322068786202836d8284400d760fb599ab2115ed81f5552c05f091caea1039ca

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.7MB
Sample261102-phhc7afa38
SHA256 322068786202836d8284400d760fb599ab2115ed81f5552c05f091caea1039ca
MD5 a9377d1a1a803c5387e4dc4c711642e7
SHA1 069d1c672206d3050ed574924f70e651dd4d3cb8
SHA512 56757cd8e6e85540c64518e48e8dbd46101affe0675cd195611b054ff1580e58d2c558825d8a05a25e35323e49b2ce85da1d4b05e7bb72b99bd8733a676fd575
SSDEEP 49152:XNZCWOLT4WXGQ6m6K2MtENMCM/XxvYT/u1XMHM9:9wnLTbGQHkM/XxN1cHM9
TLSH
T153855B0667F95128F1F33B71EEB992645A77BC71AE3AC50E6280125E0DB4E50DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
60	4252	Process not Found

Executes dropped EXE 13 IoCs

pid	Process
1204	elevation_service.exe
672	elevation_service.exe
4260	maintenanceservice.exe
1516	OSE.EXE
3616	PerceptionSimulationService.exe
1940	perfhost.exe
5624	ReFsDedupSvc.exe
4120	SensorDataService.exe
4268	ssh-agent.exe
4668	AgentService.exe
3908	SearchIndexer.exe
2496	Reader_sl.exe
5436	RdrServicesUpdater2_x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\33fbe3b1b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RdrServicesUpdater2_x86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RdrServicesUpdater2_x86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater2_x86.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e2022ccc46add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085e4c690c46add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076ef5b8ec46add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b0dd58dc46add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000982e6c8dc46add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f974978dc46add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
5436	RdrServicesUpdater2_x86.exe
1204	elevation_service.exe
1204	elevation_service.exe
1204	elevation_service.exe
1204	elevation_service.exe
1204	elevation_service.exe
1204	elevation_service.exe
1204	elevation_service.exe
672	elevation_service.exe
672	elevation_service.exe
672	elevation_service.exe
672	elevation_service.exe
672	elevation_service.exe
672	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	4668	AgentService.exe
Token: SeBackupPrivilege	5624	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5624	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5624	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5624	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5624	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5624	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5624	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5624	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5624	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5624	ReFsDedupSvc.exe
Token: 33	3908	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3908	SearchIndexer.exe
Token: SeDebugPrivilege	4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	1204	elevation_service.exe
Token: SeDebugPrivilege	672	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2580	3908	SearchIndexer.exe	101
PID 3908 wrote to memory of 5572	3908	SearchIndexer.exe	102
PID 3908 wrote to memory of 4260	3908	SearchIndexer.exe	103
PID 3908 wrote to memory of 4972	3908	SearchIndexer.exe	104
PID 4056 wrote to memory of 2496	4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	107
PID 4056 wrote to memory of 5436	4056	2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	109
PID 3908 wrote to memory of 1520	3908	SearchIndexer.exe	110
PID 3908 wrote to memory of 1816	3908	SearchIndexer.exe	111
PID 3908 wrote to memory of 5820	3908	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_a9377d1a1a803c5387e4dc4c711642e7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2496
- C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
  "C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe" R32
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:672

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1516

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3616

