bc3v2sez2v
SHA256 f50a72f3af3f5c78a4b3ce600fd7ec49e5a79b951c8853496b326c8445394592
MD5 abad3d28b7ba769ccd77730e005f8536
SHA1 36db74bb1bdb60b48790032b6fdfa8290759301d
SHA512 114efd7397411414e2a9f97e16514216ee7a92885d5b8f75666a5941d97bd4cd470faeeaaed9fb8e7d5437371ca7fd6619e75509d4b3f1697327425e33c3bf0d
SSDEEP 24576:lsYmkmaM41Cb8NGyVXXC8Ac2YV3swxhZPegenZPwC7:uYdmaMsCCWh4sCdegmZz
TLSH
T1A615E1227790D032D2B231714BA6E3B4A6AEBD705E34878777C03B7DAE345D19A3471A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3412	elevation_service.exe
3620	elevation_service.exe
1532	maintenanceservice.exe
2808	OSE.EXE
4636	PerceptionSimulationService.exe
1540	perfhost.exe
4592	ReFsDedupSvc.exe
4176	SensorDataService.exe
3148	ssh-agent.exe
2296	AgentService.exe
4820	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6e15ed1d31e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaw.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\java.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d07dd6695363dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004674e9295363dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009aedb9295363dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000130b4a2b5363dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc84732a5363dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048859d295363dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe
3412	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeBackupPrivilege	4592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4592	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4592	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4592	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4592	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4592	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2296	AgentService.exe
Token: 33	4820	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4820	SearchIndexer.exe
Token: SeDebugPrivilege	4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	3412	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
4620	2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 2016	4820	SearchIndexer.exe	101
PID 4820 wrote to memory of 1172	4820	SearchIndexer.exe	102
PID 4820 wrote to memory of 5716	4820	SearchIndexer.exe	103
PID 4820 wrote to memory of 1204	4820	SearchIndexer.exe	104
PID 4820 wrote to memory of 3248	4820	SearchIndexer.exe	108
PID 4820 wrote to memory of 5048	4820	SearchIndexer.exe	109
PID 4820 wrote to memory of 5624	4820	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_abad3d28b7ba769ccd77730e005f8536_amadey_darkgate_elex_remcos_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4620

