322068786202836d8284400d760fb599ab2115ed81f5552c05f091caea1039ca

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.7MB
Sample261102-phhc7afa38
SHA256 322068786202836d8284400d760fb599ab2115ed81f5552c05f091caea1039ca
MD5 a9377d1a1a803c5387e4dc4c711642e7
SHA1 069d1c672206d3050ed574924f70e651dd4d3cb8
SHA512 56757cd8e6e85540c64518e48e8dbd46101affe0675cd195611b054ff1580e58d2c558825d8a05a25e35323e49b2ce85da1d4b05e7bb72b99bd8733a676fd575
SSDEEP 49152:XNZCWOLT4WXGQ6m6K2MtENMCM/XxvYT/u1XMHM9:9wnLTbGQHkM/XxN1cHM9
TLSH
T153855B0667F95128F1F33B71EEB992645A77BC71AE3AC50E6280125E0DB4E50DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
45	4740	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Executes dropped EXE 24 IoCs

pid	Process
2444	alg.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
5884	fxssvc.exe
5644	elevation_service.exe
5368	elevation_service.exe
5204	maintenanceservice.exe
5772	msdtc.exe
5452	OSE.EXE
2036	PerceptionSimulationService.exe
5572	perfhost.exe
5336	locator.exe
4300	SensorDataService.exe
2632	snmptrap.exe
3476	spectrum.exe
3676	ssh-agent.exe
4372	TieringEngineService.exe
4108	AgentService.exe
1624	vds.exe
6100	vssvc.exe
4888	wbengine.exe
3792	WmiApSrv.exe
2424	SearchIndexer.exe
6072	Reader_sl.exe
4144	RdrServicesUpdater2_x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d4d06e5e4bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RdrServicesUpdater2_x86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RdrServicesUpdater2_x86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Reader_sl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Reader_sl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater2_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004309eef2c56add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac2ff5f2c56add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000706a2ef3c56add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000054bf3c56add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000468f35f3c56add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005960e8f3c56add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3f318f3c56add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000304670f4c56add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020b55bf3c56add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cdd43f3c56add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
4144	RdrServicesUpdater2_x86.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
3288	DiagnosticsHub.StandardCollector.Service.exe
5644	elevation_service.exe
5644	elevation_service.exe
5644	elevation_service.exe
5644	elevation_service.exe
5644	elevation_service.exe
5644	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	5884	fxssvc.exe
Token: SeRestorePrivilege	4372	TieringEngineService.exe
Token: SeManageVolumePrivilege	4372	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4108	AgentService.exe
Token: SeBackupPrivilege	6100	vssvc.exe
Token: SeRestorePrivilege	6100	vssvc.exe
Token: SeAuditPrivilege	6100	vssvc.exe
Token: SeBackupPrivilege	4888	wbengine.exe
Token: SeRestorePrivilege	4888	wbengine.exe
Token: SeSecurityPrivilege	4888	wbengine.exe
Token: 33	2424	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeDebugPrivilege	5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3288	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	5644	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 676	2424	SearchIndexer.exe	112
PID 2424 wrote to memory of 4508	2424	SearchIndexer.exe	114
PID 5048 wrote to memory of 6072	5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	123
PID 5048 wrote to memory of 4144	5048	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:6072
- C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
  "C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe" R32
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4144