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1940

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5624

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4120

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2580
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 1.5MB
SHA256 1395602f7d37b4d265f2706cab32327a85ae0c6c5581faa1f24f621de3810cc7
MD5 5449c4fc1acabd4e95476a5d29dd15b8
SHA1 8b637940377deb505dbdcff20885f840723b06c4
SHA512 9e2d2e9749e8b8ae8d794b5b0e36308c66b5c02252b1c6fd0d5c5fb0cfdecd760c7f3b8f9d8ffa8673e194c14d078208ca80d2543422132382de97bf7b3e9c9a
SSDEEP 12288:YFtOVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:2tOQCBq/McxvN2T/u1mWXMHM9
TLSH
T19365231F7ECEDBA3D60287B2086C17B949BDEA34FF8442E36700267A5E744D2583651E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 fdfeda17ddf1ddec52fbf8b36f3825762f003ea752c721cca9e2fbe1d67621af
MD5 e2121bc42d97938273735d383042feec
SHA1 1efe0a8358ffbb9104bc8ac7ff19296dd790ba25
SHA512 3b8e7ab91e098d1d80f97561d7fa246608835d6115223b78de7b81a12dd15f6c156604e5a88da1d19a5b6bc25572315b5226b678933d1f5f75bc3f44abc74a02
SSDEEP 49152:cSgouvAeFfenxyQTXS7uQ0NI5CM/XxvYT/u1XMHM9:cS1uxaxnS7ufM/XxN1cHM9
TLSH
T1A2855A0267F94129F1F37B71EEB993645A77BDB1AE39C50E5280125E09B0A90DE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.8MB
SHA256 ff25777e185d355595d06aa5a05575e0d5f7681dff1d09601f612eb2ae08ff20
MD5 047136b8b36e979585d9c2c66daed880
SHA1 6befcf8a3c5f70ceb62f3300f43f436b5aa09d6b
SHA512 5534ba83ec697220adaf69a4bdf421c721f9e1d9ab55f00695a868f78f6fbc619084ae48f73123de08f5c4181ed7084364def8f8d0c80cfcc542145ccafa348b
SSDEEP 24576:+HTAbD+OmeSQCBq/McxvN2T/u1mWXMHM9:uTAGOmerCM/XxvYT/u1XMHM9
TLSH
T10795E11037C0C135F1B329768ABF9738556DB9715F6881CFA388167E5E70AE0AA31B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d7ec728aee487a38c9c300ff4ec24d9395b41ba80fdf7d34b32704eee7ab6381
MD5 c16545028191b7f62181565e4889f01a
SHA1 9071881e375740ce53c8b1d9e22841a8ee683f0f
SHA512 020a64d2b58a7b96a92651a59e5bf3b85ebecfb953114beb195549fb95ad9b2f79c60f8aa170c6a7e9844676aad963c05fe4621ceb2bf342d19bc1dc82778065
SSDEEP 49152:Jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnqCM/XxvYT/u1XMHM9:f3q6HjB6M/XxN1cHM9
TLSH
T183D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 a17edeb7f3e270cd8039d9b4976b34f6cde17913e64dfabdf2b48bd90dc6aeca
MD5 446abffee2abe9543231608575e17ba9
SHA1 a167db2b76e48bb48680ecf6bae6544f9b418ed0
SHA512 e38d49c3a6f4f347a9a2d4108963687be310f8ea020ddb544180d5e58f956dc58a2483ea44d6759f39e3ce656911ce1552753aca4909c0df84e7ab1a4bd5ae76
SSDEEP 24576:uXYfDtczA6QCBq/McxvN2T/u1mWXMHM9:ttcACM/XxvYT/u1XMHM9
TLSH
T1A485012CB7D408F9ED678279CCA28512EA33786447A0E7DB03A499751F336D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 db7c82ce2106643de02534535e23a86520f8a3d523bdb2788ea718804c84e49d
MD5 304eacfaa9a179ac508b7f2295d7bacf
SHA1 93a2bdf234f5a7564539059fdcc9f9a23cd0cb0e
SHA512 ee5b26fbc40098bb306caebe9bebf73c721b8249128870b00aefd54be0496b6eff1511c766b8f32b110eda6f8e7c0644e2ff8b5fd875478914944520f6a9dcd9
SSDEEP 24576:j0Le5ji0hmxYrMtQCBq/McxvN2T/u1mWXMHM9:jPji0A21CM/XxvYT/u1XMHM9
TLSH
T14E959E16F5788335D073C0B9C5D2A69AED7130865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 63152e32688c5f491c73850aeb14cd38862a83c3cf46fa58f3d830f155ccb1f6
MD5 845b199b13c167103aa5a15148b19e0d
SHA1 70fc5880ec26a6afd71cc0fdd909f9ff5498caf0
SHA512 fba9785688c73d2b001fc0535cc264ef13a95df6bc2b8696a96f0eb70ed9d8b21d01a707d5f109f24e87bd075e59f37eee72b811b963ed9f7a17e57f76f1f110
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWE6q8wyunQCBq/McxvN2T/u1mWXMHM9:2/ezSC6vUzPvxHjypCM/XxvYT/u1XMHK
TLSH
T154756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a6d97d54ce7de8863e73d47543505f10cd2dc905e4e7bacc3b7c269cca53cd75
MD5 2a89e90b7c2fc6df6d9a5123315fcb21
SHA1 34f0066e166e72c91edf7ef7386884c1cae12908
SHA512 de58fafccd7b353a092fd00b31601486987c7707545b4e60ce95e7ab203631fb823370e63a1219d807e3505e49fdf0e569a438bb932df840b2e2f87f6d1a9ccb