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3620

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1532

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2808

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4636

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1540

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4176

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3148

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1172
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5716
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5048
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e5bfd7e9b322803ea9163aa0d574f84185675af78918538c5367c024c9829128
MD5 1620c11c254d2996997dbd8128c7d7e1
SHA1 f97fee09dc130f1eafa091424c0660a937e8fbe2
SHA512 146431601c59ac7a35ede8da4aa0bffaf54c736bcf8f11d2dfe978e5d2bd8fd5d8f98d27448382cd7706297979166dad16a33d66ad115da000f463f893e0c760
SSDEEP 49152:ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxndWh4sCdegmZz:w3q6sjBgWIURZz
TLSH
T140D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 eeedb8fb11177ec9d25b29278526f709bb3ecbc34bbc019309e54043529c9706
MD5 3f085cdd553163f6a10b5c03aa8181ac
SHA1 e8c95b7f3b736b8a34d9ea9859d394795fba7a19
SHA512 72604ce410a97bc2ed93a73d4aa474589ef01e8707c28b4fd717e731ca2ac7683fc081d3e40bad57be66a114dcbd6398b30cdaeba63a3b9e2b288442a366f24f
SSDEEP 24576:0XYfDtczAiVXXC8Ac2YV3swxhZPegenZPwC7:ztcPWh4sCdegmZz
TLSH
T1D5050128A79508F9ED7B827CCCA1C515E633BC544360EB9B03E09A261F376D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 652757f738c313cb8cf04368521883fa5cea29f59c2370af6ec85a35845d645f
MD5 49e77a5d5cff9f9e800417c3b41f2a8a
SHA1 e8fba092bb6a0eeb4571e22483235545021767c7
SHA512 82af1033016549a9c514a131c78f218a0bece484fbeb92bc7d95949dd74629a6c9782bd5687cc20bb220d81b5549c8e5f12e8a4c13a59b9fa6604fac40df1556
SSDEEP 24576:D0Le5ji0hmxxrMfVXXC8Ac2YV3swxhZPegenZPwC7:DPji0AjqWh4sCdegmZz
TLSH
T19135AE26F6748335D073C0B9C5D2A68EED71348257308ACB4286D77C7E6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ce4b85885b7d00260a8ae389f74515b40fb19e81e7d744719b6a75614d533c78
MD5 a8bf51bf12d97f400f3866cdb21e206d
SHA1 a77f749233b37f97e25775a29413e3a60e396b0b
SHA512 0ce1f389b50e6ac499c1ca7f205f0876a12eac9c55beed5ea46223813018e374a0487e2abdc1ee21570f0492718d4578667a45d49e4369f60a077596809f38ba
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWn6q8wyuFVXXC8Ac2YV3swxhZPegenZPwC7:L/ezSC6vUzPveHjy+Wh4sCdegmZz
TLSH
T1DA756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9f2d203d2caacf0088032142ee4283d0c25ae8a7490300bae75aa30a0b162a6e
MD5 fdb037fab74e1db9e4b535e978f5ba8c
SHA1 a21bd3ded04f3934722f37ed30e3eb9464b5fd41
SHA512 c2717726c2c7f68a005fa84fa6b220cb7739451fc2e5b7bee3b2c147ddc5ad6b8b37ff05b44e414a4ed09f491b6b40ae82f83b40611cc5d2283624227bb2b6e4
SSDEEP 24576:zVbqPb88hv/l+YeVXXC8Ac2YV3swxhZPegenZPwC7:zVO88hXl+nWh4sCdegmZz
TLSH
T1AF559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 523e4119768655a1f1a033f4d8baf4e857459d81b579299963a886f353f645e2
MD5 d8716b2d03cb8cd3f239d823f17e25a3
SHA1 f65fb85b1ea15d3bf59abba56222b8e28025683a
SHA512 da01043f3d03fd98fdca7be83353d1925aba2c5775e12b145f4bd9a0cd4453c58c2ec2a86f3666875f9b145046506ea51ec999d2c8414ed1b4f932ebf720d478
SSDEEP 12288:5LbVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:5LbVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T16AC423A2CE069467F7BF0674CDE4E7D9E2289F849084CD2992917F1A7C3C899A432533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 357d927f3a232e53f1e6817b32af276248240bd57653144cac1c0b9f13cd5995
MD5 564df3cb9bf65657ea412addc400b3fd
SHA1 5e77809df2f1a637ff81ce55602de876f0350511
SHA512 9d71c33428a9fd6cd1c6d20b5334cf0c93f282c753551287eced1024b26134803a025db07df0d136dfe8822efc1a2cecaa9adbc006cac3e063b29ca818849115
SSDEEP 12288:veBNUbTVO86UmVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:vJIUmVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1C505CF7BEE28FCE2C27E4DB85A918340E77278304B61A3CBD165830E9E275E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4093789842416291607f1e478c71a6cc431df553ad9161fa780e70ded7fa54a2
MD5 956d7ca61aa296cc408cdadb6636520e
SHA1 b573987b065625b5dc5de51afaf889fa2896c131
SHA512 904780156a1b103f8ded7543c1b8cda274091e6cf6397ad7f30fca4cd0ff14637ce86b801cc24525fa11b0c1b2a2af189eac8ffb95f0448731810bc0c7ebcbc3
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THJ:3QvGAdlCEL8c/DRNw5CvWIURZz
TLSH
T1B6266C656BF880F5E0A7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0895d3166a5d4870d0b8595c2f652c8ee0c5d4ed52f86e73657928ac9b262eb8
MD5 adad2eeb48b50534408c669b722529cd
SHA1 6fb8473bdd777683035481bdd829e2eaed4418f8
SHA512 0737a6b3699c595bb26362439f328c894d717c348669720933bc9eb565a86ba978cd44208e2360f875fa642cfa9082576934484527f7e41e883645c901fdf911