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2444

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5236

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5368

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5204

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5772

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5452

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2036

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5572

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5336

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4300

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2632

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3476

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3676

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1624

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6100

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3792

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:676
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 1.5MB
SHA256 f19322102f369c23b318c340ba010644e99bff3b8e68063ad6c7543b69fe42c7
MD5 5eabc8eac17ee88a5881d107bdc325d4
SHA1 c1e736be8d118a31c84ab7557e3e96a48732f449
SHA512 8a5d3638f2f7d05b7fad3c9880b7031e651bcfe4f1fce9745e545093c10fc4535ce2bdc1a4328eb75af4924347d19b0dcc9f16e5ba45f98cec397486761f4848
SSDEEP 12288:uFt1VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:kt1QCBq/McxvN2T/u1mWXMHM9
TLSH
T1B465231F7ECADB93D60287B2086C57BA49BEEA34FF8442F36700167A1EB44D2583551E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 589e13424dd329f4c880de695291129107bf7f8a971490e0a2c0cc972473081c
MD5 f3ea2dd02a7987262518f707c8600af6
SHA1 d9cc6beb6da7e33c1c60b0f95684bd40eab756fb
SHA512 db619f0fb647c0fff45dfdca98bb38fa025353ca0f11f36e53befaa6b11cf35a76547ce3f95d492aa238457ee19fbf195da85ca198432b13294ca451dffcd4a9
SSDEEP 49152:nSgouvAeFfenxyQTXS7uQ0NIYCM/XxvYT/u1XMHM9:nS1uxaxnS7ukM/XxN1cHM9
TLSH
T1A2855A0267F94129F1F37B71EEB993645A77BDB1AE39C50E5280125E09B0A90DE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.8MB
SHA256 e03c7ff4a346efd7b6e1c33b1fd568e638c3beeadc31a1975e8c4248bb2bbbf5
MD5 7c2aaa2adc54af62f100f5cdb7762229
SHA1 f3f1a25e35caeb84c73d77fca39272b74ab3ff00
SHA512 14e2d09a413dc402a57d810075f4d83acbc922e2a276fe0ede2d1cba929bc56bcf353549b7c67b5ea7e5d495d06f224bdd11064b9fec938519b11f242095e6f0
SSDEEP 24576:4HTAbD+OmehQCBq/McxvN2T/u1mWXMHM9:4TAGOme+CM/XxvYT/u1XMHM9
TLSH
T19F95E11037C0C135F1B329768ABF9738556DB9715F6881CFA388167E5E70AE0AA31B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2bf4dcf8a6980dcb66e7cccc2baa0032e7b6122bdb866eeac547bceb4dafa2d5
MD5 4fe4b38c20df2b082b9ce485e162dfed
SHA1 d7a548cccffbacb9a317400e68680b99ab7a0eb7
SHA512 6157cb489f01bb9374ace5af16e854603553321b2840109c37b0089a05fadf00593bf91e23ae87cabb59f861a87ea7024882ce392d9c3d10b7ceed5e6375533b
SSDEEP 49152:Mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnZCM/XxvYT/u1XMHM9:23q6HjBnM/XxN1cHM9
TLSH
T1F9D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 7652724f009b1d75b45e0d2b23bba887247c19a1672e4d52d78de2cb7bb14fe4
MD5 811a1d1701ce1a89863a46475dd75c8f
SHA1 d987dbc24cc05027c52948b649c133eaf2a40234
SHA512 ef6855029958e666eb9b131b10e7781b39c1fbeb0fc03fe6dc7846fe808adef9ee4728240522942b3e5f981285dfaa5d4984529787697ef580abbbd7ec39591c
SSDEEP 24576:GXYfDtczA/QCBq/McxvN2T/u1mWXMHM9:ltcXCM/XxvYT/u1XMHM9
TLSH
T1CF85012CB7D408F9ED678279CCA28512EA33786447A0E7DB03A499751F336D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 ce2d537b2d7ce0b670d5952502e0e173d40d2b23f8765109c1909ee6b87ee570
MD5 01e652fbb8ffb5f48eb405a28bf261a4
SHA1 9167e787607e139b711b3eae5a9d60498a181402
SHA512 715ca5de5ae3877fd3af194fbe59a46e2f57ee930c31158f009539ea157654b8ad53417ce626254aa7caa5c980da736ee2826c9b6344ffe91bf849b7586246a0
SSDEEP 24576:k0Le5ji0hmxYrM0QCBq/McxvN2T/u1mWXMHM9:kPji0A2CCM/XxvYT/u1XMHM9
TLSH
T19E959E16F5788335D073C0B9C5D2A69AED7130865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 18fdd5627ddafbbd9634ede843eede104d33af7a20c124b789d9bd3ff550ab82
MD5 6422b57997bcf8ae1ac0095c2457769f
SHA1 d906d451bb4fd5aa03755acdeb29a2134f9160ce
SHA512 172a363c02d835432a2b3da3fb5d12946c8ffe5525031e6db122e11394f1746955ac2042a725f4605cd9cd72651a413bd8e89db8340c8390f1953ef1ed3055a1
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyu2QCBq/McxvN2T/u1mWXMHM9:9/ezSC6vUzPvxHjy2CM/XxvYT/u1XMHK
TLSH
T174756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e69188d7e78dc86e09376551a4b668c2a586156af48b7f6f11855f0b6e0bd3a2
MD5 3035665ee0edd7a40e458464f2104d61
SHA1 1c5b8332f3d2bcb522152e48a9934bbe17ed5ef1
SHA512 19a492b060196d1b6515b8da62df38cb62eb481742364f608369572a2e4d3a8e7024d858f590bbd87c8cd010daafd73cb79ccee2f31490ed1800be71640d24e9
SSDEEP 24576:jVbqPb88hv/l+6TQCBq/McxvN2T/u1mWXMHM9:jVO88hXl+FCM/XxvYT/u1XMHM9
TLSH
T147559E66F5B48331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 2650f9e9f2ee6d498f8741543558f8ed5b2f078c62bf96e8e16c2b50488cfe73
MD5 14d6d4e5c60d03d1a735c7cf0bf968d9
SHA1 3d6ed64657bd5a68447f5bce4314636b946dcec1
SHA512 8f729ad1825d8e8a63effa67acc480a6003e14cc8842db2e22172e4bf36cd9f3d75629f8e1a3e2cea947aa118c69ee2a35cd5bce77feffe3d1c4e722fc2cda73
SSDEEP 12288:wHYVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:wHYQCBq/McxvN2T/u1mWXMHM9
TLSH
T14465231E9CCC96D6E7478BB348AD5A7B0E66BF78FCC484B1A5103AF41770CB2D429909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 27fc9c784e7f30e2591ae14df442e42d67f9cb03b05b33dc08c243cb58ed4217