SSDEEP 24576:VVbqPb88hv/l+6+QCBq/McxvN2T/u1mWXMHM9:VVO88hXl+mCM/XxvYT/u1XMHM9
TLSH
T185559E66F5B48331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 77c802f8418d32fd52705f549e16fae2d8dcbc2ae8de7a080e1cb029420c08f6
MD5 c67fa294df25abebdded591314506e3c
SHA1 2620b079eaa60857f68408deb0b646eb19e15e8c
SHA512 da1f3a30212b0138d0f8979568825f6a0e860c607b9303d3ba931501002966137525625efd6c16afc58fd680a306624392142a915d93d5594920bc8209066fe1
SSDEEP 12288:dHRVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:dHRQCBq/McxvN2T/u1mWXMHM9
TLSH
T11F65231E9CCCD6D6E7478BB3486D167B0E66BF78FCD484B165103AB41770CB2D429905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 7f8d95446886954ea6be707ec0f947846876b08d64363ab9f6d1067830ed1061
MD5 3750fbd2e8c78e68b1b9a739bfe41c8f
SHA1 31c6c9cd54568e66ffb5e82f6339a68ecfd9e949
SHA512 1329b41b624e3448dab61ae7a70fbe19f46272b54759d3d04f765ac10207053c954ec74399bba14fbb2eb505c2ddf15de295ae2b3a53bbace11f4c247b11c164
SSDEEP 12288:xeBNUbTVO86UGVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:xJIUGQCBq/McxvN2T/u1mWXMHM9
TLSH
T1E785CF3BEE68FCE2C27A8DB95A918740D77278304F6193CBD164820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 091ab3ee43d026c0297fa91716b62be2011e8a67b3ee2142f38963403dea659a
MD5 3c35a8fd41022071bdf399e898e1b630
SHA1 1a017a5d0f5d524cd5f43308c21414be20d01090
SHA512 7fd49a30c8a2da33d6fdd49c4655c0d82d297c639d943dcbd1de78e21d6dd25a97c53fe1af90678290b6da4fd5a63934f8e41ae5aee76c685afc098f0ba2ae16
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THj:MQvGAdlCEL8c/yRNw5CrM/XxN1cHM9
TLSH
T1AC267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 be7c4bd1db3da92968acad9cabe18d46a1b592b12f9a7d1841635172ffc7bbf5
MD5 9cc3ae0e33ed2f611294058db2678431
SHA1 931f312f4196d10f041c5a811dc82f894033c29e
SHA512 ec1c6cddc765c2b085a4a420b2224fa7d959abad2ef45338d38d10fa0309012d31277c6cdf8c5355e4f12a295bd4a31efecc85a125a7bfaf070dae395eaf03d9
SSDEEP 12288:dAwSfxL/2Dc3SDLLmt0LDQewsAjwVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wx/:O7ewsAjwQCBq/McxvN2T/u1mWXMHM9
TLSH
T1C285E031FEB4E436C77B0DB21B26C716182DBA204FA119C3E3A85E9D5A301D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 57af2465974938dbb49fd1f440bf5b8d5f28658639ae40b36e3297e8c201f837
MD5 c172c49cfdfac26c85cf09f9bd3bdb4c
SHA1 faab45fede37b7d305b87dcf790fc1278f2f285d
SHA512 4d9c4553a80978b31862e0d602cadac3d7f6c62908fb97c6f211cee318b8cc7ce41771b88c89a598248655555a708e1ef870b14c12887b7da13c158c77843a54
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHPfyHK:kUEtQevvqc2W1cpV2EI32XyHK
TLSH
T118474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 39daad04318ea27c03dd5eb07ca42de282910e3cae4e0be50e0fe6d652f0a110
MD5 363c4d183cdc8b0cf7ed51c6ab1364b2
SHA1 4851ebd49d942d75cc6db0ce7271880a62175344
SHA512 8da7af143095fbe8952c8b6430fa0db8d18001be935e21eae2980ff158cbcd4ca3455922b01cdae84bc4bdf19c8fba33935f76afaf7d3c99c4e439b292b25020
SSDEEP 49152:ACbRquA/m2yL5zLfFiV+XenmE3/zlCM/XxvYT/u1XMHM9:Joq2Vjnm3M/XxN1cHM9
TLSH
T1FFD58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bcf1c15bf40417c9fa33d8e0833dae06b334d4f9738a8f9a695242c6056bf967
MD5 50767a9ea95d6d3faf4288a8612dc56f
SHA1 1dd153bf0bfa0ab067699bc16037fb96e4e09136
SHA512 9a2af9f6546085127feb07281e16dd8045bf400eb665490c2bcabf0ac871cf61b7b3554c06876af1161b22cd29455fa6486f07b0e4dded1273a0abef9235e24b
SSDEEP 24576:cAhGLJIFoiwtA5l7S53zQCBq/McxvN2T/u1mWXMHM9:cAMyFoiq5ECM/XxvYT/u1XMHM9
TLSH
T1D1359D81EBF955D4F5B3AAB899B68171EA76BCA95E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 e0def01d867b257e560cfb7043fe43703cc4cf7f933460e3f77cadb26c509f2c
MD5 8e885aeced9a4ff0d68750a4f6f537e9
SHA1 a64a4788edae9254ca199e33183ee4e96c5022cd
SHA512 06e086e72249ce087d3eabb466ec17b9965ef873c75dafcca446c47e6c03e3867cbde0412d1eaede2c6d9bee3a756c816e7a8a0cda4d37af237252816af6fedc
SSDEEP 12288:Amw5HEjsChNzBFgl0WDm+CHVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuG4:dwuSOWsQCBq/McxvN2T/u1mWXMHM9
TLSH
T1BE85F14A76E81CF9EA6782398557C136E7F2BC113A60C71F1760C66B5F33261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 54b2983fcf4ed5f0b342e21d1ac1b716d3641281371859faeca1c613d61a0315