SSDEEP 24576:a0ewsAjcVXXC8Ac2YV3swxhZPegenZPwC7:7ljaWh4sCdegmZz
TLSH
T1EC15E031FE75E036D3BF0DB61B65C716542CAE204B911AC3E3E89E9E59341D22336A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 40fed7848d75b1aa6ecf2d82a7e7a2593d6662d9f6c4a36e10f6c57219f4cea1
MD5 112d563759e00bacb2aff6dcdd64faf3
SHA1 9ed43f46520f59b1a075732550783780a7fa4b21
SHA512 0176a0a2f832fb368eb5bedc5fd627ab73106e9b7b72b023a7e56ff444e4720fe0d09908eec91675375ed2daf98d3996a0ed48688ed6e3de8cf7e849a1907df0
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHFp:nUEtQevvqc2W1cpV2tI32z
TLSH
T119474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 111d47c75b6a1c10de4ee56d1642e4bfb178983a4bb19147143c59588aa5e2c4
MD5 319cfd1199aee22e0c4be261faba3cf5
SHA1 7fd1a5f0fa525e19b781a5c4aafb846473878f73
SHA512 15bc2f73d83f11c35d051aff36381bff2c083cad4c0664d1ff6b38bfa3a91f6cbb7fbb3c2236e2783f35d6fdf133f237764c8bb3e9fc21ef8b00cab8028401b2
SSDEEP 49152:kCbRquA/m2yL5zifFiV+XenmE3/z6Wh4sCdegmZz:toqHVjnmzWIURZz
TLSH
T147D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 921018e93c77682046cf11facb8753aefb367b20c7a09e3febad521b7cdbfb24
MD5 76b3b96a3588849431d7d141841b84c1
SHA1 c2e1105b82d4ebe9c8d71bdde5e5370ddb72f52e
SHA512 9c2f11f4ddcb80b0bcf4f9342f73b8780b428b730f26ba643c859bf5caca8fceca54bb76ab194e55f1c3bcceeddd9686d0d6d25eebc26477bcf35a3e0747c98f
SSDEEP 24576:uAhGL3IFoiwtA5l7S53pVXXC8Ac2YV3swxhZPegenZPwC7:uAMUFoiq5jWh4sCdegmZz
TLSH
T1BA35AD81EBF955D4F5B3AAB899B69170EA76BCA55E30C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 3df688091a958b9c69c5ba6762554224e5896b05c988c54a6e276dcd4dde32d2
MD5 fca9cf4d7032601120abbe0ad5588625
SHA1 ce757ff02b4949c99e0246eb39ba884b35f560d0
SHA512 9adfe194c51e0527289fb5ad8ff3c8571134f53f96ea89972ec0fa4a1cddc0d96c98fcda96ec78c2afeab9309ee57f314a727bd2c34b9bc9729a49e19fdf313b
SSDEEP 24576:Wwu4OWQVXXC8Ac2YV3swxhZPegenZPwC7:WwvO3Wh4sCdegmZz
TLSH
T12205F14666A50CF9E9774238C997C136F7B2BC012A24DB1F5360C75B6F37261BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 b7fe89562fbf45874e98ee0bad142cf69f84a2ace2655caa24bceeb1e3b76878
MD5 138470109c6b5ab53c68f25164075f41
SHA1 97140d968cc4398fd732c69f0e11414c64977ef0
SHA512 36ce595ea4f6b528c959a2f56193ebb4ee0042015d1cf8f6047db3506150c19043b4462117438aa46b3b0cb0cdd62b00b30215a42c80d318dcc17ad7daa9ce06
SSDEEP 12288:LeZ1IysVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:qZuHVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1AFE41296279460FAF2BB4278CDE09789E371BC51637487CF12515B6A2E3A8C52C36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7fbcc3b8bea95f56ff5e7ea190d0188b6a2ce95136899dd9c9203391f75d55c2
MD5 d624b0f6525c0fb639e24c806202c3fc
SHA1 32415ef307adb6e0180105120051493ef9f58056
SHA512 94f00d8a274394cb5d86a6e690a9ac3547c9b76564e272b726de1c6d98d6573f5491ef5f0fa3faf573d407eda7ec6053b36c426eccba373f769cb2f8442c4b27
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ud:lQRQyi36YOcPbLvw2gAf+PN3sWIURZz
TLSH
T13C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d38da1e7e9d8b171da7d5a692df8d72e61af88d1fbcba69dd235565bc2db8723
MD5 f3c3afa521549572c7b60c576b365166
SHA1 04be0dfec177a25293f8aa4d39647ddd740b9879
SHA512 734cc4efd246466e2f140c92d21d1334eb950963f74b625c3cb0c0011ee0b08cc14a5adc9ed314ad4932259cc21821a7310ea0fde1db3e0fbb0deb2925705484
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ud:6QRQyi36YOcPbLvw2gAf+PN3sWIURZz
TLSH
T10D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5480867470a942307ae7e0943146e17a00704d304aa49420ece5b2a7aebd8ce9
MD5 700b4458f6077a147776b7e6f7ef1a9f
SHA1 75781276aa097470ae8c2620ae444feada658069
SHA512 1f758e0ac634840a62b2c505c19df3cc1eff8606ce6457dca28226993485f876ca6e1f0457341385d7c4cd910c3d9f09e538ea764ebd97efd6c66cf312a307fe
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL03VXXC8Ac2YV3swM:468Qg55nhceWu7PNU3/qWh4sCdegmZz
TLSH
T1D8B54933B2F600A9C45DE1769F4A872196D17C758FE0E7DB8501720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3f18bb9869f60a777c52a11cf684e76aca047b77d50d2a49e474eb803a8dca3d
MD5 3757d0e208252561f057ce7a78c52752
SHA1 6c54b83838ad594a8858ad3615930fa549ae0753
SHA512 772b5498f6ce27db1b35a4c30fa40d373ec31f0537eba993e8f6bb186159b42925dccc94bf36362af0ec1c9923095212c4e4f47638a77602681d6a7e66489d88
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99X:4y5112gYy5azzVvt69nLKnhZBWIURZz
TLSH
T165167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bb900f01eb39da7c11685bf8e0bd267aa205a85e4eeec2c13cfb6e89d4561e0b
MD5 b9cb49c8464526e39d39960f7185d809
SHA1 0d8243930bd1b2b8f35b32f92a33ed68b53a5fb7
SHA512 17ffe5fb000d363c274674069299d8c58bcba713bac29f20b8e6837811956532b7bfdd701f232f076e25c944cb48bf9dfaef910ac80cc0356868ddc77a3dfd3f
SSDEEP 49152:sB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glEWh4sCdegmZz:mu6Jmdxd2dEWIURZz
TLSH