MD5 e8ecc4cefd0e176555a77d301bc200e9
SHA1 a2e86012c292ccdc2c2230e94e8527ca796046af
SHA512 5de7ef688d4ade07d1fa4b3893c3c9d904a3f8e38a4114c0f7e730d18d6e9d1ffe324af1d0b0eff8825cd50501a56a4cc452df5f30a37e54b1bf9ddddac22a26
SSDEEP 12288:PeBNUbTVO86ULVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:PJIULQCBq/McxvN2T/u1mWXMHM9
TLSH
T11385CF3BEE68FCD2C27A8DB95A918740D77278304F6193CBD164820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 058a044cdb807f6796396132d774745221c080ebe6eab62d22ef5f55cca35e6d
MD5 9df8cf84a4a7f11b8593009b981c159b
SHA1 ecd28d9cecdd7833600877aec0a7b566faf456e1
SHA512 eeca23e2d1fb55a5e4885c5f8e2d2bfdee2525a664293b7e187b49704d5f32e89f413c1cf774c6f5a05afa8a3ff9abd1cdee48b885bdc14c2aaa11f51bb20d0c
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:vQvGAdlCEL8c/yRNw5CyM/XxN1cHM9
TLSH
T1C3267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 c69b2f61e30b296183c9db89308d6104e935927f8ffb965aebda95f5a671dddf
MD5 c3102d363651f5574ef19dbf9fbf061a
SHA1 53aab67252843d79530569ed1d50ece7fb62aa9b
SHA512 7b74bb98412e4d4178d17820e2f82c3e56bd153bc0d5a796907db813a0289d2b82a6ad8a57bc60c3dc12bb2647dd04093a7a239da887a890c4196b9f97d1a39a
SSDEEP 12288:JAwSfxL/2Dc3SDLLmt0LDQewsAjdVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wx/:67ewsAjdQCBq/McxvN2T/u1mWXMHM9
TLSH
T1A685E031FEB4E436C7BB0DB21B26C716186DBA204F9119C3E3A85E9D5A301D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 82e4025caecc2f1e766a430a698fdea4efa6a18d3bb0ef5723421119f455d4f0
MD5 8d3c24acb6ad1e299f8469dfb0854c0d
SHA1 7751fdad5d6e37cbbbf8aafa8d06e07d40b0c913
SHA512 a9f6f5c4309d38d06a0ba2078dbd71211bb0ffd0e5c3032e00096b65d4ba238bd9374516376e59c759f1f25b2b4207dff01fde0d8926e29c55183b02216dd6aa
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH6fyHK:/UEtQevvqc2W1cpV2EI32syHK
TLSH
T114474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 864051a126743467974b48d6fe00be00c33718f37c69e867e82df095c74a8584
MD5 daf7e19fa5068163270631096e31e996
SHA1 f47032c1844974e50d0b319868a01fb516b0c691
SHA512 f5b837a3d374e7c9d4a7e86f2f269336d4e1542e3ce7c1da7efc5b118c70c040b3edd302b26e18994a67f4ea4408d4fb65bf4b1e2fd819d2cb3c123896fc7d3b
SSDEEP 49152:RCbRquA/m2yL5zLfFiV+XenmE3/zSCM/XxvYT/u1XMHM9:eoq2VjnmuM/XxN1cHM9
TLSH
T1AAD58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 97a2d0e70bd9d5cb5bf4c740ec9b5776468c40f28211fef816070847854e3f2d
MD5 2adbf34376a4b6d1d52ddb3910b3310c
SHA1 a0a19ff203e9b274256624955759c33492de5e42
SHA512 8f9455800147523eadb55a29ba972026aab7855d48428cbdc15640e4ac8d4a5b2c4462ba635e5d11d404263eeaa876a8b898cb1a248352f93874acb6ac9d9cc2
SSDEEP 24576:sAhGLJIFoiwtA5l7S53yQCBq/McxvN2T/u1mWXMHM9:sAMyFoiq5bCM/XxvYT/u1XMHM9
TLSH
T16F359D81EBF955D4F5B3AAB899B68171EA76BCA95E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 e6ed7f7ba44f99a3ea42232414161ab0add98107a869e49ddf3106be28f4035a
MD5 acb5d828fcfd6a3f55576bd56bf95af8
SHA1 390b147e2507782f2b4d188db23061bd0090e0ab
SHA512 8f1cfef48145fbba0034e25a447f9d8671df6bb9ca27b561a16fcc3919938229e841a7873895d77d20831aff022a0581590842905fda28d73b2e2f071acd5d36
SSDEEP 12288:lmw5HEjsChNzBFgl0WDm+CWVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuG4:AwuSOWJQCBq/McxvN2T/u1mWXMHM9
TLSH
T15D85F14A76E81CF9EA6782398557C136E7F2BC113A60C71F1760C65B5F33261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 4d7208b65a0039acf04d7930e1ab61b89b72b7ba40ab5eeba13e9db6210f1442
MD5 7825110fc27f57e9888e1f52bb7ca5f4
SHA1 888b7be9fcfac674acc7b29f9891e76521580bf7
SHA512 29f3cf0595a5790484abf2c3476197829e99ed83eaf5127b5a995b255070a8b83d20b30ca5a10af36f9a596a1817270fdd9e23f70b1515966a28469494a038a6
SSDEEP 12288:CjZ1IyNVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:uZusQCBq/McxvN2T/u1mWXMHM9
TLSH
T1BC75125E36D861F9E3938379C8E94616DB7278756BB083CF162002B92F32DD25D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fdcd8bb8e20c35172cc47fc41b3e84b9a53097e7c7e75f784679cb91913e5156
MD5 9cc0d7e4a04a77f3ef18c66259c83c53
SHA1 356bcc826781ecc73d40d7e8c8607a9422845525
SHA512 7690afb0f2d3c9a119f4a97ac731458b51634cd99f8b781182c40815144f068f92fa62169ffca66c92d9fc57ad762ac391fdc149cc2597de0d55159e162ab458
SSDEEP 98304:5QRQyi36YOcPQLvw2gAf+PN3LM/XxN1cHM9:wQyiKayX+PNwfyHK
TLSH
T1C7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 71c9d5ce164a8b9487904bd42eb271427655e8acd9a0faa652eee6c0cae6fa39
MD5 17943c892cb077cc16be703be66ca574
SHA1 ace4e65d73a7f91949793ead356a8012c4b4fe65
SHA512 26cf04c2c6ec768380430750ad201561c9471726526cf3d7dd2098b44a615fa4a6a6aca4df900c603be20021333a6d8fdec1950e2a8c8be4e612bc1e24b2b959
SSDEEP 98304:KQRQyi36YOcPQLvw2gAf+PN3LM/XxN1cHM9:hQyiKayX+PNwfyHK
TLSH
T10A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7b133358eb3edc526462f32664e0c84c964ec95cf822111993b6624b3dbd5730
MD5 b1850717b6e7f0dc501a98dfb1b39764
SHA1 9649df3c49a35660d3a7b1252a9a887cba03ac21
SHA512 178b72474d761994aa9bb26798051575de4e8224b69686e7173528d6fed1b9721d781f0eefb0e00dac5e2b0cb62ff199d4c7030c7bf31d299b0dc3b43964d0a9
SSDEEP 49152:x68Qg55nhheWu7PNU3/CCM/XxvYT/u1XMHM9:vthWRc/9M/XxN1cHM9
TLSH
T195B54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 654fdba75bc7aea2e3b46ac1d8f52b5ce82c153a0e14e6f49e4707cdd1bcb0c5
MD5 48947a5797d7180f34a221c09c6b0ca4
SHA1 4a340f48a19628c11349a40cd7b3888355f88acb