MD5 7f7692695ef3eec9e698a1bf2a22009d
SHA1 cc2b45fb40b08d7e9176dca62fc6aa558fdb1cd8
SHA512 a91c0e80dc5328b55bcc05f4e80c5b02c811565076f38a9d881c5788f68f2548f393a5f0d8c5a0c85c947b847b87228f4d6bf0eb21e3315c9ea872781b753454
SSDEEP 12288:LjZ1IyAVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:3ZuVQCBq/McxvN2T/u1mWXMHM9
TLSH
T14B75125E36D861F9E2938379C8E94616DB7278757BB083CF162002B92F32DD25D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5c7eb161aef47cc17c4a6de7db48264631451ff12d47b72306fd703721b2d658
MD5 06fc8801a30463069c7851455d84aa0a
SHA1 949b6b0e48f745a2896684a00ae853aae9654ad5
SHA512 3628a85e92244f1d493c55063ff8e9e64b6237bcb4478384f824dacffe9242c7a3c0a8db06fd73aca96289a3011395c5f6bddb82453fadfaccda193a10ded94a
SSDEEP 98304:nQRQyi36YOcPQLvw2gAf+PN3eM/XxN1cHM9:2QyiKayX+PNFfyHK
TLSH
T137667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0dfac2efcc6ceba91d8983b99bc6771e2f9d6d1f677e2443023b16017c9f0ad7
MD5 15f7b300870dda4adb354854157403e6
SHA1 e543724ccef0373d2b9590d781f255c6c4e89b50
SHA512 16b65897f8221412054e61172fcc5d5a27aacf9d2a06ded6f55fd2fca55a56f1c7212933e768e43b81a6b4cdfadcc46e3744b8bcc4172b09981c3591a46d5fdc
SSDEEP 98304:JQRQyi36YOcPQLvw2gAf+PN3eM/XxN1cHM9:gQyiKayX+PNFfyHK
TLSH
T1F1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 707fabcd61ca41570f0eceef3728b2e4b15c3b634a64d80d77840b37d436f59d
MD5 60b34ea9351ad9d3d51bdb853cf20471
SHA1 7370dd77120cb6de5a888154695f4a146f141ddd
SHA512 1f483109f69f3a41e77cec63b4d72aebbffcaf978bab582180506e224bc1187cc616dab302f8d0a28af434b9c5086003f4273d80d1910faaf4b497005bc8f0e3
SSDEEP 49152:M68Qg55nhheWu7PNU3/1CM/XxvYT/u1XMHM9:GthWRc/gM/XxN1cHM9
TLSH
T1D2B54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 70081f7f75e2ac6ad257fd59245dd177680a8f0d44d4842ea679eecba56eb1fc
MD5 7a5ed4c86ef293d1ee3e213d706d6d22
SHA1 8c3813758258c81f82cfeafa9182639cc24fdc58
SHA512 3ed8f8bc1aa64facbf7611675c85db3e0d9b3cf9fe9eef1d4b22c4e4e7232eba8a1f1dcd61cd73f66c2b8071f206680507e0ba6ea5473dd0a9cf93eb394fe932
SSDEEP 98304:Uy5112gYy5azzVvL69nLKnhZRM/XxN1cHM9:VLIHmWh0fyHK
TLSH
T143167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 64904b0985efc287b74e0be7c099993fc5f11e151aad7fef1beff3d4a6296034
MD5 ef7ec6da9a11891782518c369a59b299
SHA1 9d9a1dc6d4a3f051aac47d5fe0b9661f3457b085
SHA512 353657255d467fbba7378de79f92f20633bedb7571b0a39185002423865ebc3e2b4e15a7c2a16d2e02bd6dd9d0882f0a9f08bca4d3c379ab685f7de187e52c60
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzCM/XxvYT/u1XMHM9:Tu6JmVxd2dGM/XxN1cHM9
TLSH
T1D4D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2be6a8cfd8f01044a81fb32906ce3fe156fc5edbf0981a82ca3be1ee1c21db63
MD5 8e9a2fc2bbd12ee061bdeb4b310d4872
SHA1 3ae71d21c361e6135f67c25c194bad874a704774
SHA512 ffc685eb4bc34298b1bf2c855dab5ac73db6645f447027272c28bca6f7516676382e45a19bd86b206df1b2a8df079f31a4d6920b3c4b2b4eb515b0b7d2fbfadf
SSDEEP 49152:u1hpsNoJpF1A6UU44CwH7R4x3CM/XxvYT/u1XMHM9:umifPbR3M/XxN1cHM9
TLSH
T170B5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 af12cef8bcf218e5e94c7d4981e0217600aa70367b3c83f702aad8f8bdf60ce4
MD5 9f680983e5592f080da4e6ab552380a3
SHA1 f976f45eaab8a8568001a43acf602564df69d963
SHA512 aba52ba4d21f4b2711257a459d3079f95a38a16f8fbf746554d38084821661f93725f98566ac855c91a129b4bd01fcff498ddf41afff92769da411a70d7799ca
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHq6CM/XxvYT/u1XMHM9:w5dKTi61FM/XxN1cHM9
TLSH
T11DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3466bbfc96cf1a08d21050a78d4ffed5589fc720543a62d34c2f9ca8c0965bdc
MD5 a9e8090a03ffd23c6c5de614471c1dd0
SHA1 ef3e6602a9174051a0a6be50a6721a063673143f
SHA512 d8401c6ba7b743368c8afc1e0555786c969f8fcad86f64cbe623c3e0b63a1121e01b0957243c3bf3a328ee9500822c95f48529734629ce03568c224f7aefc1eb
SSDEEP 49152:8htSn8EApI0figngiDn0AP5wDCM/XxvYT/u1XMHM9:9X2iyphjM/XxN1cHM9
TLSH
T10195BE13F2D901E8D05ED174C7468632EA62BC150B38AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 8ef9812f574e0e8609350f689d3575fd68be5ae6f840bd3ffaf734713dbc8a0f
MD5 5f3cbee77e0305ecd20d3ad5d903080d