T131D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 50fbc03a32f662ec69b6a1284b6590d40459cdcb82feb6ceb8b01b991d662e7b
MD5 67743ab6ea39b3dbbb37f17b5d3a54be
SHA1 d26514c2bfa1ad903f3d0f464bc13d8eb42c233a
SHA512 c2aad411762308057a19ca40784d127fc55659f713d32f6a9e1e4a581712b81e705b1aab0bd5eaf8afacef75f9d920fb3c53d30fbe570069ba6d8a0665100d6f
SSDEEP 49152:F1hpsNoJpF1A63U44CwH7R4xoWh4sCdegmZz:FmifPWRzWIURZz
TLSH
T119B5BE13F2D900E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a8097735fd54ba03af79f57e8b8beb73de09b9aa6ff1a41218b35f9799b269b6
MD5 79f0d99d5b026111ee9398691c35e358
SHA1 b505630c4dfddc3500ec946c1290498607680d07
SHA512 65d3beb8673bd071cc0a41101512ffee3cc497cbe90d57cb467c7f1b0faeb4bf203e3c89313dca16d9de08d462e916c1351f9a13e588253977356ce4aee35112
SSDEEP 49152:VSuZQIY0Be2KcRVtOnks6NMHqNWh4sCdegmZz:75dKii61NWIURZz
TLSH
T11DC5BE03F2E940E8E0BED674CB659236EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 137fc96ea1cb9ff72a02aad2c4a8624c972b2ae5fa7512da2aee68446d9dfbe3
MD5 2dbfb86104ff4701250f79c322da4460
SHA1 a9b9a01fb227d0bfd657a098f69efa09bc10920f
SHA512 2aae5c81a63f0bb449c68a47cc4f4bb5a7e59b5be5f1c632304ddcd4c4dc50c51e10a674c3d8773895ff93e066bb6df794b8c773c6640da32d72a7fb1a412a9b
SSDEEP 49152:fhtSn8EApI0fig3giDn0AP5w0Wh4sCdegmZz:OX2imphXWIURZz
TLSH
T1DD95BF13F2D900E8D06ED174C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3f2c0d82875dcbd2cec73934ea48fe055dcb4472000cfa52dfae425e9c1ac64e
MD5 0f7adccbd45422e0b7402456958564d4
SHA1 178e79e3532de490587b51168b4d4306ad53da2b
SHA512 e1bb4f3baebe2ede12e997e2f35154a6f6b88b66e77c5f6cccf73b295e459154c2af592f65c8d74e4b042421008523ce9f1d45940d0cbbfe8c28441f2e16fb7b
SSDEEP 12288:hjVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:hjVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T14EC423A5CD07846BF37F46B4CDE093DCE6289F44A094CD6AA2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f955c54d95987ee210323ec4dd1397aff915074e345f140a52ac45d4c651b50e
MD5 e6cd9cafe8db0b42b70f1d5f07230590
SHA1 98876b2846e8a4ec629c019e5c0e4088afb965ad
SHA512 4643efd6437c319f99fecccb5c02a1d651157752bf267d0caa26314c4f65f7608814be03a7e29be1b546aeadf0a63534a702e6fbcafcfc02c8f338e860db26a9
SSDEEP 12288:OIVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:OIVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1D1C423A5CD07846BF37F46B4CDE093DCE6289F44A094CD6AA2817A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7c6301a133b5e20dd3404c0349959e08d80d2f62f29061ca131bf0784fba2862
MD5 0264284608f672f9a457f50a824d571f
SHA1 44d9ccf66b90f68967355f782da658f12e05e9e4
SHA512 26a7232aa3b2374e04946faf9be9a5384654ef2b65062741c4a08ae54b217d174424b9a9e8d5c1031869dafa01472c993e3907a6d33b7f9848a6d5e43b8f68da
SSDEEP 12288:ZOVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:ZOVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T16CC423A5CD07846BF37E46B4CDE093DCE6289F44A094CD6AE2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f4be46806716e83f4e5699625b3abb276d33cc1e68fe6c238b23183ffa0ae117
MD5 199d82a99183df68a1d130e850218236
SHA1 111704a5b428d8c622e10ed607b2be616e5f95c3
SHA512 5a133a72a82bef663e7b10fde3c066f4300f4a90bbf1e1c353752375a174ffa9c901a7b090fcfe55c04a702a0a45349ede16eb4d44b072d17b99fd3c6f3daa73
SSDEEP 12288:zVJVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:vVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T17CD423619E1A40E6F57B8374CDE0D3D8E378BF94A264CA6F93412E1A2C784987431B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 5f188ec6d7ea5d5376e483e676ff3c28aa1d5d86b3936f15463e816edc0f4b20
MD5 7d4b7e885ea7b6ac8b754bfc8181a7f2
SHA1 eaca5178d7847a52c6b88a3716202997cad81705
SHA512 a0ad4760558b3832ad348a9ef83a1befa645d1e49624fdf5f435eb2ca534cc09843eb14f549ac503ffea5395de2229cb20e3e497c75d3924abd3eb01f330560a
SSDEEP 12288:yBVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:yBVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1CFC423A5CD07846BF27E06B4CDE093DCE6289F54A094CD6AE2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 96462407633a859e9453f0d7d5bd168e63ff889efd5bfd0efa14abf8e4a78732
MD5 89d4b8f0c88034226576fba3f7d21989
SHA1 b1651be89b2980cc86b3c44cc1139ce9ada638e6
SHA512 c1ef63a2528ef02cbfbe5fdc3ec32fb54e7cb0719ad298b35e255311b6448d30694ed6ffcf4ce5d2cb371b82cf900485c82455c1222755dd28176d08fb5b82d3
SSDEEP 12288:UkVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:UkVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T153C423A5CD07846BF37F46B4CDE093DCE6289F44A094CD6AA2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a2521453415faca3763fd607a4d10cc18973f142a6f52b443959b75b6d27a115
MD5 6f38971d4e9a7ea47aa982c84bc3a77b
SHA1 18e8b616318f6bf37800014f759bbd1e16838b3b
SHA512 114a7b876281d6a13f813785b06e25f74b230f96821f664342512e86d585fc66967cae43c4a0a453feccea384e2dabc1373e9dfffd5882285b3615e273626d83