SHA512 fe620e8c72ebb52e989b42f4574b8b8544402419b382163889f6840b381edfc15109977788c03ceed3be2aa5acf426ca3fd1da9417643f1c9dd86847f7576b7a
SSDEEP 98304:uy5112gYy5azzVvL69nLKnhZYM/XxN1cHM9:fLIHmWhtfyHK
TLSH
T129167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d72e6e4f11167c2f15ea8cf5aba887887b41a3903cab5cb130fed447ad6acf14
MD5 191c14ff946afd10eba323386226a990
SHA1 9c77ab78b9aa09fc157dc01ae65e41db8964c384
SHA512 ce855431594c0977851126af72b159331f586da5dfcf6d967ff1e4892097302cd87d03bbffdc064e6a7fad37444a93ace02ef1a2fe5a75ec109e8ade98af9e28
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glICM/XxvYT/u1XMHM9:Yu6JmVxd2djM/XxN1cHM9
TLSH
T16FD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8691cb71d232c94b4f0dceabbb3e5b9acc7163facedf0ab40bb471e7afd3d387
MD5 2ea39df2e0a933b1a0591b9af6e18009
SHA1 764660f79aa9c466ea34d93bef108b15d7a4f770
SHA512 55c7af6f5ef541a9081572f44fb7c53e8888d3312dd1eb914341067717b632c14fd28e2b91e6fc91d9db677c2eccd3c8945e9001ad2ff92dac7df9a157eef044
SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4x8CM/XxvYT/u1XMHM9:WmifPbRuM/XxN1cHM9
TLSH
T1BDB5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1a4fd213885bb519abc5d1571ec9854ab60ee7d157cd9bdbc4a4132ac5978d5b
MD5 ceddd1c9ce769b834e7d943cf86ea8e7
SHA1 856422046e7338859a046ea5b6301c6b88951973
SHA512 3ac39bad244a673fedf1f5e8b7e7db6933579ba89d0d505a21f89e0e1ed8b68f71613915d5b5528f3dcf30e9b7e726c3cd2dd8d20550f8944e6a4b39d282e3c3
SSDEEP 49152:LSuZQIY0Be2KRRVtOnks6NMHqJCM/XxvYT/u1XMHM9:Z5dKTi61MM/XxN1cHM9
TLSH
T140C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6cc2b8e9f474957c1239479d9101e2f044976c7b82b55abc2268f736884ffe10
MD5 bfda21683e588d8df582a054bc449741
SHA1 c7e62d2097c44e12c2dc6fc0b683aef3325b4184
SHA512 fe018c186141d3dd08dfd93fb6425650a583a76ce8d8b2383f73fea9215da3bff8845de1e655cb1d5ff61e22fda13edabd40dfe3172b7912c442e79d9336e9c8
SSDEEP 49152:XhtSn8EApI0figngiDn0AP5w4CM/XxvYT/u1XMHM9:GX2iyphaM/XxN1cHM9
TLSH
T1D095BE13F2D901E8D05ED174C7468632EA62BC150B38AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 4c4a54e973a08a118c92d3479b54a9062ced25e19cb02995aefb66ca5e8ffa27
MD5 c862b8898e323549f12f41e7edce11c8
SHA1 657a5533d163a8b1d62b25325d0a86c142789834
SHA512 8cbedd56974020e2d13baec21c207f3a7bfec335608a619411f423864fb9b85bdd7fe19253eadabad3e5ec080c2595660319778d7cfeaebbdbb436165cde8305
SSDEEP 12288:IwVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:IwQCBq/McxvN2T/u1mWXMHM9
TLSH
T16365231EACCD9AD6E703CBB3846D16BA4E6A7F7CFED480B6761421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 1365fe0abebe75919c49c0bdccc70ba2712a82440083f823392434ef0c9619b3
MD5 42369cc32cf7a27cc2050b988a019c37
SHA1 67defa042c33e879963058b2d52a1396c79801c2
SHA512 5de513f78ecfe15e6698b8fbedd1477a2d3a207b5edd40b13c2714829e8cbb0aaf73d12af8433fa5ccad1dc29ba206843a91c518322d6aa487ad800584de6464
SSDEEP 12288:5RVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:5RQCBq/McxvN2T/u1mWXMHM9
TLSH
T14265231EACCD8AD6E703CBB3885D16BA4E297F7DFED480B6761425B02770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 ad7bb0d5777d1615b22c8a59d0e58738325cd4788d76c5878f0258096f0b5a93
MD5 59d1a0abac0938e16b5b096cc242716c
SHA1 f2ac3c74453c46f3b46172376c8a5e39a6be7927
SHA512 d1f19de3c2db29ac00ce5dc1324ce8da36ccc85a3a619542cbfb7a067045e03f2c0b3660ad22371482f663e39752e687ae95a9d5c01bca7510a5cd2d14eda0aa
SSDEEP 12288:UjVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9v:UjQCBq/McxvN2T/u1mWXMHM9
TLSH
T16865231EACCD9AD6E703CBB3845D16BA4E697F7CFEC480B6B61421B42770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 0d5380d1dc854db5179346b18d60d83934647bd807786c0cbd070639e4e66a17
MD5 7d2784e656d1bfe02fb3b13d3c3db180
SHA1 860bf1df38ce9b5a2b3cf808a100717d96f97209
SHA512 4f016b3cff544ba819348ac2839e1f5dda8a21494069707b5bd53eb422024411c826cac9d22658a0a3e58d6b221e270c4c08d8d7f874842e52e99e28daca4eed
SSDEEP 12288:+VSVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:NQCBq/McxvN2T/u1mWXMHM9
TLSH
T16865231E6DDD82D6E703C7B2C86942769E75BE78FFA082EF660015B51F709E09838E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 38f8a764c18be9d96c29a74667c4423bc4a6efa679ce8b6c936183b2e592ec94
MD5 7582900a86b72dbbb96b5980cf24824a
SHA1 af98da918fe2d86f0fe1bf1aaa564aca603a2365
SHA512 32b1382f882294386bef293330629fa9155e43aa3204b20a066a828c0c23b5c4f949421550fbb462eda83bb25deff474257ae2561b735de8cfe5a99fae29d1d4
SSDEEP 12288:l6VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:l6QCBq/McxvN2T/u1mWXMHM9
TLSH
T1CC65231EACCD86D6E703CBB3885D16BA4E697F7DFED480B6B61421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 740caa88d48bde6b27509373027d9065d08dd540f9f306b34bdda5d7b477e8b6
MD5 de1d4de7b4eeb14405b72018e385db1d
SHA1 fa5339193dad294d95aae34ef0cea1c9c67d82a0
SHA512 44bafd138ef115c6ecf36f14f7852b7f5698150803507080fe9a32b4e78e00e71b645599e22b5866d85bff3606b59d878e9a63e29b9755f58f6a64ffac10ae01
SSDEEP 12288:g1VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:g1QCBq/McxvN2T/u1mWXMHM9
TLSH
T1B365231EACCD8AD6E703CBB3885D16BA4E297F7DFED480B6761421B12770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 ec1b27c62a304305d986be75b8b71d75a03693f6d0a165840ef009b012f42214
MD5 a5c68bc658de03a45b28ae0030aee6d8
SHA1 fb15df25e892b3a34eb9dc9e47207a5bbf983a64
SHA512 7a6fc97690f9f70371463f114488f87ff1ec9e5b65b5df1b81ae64a66da2f2aa1f2e09fe2212b273824b4cde04d560d1a3d1bfef8c032357b75ad619e04b88e2
SSDEEP 12288:CZVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:CZQCBq/McxvN2T/u1mWXMHM9