SHA1 18a8f867337f982977cf6436c8f109ebbcdc9d52
SHA512 a6f6ee000760c52fdeea28216f5901af53c29dd62822ae896df712794f38ab814df8ba685851b43ca612f8a30a399fbf91a14d2e90b16e1e7588210fd1b8880c
SSDEEP 12288:tZVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:tZQCBq/McxvN2T/u1mWXMHM9
TLSH
T1CD65231EACCDDAD6E703CBB2885D167A4E697F7CFED480B6761421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 4be6fbaecea565b0389cb4867ccd70e7b396768dd04371a0879d316c505d2f32
MD5 0f2986235973d2fafcd43e59b84613dc
SHA1 92d6109c6edd9f28233db64435575245d0f0a345
SHA512 339239df20c601de8ccc90891ab36e1854592d242fb6e6af9b287ae6c2f796b97140304bed34bfa321a24e2b5b40a1ad6c49b895618f4b206e68db76775c35d6
SSDEEP 12288:RkVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:RkQCBq/McxvN2T/u1mWXMHM9
TLSH
T17165231EACCD8AE6E703CBB3885D16BA4E297F7DFED480B6761421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 a72845c041697acdeac4aeb580394b9d22f67ef7886e714b937c5f06040b9277
MD5 32fdca6bb827a6f381efb21785a2c248
SHA1 aec95aad80f2c8501471f21bac472fa4fab7c34d
SHA512 d5e3a6316ca31cceea2b54d054b3bbf175c2bda978bb0b364b834f677087cd6b31089fe19161268538090adf8af93589d90f019a87607ae57c1e8d7f9ab50018
SSDEEP 12288:WuVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:WuQCBq/McxvN2T/u1mWXMHM9
TLSH
T1F565231EACCD9AD6E303CBB3845D16BA4E697F7DFED480B6B61421702770CB29429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 d9b746971bbcec12e30aea10740cfe60aced4b884e178bb5012496f191d8f3b6
MD5 aaca61a357f0bc33950f6efde3cc2226
SHA1 2eb9e5214a76ea818a025cf97b0c94b5990f19a2
SHA512 31a423ffd7fd9f716269aebcf7ef0537cda66a06f123cad356ab222a36dfb3c368ff5e74a7235a5abdfc510215e626e4b9dcf34591c5562abf6870b5acc2f05e
SSDEEP 12288:LVTVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:FQCBq/McxvN2T/u1mWXMHM9
TLSH
T12365231E6DDD82D6E603C7B2C86942769F75BE78FFA082EF660015751F709E09838E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 272f3d474511ab556348b987034514823622396101db040ee9b189277cd7e318
MD5 b4764cf02d85f3e82b470a2d20c08201
SHA1 ff73a487bd8f3cafd7ea2851c28aa0f3aaa16c84
SHA512 1753d0246bc8b45de88fb0a44a26e4830e3bb6052eb799e32b77b46f1b4f3c4561847dcd3729a9aa01a993ce18aedb5a6c7b2852fa1c33a824fe84e7dbca1fa6
SSDEEP 12288:HrVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:HrQCBq/McxvN2T/u1mWXMHM9
TLSH
T18065231EACCD9AD6E703CBB3885D16BA4E697F7DFED480B6B61421702770CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 10d4a390688fef6ccd39d637cad1aa37906fbf2ad18aecba3fd7dc6f1141b28d
MD5 b3294d61cb5c182fea5c61164f1d6d94
SHA1 98b3eee27810fc5c6c0d21e39159e1b0179275db
SHA512 7f81cdd31be5d48143b3eac712d92d2a2bfbe826892145fbd0af09f5fc699b24966f88305c043081a1ea0c63233d7812c0d553069c782016aa9b8a235e8f4441
SSDEEP 12288:hYVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:hYQCBq/McxvN2T/u1mWXMHM9
TLSH
T11565231EACCD8AD6E703CBB3885D16BA4E297F7DFED480B6765421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 17d759fc028f3859eecee583b2e82379449a5ece274550f5b20ef26d79f05fc4
MD5 07ed4009e968c197c1fdad3707fa398f
SHA1 79b2a0156764f4d046eeed21caf5c4a54dac3b6f
SHA512 f3beadfdf43bc09a6da4fb37bf38029e1058a22d46b205aad4c859bd6c72a338da57225025664650b1d38cd36f8cb72730d8dc355998c25e625e285c13e62206
SSDEEP 12288:pcVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:pcQCBq/McxvN2T/u1mWXMHM9
TLSH
T17565231EACCD8AD6E703CBB3895C16BA4E697F7DFDD480B6B61421B02770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 c686ab8fc9ab668cbb91eb0b0ceeaa879cea7a87a7cde0fc3de2e85414d1cdd6
MD5 36bd8a45cfbea3a873c3634e208c4090
SHA1 b3229219a9e893d51126fc7155f31c2d5496496e
SHA512 8026d9f3fdf5807513b0cf8a730e292080c27dcf813dfb310f04c16fcd7576b70b4bcc654bc126c849cbee2b52fe906290573e29b8aeb91534dd0e826e1ba23f
SSDEEP 24576:nZMEzFVSOEQCBq/McxvN2T/u1mWXMHM9:nZMEzfNCM/XxvYT/u1XMHM9
TLSH
T190850199B39418F8ED63823ECC158916D6B27C295BB0C65F13A436661F333A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 922bd2544a3913582c0794fa09f76f991fd278dd4b8c5e29900664fae3a23ba6
MD5 6f142fc426455d93ef290b9c1b6fb865