SSDEEP 12288:EAVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:EAVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1B8C423A5CD07846BF37F06B4CEE093DCD6289F94A094CD6AE2826A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 aeac6bb738e7a7d5e42bfa5a32a90192e66596c2041722ca5ab54c589d608974
MD5 750119a26fd987c4a0ea70acf68b4317
SHA1 aa61f98645b44c53b57f9ee48dc6dbdc59528d48
SHA512 2188f3935b0776f38f5ae054aea96ca15d95d3641bfff0fb2d18b446dfa58c65bc4620a1e97c33e2cbe9a312b780ad5852787477a5454fe068d7fc727a82af9e
SSDEEP 24576:ZZMRzFVSOoVXXC8Ac2YV3swxhZPegenZPwC7:ZZMRzfCWh4sCdegmZz
TLSH
T1910501A5B35018F9ED77823DCD658A45D2B2BC590760CA1F03E4362B6F372A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 2fcf4c7c7aa40e60480b0cf8e1ce32f65af582b4295bf3aa84d5c5188147b823
MD5 41100d2894586d9e88967790dbffd164
SHA1 8758331c0d8f11894b2eea480aba680b2b55b7e8
SHA512 38332adcdf5d084bcbf35e4a4dedf73af3e309bb3ed14b3dbc8f7f5426443a3920af1edbe57802a21397d01d5c15aa689cbd9ff9be1aa7d88c424e9cda5b0611
SSDEEP 12288:HXVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:HXVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1B9C423A5CD07846BF37E06B4CEE093DCD6289F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 417de276984c465ffd9e86bb0ae9e29a5bb951890efbeed5dbb6a5e67f582eb9
MD5 5d74efdf6bb7de4bc53dbb2ee2e0374b
SHA1 b4269fb42bd82c251e776d423f2d7cd5de5e1285
SHA512 0de99162506b3d0548466975e37eb881d9a53270b1a9d3f6e6250b9e301a2fca71cfd1768ad451b5c41867b42435cd0aada9515dc4ac77a9480596712610122e
SSDEEP 12288:VrVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:VrVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T131C423A5CD07846BF37F06B4CEE093DCD6289F94A094C96AE2826B1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 7b62069ecd4ebbe3044dc90053527fa9663bf50ecb115106b1721542bbe2a4d4
MD5 456a4677092fdb705ce39034dc96ba75
SHA1 3879c03ea8fd458cf879c1f41d9d8183de179514
SHA512 b0c44e7ff42d5b7c87a601bd05644e3302f796fd96a41fd768700fd610bb3af650f78bb3e8cb9ac7480443b00cfd5f6cf868b5c5070ee75283114830d4e35dc0
SSDEEP 12288:QyPz5L8sVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:hzysVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1D0F40257A76220F9E17B8238CCA15A45F375BC3157608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4cd4042a8cb9399dd069c6a7e0f598f7551953b0865ba7b3e0c706b0366efcf4
MD5 caed81645a3b47a46dd93189798c8f97
SHA1 00c1428285f3be4c72f6cdafbc6e7e8bcb289b9a
SHA512 aca3a5b9f477758f4d34955034cf7f05e05e324da6937766f26d2721550a27a85a8021bdb7b91fae397dfa08f7eecfb28ffc9894c31f2e681cb0fa1efe12461d
SSDEEP 12288:5XVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:5XVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T12EC423A5CD07846BF37E06B4CDE093DCD6289F94A094CD6AE2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 db38ba3db8e82f491fa8f242619b57c426cca257bddf81418cb2b8a276ae97b1
MD5 6f0b8a7e399d3cd6b819dc4aa007a3a4
SHA1 366fdb81441ba0452bc78ff35866285f5a96aa9f
SHA512 71effa5cbb9963683fda475b60b6ed31aa24ca90a273a66cbfaa6ae92e7c2d8d8f71c874eccb5c63c0966bcbd293e62fe11d72c908d0cfc831125703bf3ea333
SSDEEP 12288:pXVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:pXVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1B4C423A5CD07846BF37E06B4CDE093DCE62C9F94A094CD6AE2826A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 8859e092462bd6811dd55ba3f5fa126e4e34ff01d71a8b6c6f63d3df4f634c10
MD5 a7ffab047ae4746050891b6073e80797
SHA1 c8e8f34aee9b838055c489477e0327d9f66b6d2f
SHA512 4de1e7a19827bb0c7702ef0a57fe34d9f2457b1fea9fcb71b1811d7d42f5b7e0f158ae18ef7d5ce2952d54ae985f7f506eaecdd447b7a5d6d810715e0fb4dd72
SSDEEP 12288:KyPz5L8sVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:XzysVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T110F40257A76220F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c6241980cd8933fc2c3bb66dca446be8921263681a1c78b3cbc67d5e61710307
MD5 fff35072ff05ce563bde4d81ee4f479d
SHA1 00e98d5677addbd48705eaee4af78778b94919cf
SHA512 ad6065cfadc2b618293fa63fa63ba32393852b5d83f6f125a216a2945e0ce4e5f8d38399ffe9930f4b098b02c9e033aafd7671d965e59d235e7362e83e2a431f
SSDEEP 24576:mTDaLl3z0zD+VXXC8Ac2YV3swxhZPegenZPwC7:mTuLlj/Wh4sCdegmZz
TLSH
T1D70502A5B35018F9ED77823ECD658A46D2B27C590760CA1F03E4362B5F372A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 6ed9d9814c376e369647784dc8001a6de8460add04ab2dbf023cd9a3fcda3596
MD5 b09fb477732802bea9e226d66415f9a0
SHA1 0c174c45d020a63f90d6e153e9973c7f0f7bf228
SHA512 ab3d8058a87c29602cd9d053dfb959e71564bab327d59d94b9746f101ce6c09679dd549d49e1fc3257327d98d38b4d9b60fde41f6f12985b5016429c1a4f177a
SSDEEP 24576:R3vd9CHKy7GZqVXXC8Ac2YV3swxhZPegenZPwC7:Bvd9CHKyaCWh4sCdegmZz
TLSH
T1BE25CE90F3E414E9F1B78A35CD769611DA767C991B60CE8F03A4261A1E33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 eeba59ab6c41ea6feb47effab426390c446798d29486ff38968a9419334061ce