TLSH
T19065232EACCD8AD6E703C7B3895C16BA4E697F7CFDD480B6B61421B42770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 794a2fd75b36f708bdac7e4209f68733393acd05d454c4eb75822c9334a4c4bb
MD5 823a4c7365fce2aeae3afba7358b3aec
SHA1 409e6d8a9b9d59fcfe3725a580973abdbc6949e5
SHA512 0e6f040998caef0446667cf88c6d0bace1f6c01ae13efb3ed8e566faf6f1656fbcdea5f5fe75dbd6508ad1d9726dd1ad4831975fab2a806eeae9b010d8466798
SSDEEP 24576:FZMEzFVSOxQCBq/McxvN2T/u1mWXMHM9:FZMEzfKCM/XxvYT/u1XMHM9
TLSH
T12C850199B39418F8ED63823ECC158916D6B27C295BB0C65F13A436661F333A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 7fc340995158d3de61ca2d739fdcf7177071b3efda8b7b84a8d20001160b697d
MD5 fcd865cd51ddf5da3e0437d46aec2260
SHA1 b4321cf98835f50753c25c5d12ab2acf946caac9
SHA512 da7e29379ed2de9901604afeb90d923202779f5686ace1ebee751b51431bea974c4022a3ac128b9e1fab2fdff3fc26c51618520a8104b4de5fe18ca26c27a8b7
SSDEEP 12288:McVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:McQCBq/McxvN2T/u1mWXMHM9
TLSH
T1D365231EACCD9AD6E703CBB3845D16BA4E697F7CFEC480B6B61421B42770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 a456021e18e7515d8cf17f5eff93377b979861454a5e47fa573896f45dce70fe
MD5 ef8145567776d4526bbf36c0490e65a0
SHA1 ffb4fc9c760238becd147bf0794d026a59bc81f1
SHA512 1282a16e22a816b7f367abb35027dce0f1561531409c52e0ecc447e17598f6c566d987854ea1a3461df4ac25442036666c6005435717a0a5da9a193c19852009
SSDEEP 24576:+cP4mcvIjkGOxhKP2l71nNKbrh/8KBEQCBq/McxvN2T/u1mWXMHM9:5P4m4IpOO67W8K3CM/XxvYT/u1XMHM9
TLSH
T19065AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 e4bd79c7dc7317c251789e23bb1f29bd242f412d76c07ccb0abb6b3e6a60707d
MD5 923cab205490a017ed8b7975a28b3085
SHA1 7081c7dfd44888c4cf2399c56eefea210ef6050b
SHA512 6b40dbcfde4b7dc83382d66d8b8b0b3646cf2f000506caff4877bc2949a81edee47a91877f5e26d1b39930040a92bfec6666b00bc99f16b3a6e54102f82c88df
SSDEEP 12288:6zsfsVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:FsQCBq/McxvN2T/u1mWXMHM9
TLSH
T1C475F01ED29842E8C16E9276CB594A51B7337D349BE0C3CB62C0F53E1F359909DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 100B
SHA256 0ed11d356e7f1b224da94b99c5493bf3c18e203f5da13a427592f19bbc183c2b
MD5 e563fb0914086201b75fc61655d45d3f
SHA1 7b00f3754da22091283d439740c56e7f73e9adce
SHA512 55316f2aea9eec1de6adf0687b8f297060e73cd524a81c68dc70548ee43f34d8b673a20a3d33aadc7a71103b439be92a7af1768134981a5034a520d461e8388e
TLSH
T150B0120333D10428F8102511CC784431633670D4700AC00D8080008E08F4A0052123BB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 822B
SHA256 8b4c88d1e9b91745a34974d925b84570e920ee6475ac19e07e929fa000a76a92
MD5 c97a70ef83cf2b0c14ae39f6236c7f36
SHA1 d688370dadc9a6aa428b2a544e6d239443d63537
SHA512 72133b6b9e8258dbd0d3171f1e525f3edfa566dc5d43a1d3ea977f18d5e641b6cdb3c8b5b2904303a5125a264aad3ad86c0f77014e900dd97e069bcb48c74442
TLSH
T1DA019E832AE91164F5B25F50DFF9947357337CA26C2DC86C90D8420E49E1A80E5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 1KB
SHA256 97340196684f58ef0d2f8c8c4640126d4d18ab3f52f5760fdd71238b0ae62afa
MD5 b6cb5c408e4f6150f11037c7c368723c
SHA1 1fbc627eda626a7df4e86f838613cd73f303156a
SHA512 aabb49cb011c5a1286dc706088445d7ad17f36c9f0db3c7601d5de7aa23b7be00049fc296b525dccbf845f8630cc951fbfe3762e9ef1bd947e2fb0dfdf496568
TLSH
T19D21CD872AE90160F5B35F44EFF9947257323CD22D18C86C90D8114E4CF1A90E1B27AB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 1KB
SHA256 8f6b73bc2dea6b93c2794e7d2faf721c0ca812ca23705ccbf65395414f83a417
MD5 66855f46cd094efaef54ce8231b786c3
SHA1 69bc21af014b98836bb90b86258c96493464fe2d
SHA512 363880349ebe3350fb67135f876257cad831ae717bdd56eef1de1f8e67f17a2d77447547311f15d4c621ff5189f538c5a2bb51173895dabc7d6a95d9e0700875
TLSH
T1C9318C872AE90160F4B39F44EFF9947357363CE22C18C86C90D4124E5DF1A90E1B27A7
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ipmUpdaterStart[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8OSE262\ipmUpdaterStart[1].htm
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp13E.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp13E.tmp
Size 5KB
SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
MD5 38c0245547bc1440fb56c7308c2bb222
SHA1 8ccf6f27b9644fad1c8f13d98e9d680154c8d572
SHA512 78da2e84d0ebb47faec6999320198da63e02f8653a0b0609a16675592ff26b2ecc8de6a3210c31e28b72d6ee340dcdd792207cba96e1ae92b72c07d1d9fec897
SSDEEP 96:HX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yJF46R:3ULc8pq8RuwdmL4pUQrNyH4o
TLSH
T14FC13BA388946C45EC27ED00B4C89A23EDF576591DC0D1C33248C2A58B923973BDE2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp195C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp195C.tmp
Size 5KB
SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
MD5 8de699a7d8a071e752e129d70525fcc8
SHA1 da6fcbafb68dd579195ff775afcf64f4209ef52a
SHA512 43697eaa55d5b7ca68036110d2bd12e01f6fc45fc7e3d4baf99b1de506170707a4eb801d6460dfcdf491fd58bafa3c93b8aeb5e2b36435e5249a2d7fe6a30be5
SSDEEP 96:PX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yh54pD3D:fULc8pq8RuwdmL4pUQrNyh54pzD
TLSH
T1F8C12CA349907C45ED17ED00B4D8A923FDF2B6952DC1D0C36258C5A58B823973BDE5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp20C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp20C0.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp51D6.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp51D6.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4d06e5e4bb6346b.bin