SHA1 51e0ba2acb5f2c75d659ffc7f6a1c06e371809e1
SHA512 c46f1bc44b025c504d92ee559f604b957ca8af24d4a8df5fe712108a8c20c474ca7f39645965d75795a3d1673651c8e396bb167587cd6e193d86805f915da39f
SSDEEP 12288:LlVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:LlQCBq/McxvN2T/u1mWXMHM9
TLSH
T18865231EACCD9AD6E703CBB3885D16BA4E697F7DFEC480B6B61421742770CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 00390aa87aa5efef8e62b17d6ce91b950b2c5a85ba481e70754f255d76ace772
MD5 b9e4344be6c4436b7ef40181a9a1e0e5
SHA1 7818fe407f3439170c8d6af28725578342e0d983
SHA512 b16613a7d7eb43645b146bd17bdcddebe02c34ea081424e3ba4cd10b188dca7b17756d538d1ca0ac511e3d65538f6cc92f2248d5b1002187d74f634341cfc760
SSDEEP 12288:jhVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:jhQCBq/McxvN2T/u1mWXMHM9
TLSH
T1EE65231EACCD8AD6E703CBB3885C16BA4E29BF7DFDD480B6B61425742770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 64c3cc6cdba21d518d34dac60536479792c889b471ff4073e8c0a66a246e7dea
MD5 01d3c0e9dea50511abbdce20e4042366
SHA1 b6be48ca51a275d65f7454d212faa1f976352604
SHA512 e8d0e5900c264a7c53fb0301e36d9769b0aa2e787a28d3eb4f0e3fe3db9008521e524bb14b06349aff6e3f417733c13aaa46e0aa4c7d825cf493f385fdc368ce
SSDEEP 12288:FyPz5L8AVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:MzyAQCBq/McxvN2T/u1mWXMHM9
TLSH
T19D75121B76E531F9D2278335C8661A12F776B8355B608AAF136007762F336E19D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 0732b6bdb4e9901c821cac4f670962bed81394d0b8cf6564acca0c4ecdc24d4e
MD5 4d02d09d88c371db2df7caeb538ff4ea
SHA1 eb679ee0bcd2f366a8ba6be23ef8b1b812373e47
SHA512 c66e2403ac354b3d0de4ef078b8d762361abc819abab1d85ed44215a6c5f87b2dce0fd764136962d14107c4352cec78614833b2692a92542646880c3c1ae7488
SSDEEP 12288:XlVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:XlQCBq/McxvN2T/u1mWXMHM9
TLSH
T1CE65231EACCD9AD6E7038BB2885D16BA4E297F7DFDD480F6B61421742770CB29429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 f8fb83c1ef39824fc1df253c341944c3d3b094185a6a123f90c0aaa49d63366a
MD5 dd72d8115c556347d4830fb758089308
SHA1 5e43510943374ac6be0e50746b442e61256cee88
SHA512 1443ffe565fba495a4a4587f78603adf4c1f6b38cf8adecf064d188902aa24a1772a78dae624b31f205f4a930025cf2502d3b97dbc0fb26232ee575f032a6745
SSDEEP 12288:blVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:blQCBq/McxvN2T/u1mWXMHM9
TLSH
T14B65231EACCD9AD6E703CBB2885D16BA4E297F7DFDD480B6B61421742B70CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 23b3f5e158777317fda94e7ca0f874af7c6b73a51eba41e455dc3c042c525480
MD5 1423fb0ccf257cbca3d233309e3bb909
SHA1 b48a986b6742304ad85b56cf7020ea1d193da25b
SHA512 b0c4b55c3e32522fd4fc75014ad63a34af1bbabd40aeead72d17eae55802edc98eb2f5444fcd8d08246a665b864ece60c6f3f11546c4f25a4496ee0fb027fce2
SSDEEP 12288:2yPz5L8AVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:LzyAQCBq/McxvN2T/u1mWXMHM9
TLSH
T14D75121B76E531F9D2278335C8661A12F776B8355B608AAF136007762F336E19D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 42d4029ff7fe497171fec94e6bd8233eac7dd9a5bf2b9439738c0a3d0c1f32e4
MD5 f7582cf57e1f5b0ed0c782a35dc611f5
SHA1 fc5a101481c359cd03d4785a18d9ba363540d87c
SHA512 087023e31524995a80a42a4271b980e76fbc7310046dfe57f374b6fae924c86cd67f90f8fab4022441f953ad5cdb8625fa0a7a30720581772856f6caf67213b8
SSDEEP 24576:FTdaLl3z0zDeQCBq/McxvN2T/u1mWXMHM9:FTwLljQCM/XxvYT/u1XMHM9
TLSH
T1038502A9B39018F8ED67823ECC154916D6B27C2A1BB0C65F13A436661F333A11C3DF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 810be37308773f8165ef771b942093ede9df71ace4834414b09878048c24711d
MD5 567a0e13e05cfcd36e98299874f3dd5d
SHA1 9bb269eaf5c8194cdf1b3f3232636d8787d16180
SHA512 171a01affcb964ae16e76010383a8e4dead5e6ab68094fcb2dd2cbf5ad6248a47905c3b4c0621311e7d20329c1c83ce77fa429d7329ddd3c525aa44ef4eab9a1
SSDEEP 24576:T35d9CHKy7GZCQCBq/McxvN2T/u1mWXMHM9i:z5d9CHKyaNCM/XxvYT/u1XMHM9i
TLSH
T1F895CF94F3E810E8F1B7CA358D764512DA767C695B70CA8F03A4265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 47dccb3c2c379bec3c207ccad66cd3b912dd826aa709400b309fdd163750b6a0
MD5 cbf017d4d435faac189e0696dbbc327d