MD5 34d9dbdca5e532df6ebfd9936688a834
SHA1 3f7fad6a72b7efe5ed610f493a66f7f0da3ff09f
SHA512 75071c21e533bfff2edd8431b9b9c1dde729eb10e52a370125363897fedebc856047fb25eacb9e4b201545bb9f66b03422f7aba66ea3ce6750236eb0e3baadd4
SSDEEP 12288:IuVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:IuVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T193C423A5CD07846BF37E06B4CDE093DCE6289F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 2f1d11e202096d3f33bf7d96664b3e7796e646f4718cdaecc70ca12a17b48fa6
MD5 d2eca9c787a13ebd79428c759041d573
SHA1 cfe36c1a8d1067b6f2eb53b78a4ab8efd1090d2d
SHA512 ca94c5398c0c72b66422b9d50d05de04fd83a25b48f6ffd3ebebc00953b507a7b49ad335d87a4479b131ef08ef5973f178ecab93dd72293bc2c27c2a46e0465a
SSDEEP 12288:DMVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:DMVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T162C423A5CD16846BF27F06B4CDE093DCE6289F44A094CD6AE2826E1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 14a77be85b922f967f21bdc2a0d307a72665942b580a62bd3518e2b476ca0799
MD5 fdaea4b70727c3b8cb67bd8812a9e9e3
SHA1 75554d7e044b3c5296bdbd7c5778b78accbd09f0
SHA512 4647fa322a1bbddcdf7808122575032c3bdf4ec44bc68ebf928495df95ad4667431e165c7de0d55f05f9239eef8fa2feffdb3ac0db057d405aa299f31eb1f3a4
SSDEEP 12288:5dVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:5dVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T15BC423A5CD178467F37E06B4CEE093DCE6289F84A094CD6AD2826B1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 45ac2a504d7d9a8711e7306912ec90eebbd17d24c4d797a24d9005cb5e8ea5b2
MD5 4f2769d4eeb789799fd4fcc66678c015
SHA1 df85cbf478eea807f029eb1cbc6d17c8c42340f2
SHA512 6e7e7e63e09f73fabb98e83f2fba51febe28c428bfa95378d42b73f30ca2b42303801b0843e90c910a39c96e6856500875518471f3be08a77fe02b7e1e3cd2e7
SSDEEP 12288:mXVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:mXVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T11EC423A5CD07846BF37E06B4CDE093DCD6289F94A094CD6AE2827A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 609d517d4a67b8a184ff8476bdecfb22121eb28c566c5dcb370871ba1b7f409e
MD5 908c607da6593158d4267d8a4d3cdcf2
SHA1 75799dff39ecbdeacb6fd630ff464e8a1629ae42
SHA512 acbd8f4caf4556181f84aeef98a2565f2fc3ca74270f087d57f25d3e60d3bd35ea7d2328d1b4b2154a94cf75f13cc0d6787a242407f9b38bfd7b3dadb317f938
SSDEEP 12288:SuVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:SuVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T158C423A5CD07846BF27E06B4CDE093DCE6289F54A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 ff4ba523f3f652c4c79d43233471a9aaec0d486273e9fa5c54f0df32c326a301
MD5 d73bd47bdffe817831de81d471aea7c8
SHA1 1f97f5979c09efca874c5b5a53ec066f7195286c
SHA512 0de01df9a9d13532b0b4ab9e0d1f2f420bff831025f9855e9686959c4bb1ba6dbdbb11a9c2dbfaea2fbc6820dfe286547ec2e6978107ea9ae3e766cde8609e4d
SSDEEP 12288:UPVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:UPVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T130C423A5CD07846BF37E46B4CEE093D8D62C9F94A084C96AE2826B1A7C7C85D2432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 d7fd1aafa7b0ea46339bb18a81011790c9b409b8353951c17979daebeb460e9e
MD5 be3c55dbca9f6c987b8d8bb364aa23da
SHA1 56973b494fd8dd01cb7bcf48861a857eec7acdc3
SHA512 7d581cc87461e4ed80f88c238e34779e2474bbaf4ccdff201d5ab79ea0605262d56505f180438cea739e218ebca361d23d26b82ff396c0ff52dce710e00b591f
SSDEEP 12288:SBVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:SBVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1CAC423A5CD07846BF37E06B4CDE093DCE6289F54A094CD6AE2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 3d3d5187d76af030663a77ca3b32fba0bf15b7379bd998264c66f990525e6b57
MD5 9e312a64b209373d8cc5fb12c31f1cbd
SHA1 6ecae458a37d9410e9e0c7ed88dd2e274696eccf
SHA512 1d009c4c0cbe7af5e4c4020e2f0f1d72d49bdec2cb959bbcf770253bfca9d7b6972341a5670028a2143d7faba40e835c6fb8120d7667f39a79629bc6837ca879
SSDEEP 24576:TfwvUk9RX6wkyAI7VXXC8Ac2YV3swxhZPegenZPwC7:JMnYIhWh4sCdegmZz
TLSH
T12B35CF29EBDC44E5E1B7923C89B3464AF2B178581B31C6CF029A536D0E37ED46D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fb20983361ed5b9ab6e8654fe71ab2c1d931dbff381da173f063b863e9406133
MD5 797292234fc663d6732a5951be1ddb8b
SHA1 bbd6d514f8997148facfcb0fc703042cf8be1d23
SHA512 de18a53cbdf40b6baa5248e3bd325e53e35f1c11626cd4979fc56a8444a3159dfd49a948fdf590cf6c6964a5336746d101d974dd07dec69b4463356ddf5b8697
SSDEEP 49152:9YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0UWh4sCdegmZz:QySzPMWIURZz
TLSH
T181066C96A16801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1202c6edfe1062c4cf5603bf824b87584fe449b7dfa934805659ebd8ae780769
MD5 9098b1e885f47efe19dfcf6e90af1f1a
SHA1 eecaacb1c43aebcd78e13db1fab0209e2e2300ba
SHA512 9d8e66b338610e84a373fc9f38c7d9dccc16ae1cc52f3970d4f59cb8b3ef6b30e84606008f3b31b047150be66947a276204b818abada0931cdb2e439791d9e3f