Path C:\Users\Admin\AppData\Roaming\d4d06e5e4bb6346b.bin
Size 12KB
SHA256 3f1dce6cfc4d2ed8fc41043e967c5ccc0c0e0e79e032ba439cc286d68a50d64e
MD5 cf181bcb00ce283af59fce44e7d325c7
SHA1 1a5a223e97e175db1206dfde6ec3984fbd96ebe3
SHA512 5c095f8a51b6696d4cc1a07c5f9ac730932226946c2fcd4c2a801fe62eb9da07be5e5bdb897a27dc8038e135c2178150b9271e78bf7d1cc6b16f0f88dc46a595
SSDEEP 384:mUEsX47Tk1Oa/I65Y8nxJccTmB29wKclR:mUEsiTmh/I6nv19wKclR
TLSH
T15042BF6B65516E18DBD59E81946F032739FEB8C351CE44503380E3B11BE4C2EBBE9C88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 9e586d79d7d8aae3e1c5e3ca34c0e4dfaef76921a76cb29da4e9b249d1fa6faf
MD5 91071c2645d5e7bb65c76d5e43d859b7
SHA1 c13f7e5c1605066b1bd1e3ae2932aca3979754a0
SHA512 b90a08c84c3b049781fda4baf8fefbceb1ea88483a44257f72795698f4fa1ef75364fa063961a9582047bcb7e3c91906ab413bfe4b886fc588700ad0e7de9b64
SSDEEP 12288:XMVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:XMQCBq/McxvN2T/u1mWXMHM9
TLSH
T10B65231EEDDC9A96E7578BB2445D463A1E2E7B78FFD0C0A7B50021B42770CE19C39A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d7d0fee8df0a9dd4dff3f2416a7e1678cd31f9770a235d86fe28813f5d95b720
MD5 7e3452d95c943038730930709bf93b90
SHA1 56af9ccafeebb155c2363424ea31549c7fc2d87a
SHA512 090dd493ed5fa4a5f76a2ad93d8cad441509980811c37fb4971a55d6bf205ccddfb1797c515a5f69986fdc46b8b7c2fc8cbecdfd7460930eaa214de89f8324a7
SSDEEP 49152:la0h2GEkuAe73q3pp46zwwQDCM/XxvYT/u1XMHM9:la0hNYG4JwVM/XxN1cHM9
TLSH
T1D985AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 2308a0121da9c09d899b3aa749f3a53974a807c35735bc1cf56426989998d4c0
MD5 78012f31ddacb1ab55fc8174a7c65d01
SHA1 b944c0d2879ecd30bbfbfe5d29b43eb9e6577945
SHA512 47a40d0a64d26d2046b93b4000b42631cec5bcc7aa6a81b18aa0a2a7ccf3de38e7b69f9d6fe2d730e670076a8c54f4f115ac43e7e68fe880188cb5c8b691fc85
SSDEEP 12288:ghbHjfXhVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:ghbHjPhQCBq/McxvN2T/u1mWXMHM9
TLSH
T17275127E2AEC21D9F272D2B98555860ACB31BD392B5093EF229082790F37DE55C39F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7f6e951ef21de7001315891c548335c2963c0ebc6f9a14127369a9114a99d52c
MD5 91ff452649b32e294bb132c705bdad30
SHA1 5e08bd88ba059a0d07061d09666eb311d68ab2c5
SHA512 dd1bf164a0ec9f45f8a963f7da3bcd60a25906a75522fac9d4d1e01b9afbdf927dfd8234046b90e41d635b03a4d2843e4abccfb36fad46e6f2a9de48fd502a2d
SSDEEP 24576:J3YgnJcRTk4yti+R5dBR/JQCBq/McxvN2T/u1mWXMHM9:JIgnaTk46pBR/WCM/XxvYT/u1XMHM9
TLSH
T14D45BF2EF2B910B9D8A6D236450147B5FB71783D1F209ACB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 4d20cbf029b9b2488299afb207289fdb088ce098b34bad533e100c5d2ea2b9ce
MD5 26d6fca153fb1f7147a63abcbcb10a5c
SHA1 ee7bf73b2e12b9ad3363ac2f83461dd5b108be73
SHA512 c5684117b0583d0a5d97d50f9c713b2de4c46c15940174aa7af4dc1ec3798491849598f80bbe33f79bc8585b8951265f8fd4db8dbe5074893a30181e25e9d1bd
SSDEEP 12288:64VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:64QCBq/McxvN2T/u1mWXMHM9
TLSH
T1E465235EACCD9ADAE703CBB2485D567A0E297B38BFE481F7741021B42770CF69839944
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 40437edf0698be7b0f8969fc6eacc8677640d206dec83cf173aa341bf666c838
MD5 a32883a83c837d8a9c2d794f573fd946
SHA1 e7cdb8f9ab79c8c3b40187b5c7245e96d679ef12
SHA512 38852a64a81e6722b356d161e7e4f67e1bc410e25832119a08178521400a8d1b92a4287f0c7e7b71d61db06681c2a596f1b438e935e3d56645f341d3f81dc848
SSDEEP 12288:jObrA4LWOsvAYFT/VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:MfL3UT/QCBq/McxvN2T/u1mWXMHM9
TLSH
T1B8950119F7D800F9E967C23CC8668626D672B86D1764E7DF03684B651F236E24E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 03dab88a0899ea79408c83e59a6070bf357d9b3548af3f8ec213d017de3cedfd
MD5 eeae2a4b59078f750ea1817cd2c3304a
SHA1 f5491448b20bb15fc8a10c0113f49164b2d961d6
SHA512 4048758cc34d36e62edbc26d5dba838f947bf0d1c50ba82911870af5355f777ec946664669fcba98072e09a513db02c09ef8f534e4a168a83203418a3b745305
SSDEEP 12288:qpFtfOrVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:aOrQCBq/McxvN2T/u1mWXMHM9
TLSH
T1CE75122E36DC10E5E23692798996431ED772B8751B6053EF029081BE1F73EF86C3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f5fcabcb672f804d39b0b32c0959df22e584f314108d322c222fdc96f73d2161
MD5 1b6c6f441872851dabfc8af90a157a9d
SHA1 840a2ff2c5535d250616acd1139e6efd4949c5ed
SHA512 93d041d37f5d7ba03e1d7e4eb9dcb42bf39693952c0ceb3599000f8b74e47c0e240f73ecf803acdc6fefb0f8794cd0c8f1a1242796903dfccc70d35d7d56d4aa
SSDEEP 24576:f7NM9YqZqmWMUkPjZM48Mv6bEhscQCBq/McxvN2T/u1mWXMHM9:f7cBWMpPjN8DbEheCM/XxvYT/u1XMHM9
TLSH
T1CD65AE2E6BEC81E5D577D13DC9A28206F6B2B4611B318ACB1152833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8fc9e3dca55445b2342e628d03a3c6b123e70e7398a86aa53dc72320e21e80ec
MD5 b317598b3579293bbc04d91b32fbfb14
SHA1 17a15e9c8ef3852296075b69685960121044e608
SHA512 6ae49f86a09a8e98dcf1c137fef7ac87736f57e80b89eb9ed0e4b3351953d698398ec9d480f5a2b60b123f9881b8624192da49df69d6bfa6bf97e252bfe5260b
SSDEEP 49152:jF2YuHNETovAvNYf8kmZCM/XxvYT/u1XMHM9:S6BCf8kPM/XxN1cHM9
TLSH
T124858E2A27ED80A4E0BBD27D45B7D246FAB2B8551B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2858f64a0c061d9f6b0b67eebdfccb907e31d04000a538bf546f5211597713e2
MD5 76ab5214ac859d03cf2c84205f0603da
SHA1 19d2ad2b1ed0eb2801197177c27b7f35156a3270
SHA512 ecbb306102a0ec9a232d7593a10076f05a242b162c39011b4a7c1ebbcc513d3c844f8f5673dbfdee7907444e886014365ed43f82fb68d2210773ac1baf02b23d
SSDEEP 24576:HAFs06+Omlf3NXEbTo3QCBq/McxvN2T/u1mWXMHM9:gFs060lVXujCM/XxvYT/u1XMHM9
TLSH
T12365BF2F66EC00D5D07ED17E8997C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 f7d3a0f1e79b3ba621532f1ff12cc92a08e0586a0133321a40e0e55d1d62974d
MD5 fc5f19a41517453fcb1dd8e6ac6d4a9a
SHA1 aea241a9280a965b492dae422ee72ff9403e967a