SHA1 729a3cb651903843256b10f4097b740639b5959b
SHA512 0f78bc5510910a6404219cf4f4948f729db613a01df021a930e6b98c936891ca6dedf4eaf2211db7cca45104caa4fb8cfbb06b0a519cc42d3ba7dcbcbab114ea
SSDEEP 12288:8OVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:8OQCBq/McxvN2T/u1mWXMHM9
TLSH
T1D365231EACCD9AD6E703CBB3885D12BA4E697F7DFDD480B6B61421702770CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 9e912afd20350ca35da36567693460bdf46a5d22c9f80bdadf8aff096cd86cb2
MD5 b876dac162bfd4b6bd961612bd780b15
SHA1 7e40f5751e90b35d6ac2efe29f61e1d925a769ff
SHA512 38453f6830b4e823f0196f74c2beaa779379cbd8370a5ab6ae765f4d387623b6e0a680c25c6f93299c98b6103b6c59b9bc9e3d2e2e5a22e3a357365e1d31afbd
SSDEEP 12288:ZgVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:ZgQCBq/McxvN2T/u1mWXMHM9
TLSH
T17565232EACCD8AE6E707CBF3446D067A4E697F7CFDD480B6B65424702770CB29429948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 535f280d4e943f76bdf61769283deb787c9e69811a0d8295246b2da4e62cd905
MD5 b5aa07c9701189b6f1dc6eaf39903fe1
SHA1 0b40687aac41a9253fd136bed96f03b3097272e4
SHA512 97a467739ded6ee36fff6c04a2bd4fcfabdbef6156cd5679669e567ae45fe1a287f7c5bb6d72193658c743e3df6685508a11fe90f35f32b6d4735512c646cf35
SSDEEP 12288:kfVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:kfQCBq/McxvN2T/u1mWXMHM9
TLSH
T1B165231EACCD9AD6E703CBB3845D16BA4E697F7DFEC480B6B61421742B70CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 ab727e9ae1cf244bde37a0e01ce397c3b2e5973014858a1f426faf27ee7acd51
MD5 45da40a6e5a4540911f26e2cabe53fc5
SHA1 3110dec2228c901ac78c32803779c88de65a5e11
SHA512 0a0615c899721ae7710cfb4f9d8ef3c1a89d7fd98ba21ce66837bf8a94a2a4cfac4335cfd56eb57eb9553d489078d1b3eac773d4594f859b236502c275bdc22a
SSDEEP 24576:0fwv+k9RX6wkyAIxQCBq/McxvN2T/u1mWXMHM9:qMnYIOCM/XxvYT/u1XMHM9
TLSH
T1E895CF2DEBDC44E5E1B7923889B7460AF6B178691B31C2CF129A53AD0E33ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cb243e0c1c840307fd52f17c331a3fa78401622dc9eec0b1a7b7652345347083
MD5 81a45e1fa0d1f3d120c4ae87a685c920
SHA1 019043bc393e38f01f0e765fbad9389ce8200cc8
SHA512 ab37c865f9f84623f3a64530447d66a05b6e5aaf8a6a3d6a0bcbffa1b827c8a790568f15c4c50683277c136eba711839d7f1c448dd95aca11e0692cce90129d3
SSDEEP 49152:tYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jCM/XxvYT/u1v:tySzP+M/XxN1cHM9
TLSH
T180066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0e3fa3d33ca1bd9a887a507d4f88c00570417f535ef85945f5ba1368f2cca871
MD5 714dc65e87b268c3d7f0c5c18d398f67
SHA1 ca28709dba1de704c06684c72e052605f6a04c36
SHA512 d5fae0cf2324d99aabc3eb477f6a9417b9f5d68edc14547c5539b15b84b2c41b45e17d7bf7faa72c00cc8d8daf70feb5c771615436f7c05a962d011f8fa7ea29
SSDEEP 24576:K47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYUQCBq/McxvN2T/u1mWXMHM9:K47JUQj1irIhCnDHUPfF/zCM/XxvYT/c
TLSH
T12065AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 086f5269db1bced6d7eee943f24a89b691a0980ff8b1bef84a15fffdabb62c8b
MD5 ce31f3a6a20b6f08d06497d7a627009f
SHA1 a5d2274024fb4d64d4e6dc72d62796ec693a0ddc
SHA512 5829a82e706657a0f314f348cc6f82b960805324c38da6b9f8f66a8e5010d3ab0788a057130bcfb536c671d40b883508e86ce4c8d3dab6f9845d0f3f83cdbca7
SSDEEP 12288:hzsfVVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:oVQCBq/McxvN2T/u1mWXMHM9
TLSH
T18E75F01ED29842E8C16E9276CB594A51B7337D349BE0C3CB62D0F53E1F359909DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 100B
SHA256 0ed11d356e7f1b224da94b99c5493bf3c18e203f5da13a427592f19bbc183c2b
MD5 e563fb0914086201b75fc61655d45d3f
SHA1 7b00f3754da22091283d439740c56e7f73e9adce
SHA512 55316f2aea9eec1de6adf0687b8f297060e73cd524a81c68dc70548ee43f34d8b673a20a3d33aadc7a71103b439be92a7af1768134981a5034a520d461e8388e
TLSH
T150B0120333D10428F8102511CC784431633670D4700AC00D8080008E08F4A0052123BB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 822B
SHA256 8b4c88d1e9b91745a34974d925b84570e920ee6475ac19e07e929fa000a76a92
MD5 c97a70ef83cf2b0c14ae39f6236c7f36
SHA1 d688370dadc9a6aa428b2a544e6d239443d63537
SHA512 72133b6b9e8258dbd0d3171f1e525f3edfa566dc5d43a1d3ea977f18d5e641b6cdb3c8b5b2904303a5125a264aad3ad86c0f77014e900dd97e069bcb48c74442