SSDEEP 24576:a47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY4VXXC8Ac2YV3swxhZPegenZPwC7:a47JUQjTirIhCnDHUPfF/EWh4sCdegmB
TLSH
T1AF65AE1DA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 45749adc9d4881abe4999f01d06943c07a362dc6178bc10cfb38816dc1a9cbf3
MD5 187c2098a65e05fa06b7b547f021f5af
SHA1 4aca53947154ea6355cdf6d75992bf03bacbcb3b
SHA512 f1fea1ea12c87bab929eadfcbfefd69c90204e47e99b0a2b641e39835442e0488a841562e4b9b46ad03c44c00c2ed34330b987ac434ea434086840454b452447
SSDEEP 12288:gbsfHVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:HHVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T17CE4F05AC25801E9D16E5278CB918684F3377D6493E0D7CB52C0FA3E2F395946CEAB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 68f5b3902cc851e77762c1ad62297760ba046510472d520b54add3b679070065
MD5 c4df30f4b8d454f519cb90156273c2c9
SHA1 70a3c103f7696432eeb64cc78bdca290e31c0603
SHA512 7e95c6dee83cc2b5b4bc030be21c680b95fd20621de6cde69de3c3e46b6ec1b239c5d35044c3a20ddda4d0df808078b96d71ad6a1e47bf0c8e4d98e15e7fc67d
SSDEEP 12288:+a6fkU3fAXFXdLetrRTazZgtXtlx1/d2iGdz6S1b2y3:+a68UPA/etZoytXtlx1VTGh6S1D3
TLSH
T1694528407666CB4FC66980321E37D5CCAB707C51EE84AF0773C9873F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 08f256890b7ee2d860257bcb025f0d7b031e943be7ffd2a01533a8700b2efe76
MD5 042b24f60a9429a7ea1cda3d24a93a34
SHA1 a85476f5fac8284a5259c88796c4d0195697c8ae
SHA512 196fd3c25afc938d3b6f2137921d86188b07ee37e08e2da82190c2bb526f24d094af679eed601918d1a3636832e371b130e18cb7e9fe6fe7443e8a1abd22561f
SSDEEP 12288:CkveA8oqc9h6rrrcCr8XcRkvXbhA/mEx/ov0fbW7rds:COeA8Xc9crrrcCr8XDvXbGbov0fC7rds
TLSH
T15F75F9405537E78FC2B760320326AB8C77A4EC5BB6456F2273C9493AD86BB1594F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 e85a77c746cd3f35a3483731672877436b65c2bf70be032390ab29dd27bcc294
MD5 a3e24606c7d10a74f41498734bbfb4b9
SHA1 7291f3ff348e150b863bd874ae69362a5bfcb114
SHA512 3fdfc7396ee3a78a682e7f7b807644a2dc57845e271980f4d4775ea33e1bd3743ed57494d5186cc9aeab078c3c06dd71dae5d23649c9bbddb1778afd18baae97
SSDEEP 12288:wz7/VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:u/VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1E4D42361CA0A8827F67F0674CDE4D3A8A22DAF545744C9EBE1417B1A7C3C8D96C32637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 040d68e8d649389de61680d6f0d4f56531aeff163a8f160f3fe33d6746b43d44
MD5 b7cd6b42c8422de34494adf67740c330
SHA1 d561bc225db17d499f3024740079c15b6c3088d0
SHA512 9d47f932a2b533bab3db91e13eef5853af59a4883749ce95e75f21cf2fff27e0ea9a77ffd608adc5c3342f1692aa3e0db1e2c25101ed6cf8cd1d95c2a601573e
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bYFVXXC8Ac2YV3swxhZPegenZPwC7:Agb4mBIBhGF2Wh4sCdegmZz
TLSH
T14565AE1E22EC02F5E0FAD2B8CDA64417D6B278161731D6DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 d3d9dfaf6173cc10fe8213b4720c1aa8885988f8472e7db210b3c457b81e8aaa
MD5 4bf8f48f72935b57cff8d34e9e972a4d
SHA1 2cda3acee25efe56137aa39a7253f983fe808570
SHA512 8b87fc9a2decd6191edb278f0e2f95702e4a0ea1083b433a6517fcaea07a002cb3fb520a531dc4c4ea2ea515251f4a791193bb1e5b723be04ec36023c5331ca2
SSDEEP 24576:nG88u8FpJqH1bzria7/moVXXC8Ac2YV3swxhZPegenZPwC7:G7ZFPqVea7/nWh4sCdegmZz
TLSH
T11235F165A6E101F1D47BD138898246A7F6B1B8250364EFDF07A88B551F33AE50B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 78b0a952ef670dcd1f8c766d604056a87151a54e61bc783dbed6bd7b9da7c6b3
MD5 ca0c38d40d4c246fcf65fed71e69e8cc
SHA1 d2c7b56bf192119377ec38600b70adbb634ca3d3
SHA512 c9e9d3bcec13d2d9b8982f9936bd03e7191b0f1ba90cc9817dd1a5ae715a2cea0eb3ca7fcddb3d3e76203dd358fc9ad89353f55dff31dfaa69f1265e9015fb7b
SSDEEP 24576:lPUr+NQ0VXXC8Ac2YV3swxhZPegenZPwC7:lJQCWh4sCdegmZz
TLSH
T11305E12F66A918E5F67AA17C8982870DF771B8611311D6DF02D0813E5E37DD8BC3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f1aba7e527e61100015b3821ed3c6297847e782d4352f2e77e99cabad87074b0
MD5 fe129beb7a0434fb5ac22c6e1751e8b2
SHA1 2dd315adb3fb574684e428c10db9acbb06d45bfb
SHA512 06772f3a10e05bb122349b5bfa1d9d83ea9704f22cc034f50fe74a3b7265b83f2321eea54e7bb6c9c97df764a843a3dc50fbb738bea2597d3fb19e99aef54145
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSWh4sCdegmZz:uG05lO43bJWIURZz
TLSH
T1BAD5C06A62EC11F9D1BBD17CDAC6460BEBB23815033456CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 62285c144e935d079bc9ef0aae5dace3e6894b69cc8a373954d0790fc0384fed
MD5 ca0cb28a54ddecc71c08ca453c57f7a3
SHA1 223ae90c7726eb132647505459dbb3d9b1c49619
SHA512 e0e23d956d993af7c1a302a90e4fb31bfbd90122ecdeb0c813a0db751b528fb220cfd49d073be9bdbf641e127e3156f46ec9c25f027cc11808a7109d1218a3e2
SSDEEP 24576:Yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnCVXXC8Ac2YV3swxhZPegenZPwC7:ga5POZ3BJt2pasx2+mqWh4sCdegmZz
TLSH
T11D65AF5EA6FC00D5E5B9D17DC583861AF5B1382553319BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c826e2a1b556184b3fa59004ca5389be45b578cde163df4dd74228aaa2549097