SHA512 ab01ec4ccecd1f9711b85cf9eb6948b9e39608600b058f3e4937f31aeebc5a24e6561b4b9bde6bf99136e6661fab6f5532b4fd700ab34f07bc54202d60472e89
SSDEEP 24576:RJnJ5D3WhaQCBq/McxvN2T/u1mWXMHM9:RJnJ5DGhjCM/XxvYT/u1XMHM9
TLSH
T1F085D02DD2A810E8D4B7C3B4815A1B96FE72387D2F2169C728B4D5353F12EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 efb12f599a1a73ebf58a0e63e7a62a7e54c746b12211e3f7d9cf861c0c9926d5
MD5 460c3b7c5286332f32c5378cc4dfa542
SHA1 7a063dfd20ecf9d3f0b8b2645342628c044bff69
SHA512 dfe03a43b2ad6d58f232072e3a5e456a86cabba9a873d46b1d50bc4b798a9936652c7a9d8f3697eaeea0a61a79c5f833ea43b49fa48e03ce0e6a435a161cd214
SSDEEP 49152:Eg06DIKdwc+eQnSt65aVFCM/XxvYT/u1XMHM9:1qM/XxN1cHM9
TLSH
T1A3956C15BBEA5294E9B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 ec80ff514c67a0326fe992134e0720a5f584cdd1773f1d79e4eb96780122dbc0
MD5 c04d3a0a72da80f5b58a4673da955350
SHA1 521a9b5dcbdbf16368a3e5c0f3812c5f6f3f29b4
SHA512 e52d1fddad6f1357b978530e28a4abe86463cd2da499355a7f28e62e8f5ed42d073490902ce384fce1a8168ad2bb75b580a7079e11793e084d64d63faa5c3fd6
SSDEEP 12288:1EP3RFWVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:2FWQCBq/McxvN2T/u1mWXMHM9
TLSH
T13275126E6ADCA0E9D227D27A8595861AC772F0746B9063FF2690827D4F339F51D3CE00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 541694a1a8cfceaebfeb5e83730a0aa51d0b9b018978884d40829f5616da661d
MD5 b8bbda9bff03e5bbd54a0cdbdff1c53a
SHA1 9df5fe2c11743a4fd1d57c3f15cadfcb88e9914f
SHA512 c640bf3a563a499a946fa9eeb02a1380d12f72164e5628bf9fcc280e5cd572d68a42dd4ba92bfbab6fb2d5340d8828a939cb3209bdaf3e6dcd56c28e497353ca
SSDEEP 12288:DjkyRVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:DIyRQCBq/McxvN2T/u1mWXMHM9
TLSH
T10275120D67DCA1D5E7674775896642A58E35BD30AF2082EF6090B63E6F32EE0AC34F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 f2a6f1729e5629817a63e07568f4fed0ecc73af367a4c9910189f0dca7686acf
MD5 fd2dd85e5cd3e8495478ad0a66a15b4f
SHA1 7b24d8fea8a961a4933573de3223806e39426d4d
SHA512 5b292c6fca57db83120bf6d7f8f34d053faba9b72442976fef613846fc0ad5778071920d8f793eb131a9a6e25fc11fbf46b8e7c89057f3c0fd77ab5678ecd90a
SSDEEP 12288:7QbVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:8bQCBq/McxvN2T/u1mWXMHM9
TLSH
T1D265232D6CDDA6DAEB038BB2442D1B7A4E357B38BF9050FB7490A1B45B70CE29439D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 56e76bd7275fe37c6826b715f92b9dfc13db2ed6a2c192ebb9cc5ebd48e09772
MD5 45012a62b035039352ab1b8b79d33451
SHA1 06e1ee1379f1478b6598c246bdeca5904bb77f8a
SHA512 836d5ec1e8b35887dda55bef730cedb999dddeba3aa958160efa73bd26585b84d057f8b66a45262ade83afa98dce19dad14e1e9514b7f8c10f1a8e056bdba777
SSDEEP 24576:eQ9MxZKdcz9dw3UQCBq/McxvN2T/u1mWXMHM9:eVKZhCM/XxvYT/u1XMHM9
TLSH
T167558D2DABE905DAE177D27595A250C3A633B4301B31D6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 779b9311a8cd7b432bbdae129700bb1e725ae86aab7699f4541e8c21477eb86a
MD5 50595240f28f7ebbc7ac9c698dc29dfb
SHA1 6609aee2ce0cebf603caa12e4965e4b03563fa9a
SHA512 b55a41974fb4a6e1d6509f101f31cbc3c742d3eadd472f32543c8e9c25137933ae1dcb533f3a62ffc009e38d4d04f54c2a5e6f6667a30376c4094f21c409a107
SSDEEP 12288:6yoKo2bRple9pdVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:6yoc9ApdQCBq/McxvN2T/u1mWXMHM9
TLSH
T16785E01FBBAD40E2E166823C89858755EB73B0306B6153DB6691C33D4F239E9BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 61f1ab932ac97f2765ac2fe748557c492ff1d3e1ee0dc3402ecd7e648755a9c1
MD5 3a9cf70cd6bb906306b79f480024ee45
SHA1 c2dab86e3fecb54e5bd6039b4f84d0341aa7f042
SHA512 9d51691578992d669be78a320032765187fcfd5dfdfd67d91fa20de24ae1252f9bb11bf8c6156b3ac9e5b51158c0140a3d31568f0e2a9680a45fd96841b9ee5b
SSDEEP 49152:QWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKyCM/XxvYT/u1XMHM9:C0zuNIzM/XxN1cHM9
TLSH
T17FA57B3DA2EC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 63cf3a5cd069f55bbf57d89b1569eb3700b01b1eddc91c56a637cd8d52e8d60e
MD5 f297dab249a5bca41a77c4bf598a4f52
SHA1 5808de42400861c13e6813adca22083c5b876b5e
SHA512 650f71b483fa3ed034a7ab06d79da9a7342b9a6dd2f686c0337ec1fbf0c0dd0b453952a22e56d64f11bbf432a15ea9c192595f83efb87ef6272deb711c9c3f39
SSDEEP 24576:m1QT7EcpfxR+N5AWAz3ooiYtjMqbWQCBq/McxvN2T/u1mWXMHM9:rTDxR+N5YzTfjMcCM/XxvYT/u1XMHM9
TLSH
T12355B02EA7F815E9D17EC6798A23C512FA727821073193CB42A0C17E1F679D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 f59255eab5fa09be2b7254b449f7b67b0173d9a7b0abec7f853f32ab1f1dd622
MD5 34cbeb4f13436a4ac2f6778aee9d4a8e
SHA1 98bbd58fbe66a42524e73c00eefac616c637ac2e
SHA512 ff2c65dbcf18c98db1f68c930df9708a0ea264e7d33974c455ae12661d04863546bd60e440d649da689a6ca87bc99435d2638140f6f7052a6909c9a45b1cd81b
SSDEEP 24576:TTMdOz0FFS+kmSLSQCBq/McxvN2T/u1mWXMHM9:R0K+kmSLrCM/XxvYT/u1XMHM9
TLSH
T14A85F13EA7AD14E5E53BC27D9A438906EA7234750321A6DB0690C1B93F67EE4393DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 0a663d6b980e8c0e095d73fa266e7165da226012a9356a5d0cb195c782b73a3b
MD5 b704c00eba542300f077bca668022268
SHA1 ec519dae8f4dbbbce9d8997d5519956a46c94979
SHA512 328a1007020029cf4e162137441c883753af2bace0c9ab98af2f92f070ca0df56d712cf34ea532dcb2ed46ce51a2053dff5e4edbf23cf3572237bfba107bb602
SSDEEP 12288:h40/VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:T/QCBq/McxvN2T/u1mWXMHM9
TLSH
T1F575121D67EC30D5F62397718A3A02668A31BD396B6052FF35D0D5BA5F329E49838F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1624-298-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2036-168-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2036-174-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2036-290-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2424-427-0x000000000C900000-0x000000000C908000-memory.dmp