MD5 48da6f882e5b1729a56bec6bd7233b4d
SHA1 d43702f12fbcf3b365dcacec0cc3588c2a6b7ec2
SHA512 1f896922623738ddca16f2f5cebd8a06156c0b59546cf5d121b13c75bd20e4dbc2076903d1fdb3323ec3c911aaeca84e060211920fb989c7c97d722f598552ef
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkwVXXC8Ac2YV3swxhZPegenZPwC7:5Nc/zEOVHFHWh4sCdegmZz
TLSH
T148857B2622E901E4F1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6d222172f9dc51610cec6c70e3315a4817d237617d0a35ed7d1c11fe045f7a66
MD5 daf5460d3dd33bbb0320dda5b430104c
SHA1 1447654322864643ccd1800e5d638dac83e88c4b
SHA512 666958d02a2752369dded14f56a98c2e90f1435bccaa090d89221af5a397fa6d89c8b9627b3ada8434dfe5f3002715c3e1d53818e2b44978925eb21c1d34a6c8
SSDEEP 24576:9TkNvNnaFeYhJNtmZBm2VXXC8Ac2YV3swxhZPegenZPwC7:9TMwBtOm4Wh4sCdegmZz
TLSH
T1B055AF6EAAB845E4E1FEC6B4CD238512E6727861173293CB5390C13F1E279D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 d21ebcb19eff987aadaaf0064490b4e85908c143b58ed64a1ee5b1a7cc87d4a6
MD5 7abf66a60f0832e2c36e4fdd05bc31ee
SHA1 b3bc4fb817729e1d2c8eea3bf56b608af216ae84
SHA512 b2a632293434c8e63b8c4c2822fa062ec1e39482d54650e6093851a98538bb062a3f859f397c5083ebdfe03abc0a5c1846f6aa6869897f4682e643e425cf03f6
SSDEEP 24576:ID3FHshBIYQgADVXXC8Ac2YV3swxhZPegenZPwC7:IDVHeBIAA5Wh4sCdegmZz
TLSH
T19525E17DEA5D04E5E57BC1BCCAA38606E77138A9032159DB02D081BA1F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1532-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1532-57-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/1532-46-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/1532-38-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/1532-37-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1540-83-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/1540-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1540-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1540-77-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/2296-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2296-126-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2296-132-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2296-135-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2296-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2808-305-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2808-49-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2808-52-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2808-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3148-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3148-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3148-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3148-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3412-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3412-15-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3412-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3412-20-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3620-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3620-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3620-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3620-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3620-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4176-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4176-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4176-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4176-312-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4176-101-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4176-107-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4592-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4592-326-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4592-94-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4592-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4592-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4620-76-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/4620-1-0x0000000002410000-0x0000000002476000-memory.dmp

Download

memory/4620-7-0x0000000002410000-0x0000000002476000-memory.dmp

Download

memory/4620-0-0x0000000000400000-0x00000000004EE000-memory.dmp

Download

memory/4620-6-0x0000000002410000-0x0000000002476000-memory.dmp

Download

memory/4636-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4636-307-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4636-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4636-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4820-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4820-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4820-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4820-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download