Download

memory/2424-302-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2424-538-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2424-267-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2424-232-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2424-248-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2444-438-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2444-65-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2632-294-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3288-110-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3288-109-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/3288-101-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3288-439-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/3476-295-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3476-200-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3476-194-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3676-205-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3676-211-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3676-296-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/3792-301-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3792-537-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/4108-218-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4300-293-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4300-434-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4372-297-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4508-454-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-455-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-465-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-464-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-463-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-462-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-461-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-460-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-452-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-480-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-478-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-479-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-477-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-476-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-475-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-474-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-473-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-472-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-441-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-468-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-469-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-470-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-471-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-458-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-457-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-467-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-456-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-446-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-447-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-448-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-449-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-440-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-450-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-451-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-459-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-466-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-445-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-453-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-444-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-442-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4508-443-0x00000244EC5F0000-0x00000244EC600000-memory.dmp

Download

memory/4888-300-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5048-0-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/5048-1-0x0000000000CB0000-0x0000000000D17000-memory.dmp

Download

memory/5048-8-0x0000000000CB0000-0x0000000000D17000-memory.dmp

Download

memory/5048-405-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/5048-836-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/5204-150-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5204-144-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/5204-148-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/5204-138-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/5336-292-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5368-134-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5368-303-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5368-128-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5452-289-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5452-161-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5452-155-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5572-291-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5572-183-0x0000000000720000-0x0000000000787000-memory.dmp

Download

memory/5572-178-0x0000000000720000-0x0000000000787000-memory.dmp

Download

memory/5644-118-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5644-287-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5644-488-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5644-124-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5772-288-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/5884-116-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5884-114-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/6072-771-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/6072-676-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/6072-881-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/6100-299-0x0000000140000000-0x00000001401FC000-memory.dmp

Download