TLSH
T1DA019E832AE91164F5B25F50DFF9947357337CA26C2DC86C90D8420E49E1A80E5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 1KB
SHA256 0348736ff2b769e6d063721cd70406fe89cc1d8a1b90e43cf6af88c753161e3b
MD5 e46e877f9327e8617d10f1319640ac13
SHA1 6ec3d28c1d7009e09730a336fad63a6f2fac8f33
SHA512 1b7e796ef697ab421456553244515b5c1f9c2709377dd22194c085f7c9b75e241966892c366c652679e1ac41edde1b84083fdd8890bdf796ba92b99aa66add63
TLSH
T1203178872AE90160F4B36F54EFB994735B363CE26C18C86C80D8124E5CF1A90E1B27A7
MD5 SHA1 SHA512 TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e0d7f8eb5272bfe3de72d77bb87f355161e4f301b1421aefc89a7bbc50121391
MD5 951a687c248d1c65ac300aedae9eb0c0
SHA1 77f9816ce37468f99c7b35758abcbdda15fbe2fc
SHA512 33fd52f0f6da8484fe35ba8e27be44d613335bf008b5ca06ed6afc68dc153d45102be1e9e50e2dec064490da3de33b42ba347f5026dd655b5be94c186bbc1460
SSDEEP 12288:UKCx3riVEO3PagW+9kkN8Q37BDUPZnkaqI8OIDQRczAbNZhob:Ux49FFDUPZXqi+QRckbN
TLSH
T1E53528017666CA4FC6A940326E33D1CCAB707D41EE04AF0773C9973FD576659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 d925e204833a45d25429518101272d4e06160147aa82e209d5a0187275f45b71
MD5 b386d1ba15209885096205d2f93c885a
SHA1 33c9fdf73b20729783d777c378728888e120d0fc
SHA512 31c7bbb8fa88c1222094ec03f0183175c8958541d2390ab2803eeacce606951b13d8ce58359a6467393268b1ce51590393f5ad4324af15973f44285e5c680a68
SSDEEP 6144:ZvJzCV8c547/7eO/9ODoMHhMFMh3A5TF5P7xxUe/HD+4+vstMxACstMxAWOFbHi+:lJm2c5cm9WSh3AlEqD+4++
TLSH
T1DB45E8815437E68FD1B72032072A5B8CB7B4DC17B7096F26B389453AD82AB15A4F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ipmUpdaterStart[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MW9UJA6Z\ipmUpdaterStart[1].htm
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp1BE6.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp1BE6.tmp
Size 5KB
SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
MD5 38c0245547bc1440fb56c7308c2bb222
SHA1 8ccf6f27b9644fad1c8f13d98e9d680154c8d572
SHA512 78da2e84d0ebb47faec6999320198da63e02f8653a0b0609a16675592ff26b2ecc8de6a3210c31e28b72d6ee340dcdd792207cba96e1ae92b72c07d1d9fec897
SSDEEP 96:HX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yJF46R:3ULc8pq8RuwdmL4pUQrNyH4o
TLSH
T14FC13BA388946C45EC27ED00B4C89A23EDF576591DC0D1C33248C2A58B923973BDE2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp37EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp37EC.tmp
Size 5KB
SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
MD5 8de699a7d8a071e752e129d70525fcc8
SHA1 da6fcbafb68dd579195ff775afcf64f4209ef52a
SHA512 43697eaa55d5b7ca68036110d2bd12e01f6fc45fc7e3d4baf99b1de506170707a4eb801d6460dfcdf491fd58bafa3c93b8aeb5e2b36435e5249a2d7fe6a30be5
SSDEEP 96:PX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yh54pD3D:fULc8pq8RuwdmL4pUQrNyh54pzD
TLSH
T1F8C12CA349907C45ED17ED00B4D8A923FDF2B6952DC1D0C36258C5A58B823973BDE5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp402A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp402A.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp798E.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp798E.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33fbe3b1b68fd3f0.bin

Path C:\Users\Admin\AppData\Roaming\33fbe3b1b68fd3f0.bin
Size 12KB
SHA256 b48aa442934c22c3acaf2eac5dd72c33cb8d309de679facfc230930373213405
MD5 b5a355b1b1890b76860f53c60f09a008
SHA1 7b55c8ffa42a2b2ea511637a7b701b9b1d1cc53e
SHA512 8998c71c371d4954524b4ca958f688c7545f494d3a4e8e0331d4a57d71f99d4060afd4091f1f54e538456372396bb582180a1b1814a94ff1969e85935abbceb7
SSDEEP 192:894YMSRN9li+2sCtdZtGhx78AriXatcE6w+SCJe6Hzm3bEHUGwCCviYuvdZj1Ti4:C4QRN9J2sCtdrGhx7DrHtcJe6HJUkLX9
TLSH
T10242AFD58FCBAD2F47620C95A96B21F69F4A93DC111A138B461BBB2645F33C102CD182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 5963e476296c0d5250046c2ea0ad4dcef12a29bae3d4ef5785c0915424ca1cc0
MD5 d34b4e26c493ca92892f45bbe2597d21
SHA1 bb85a78a52df12ffd42746ae3b8f50c0dd0863c2
SHA512 ce3441c5320a6257aa7bced25fc91caa67bdf814821f5191f4a5ae5538cb28d376bcfee46365525b2b5f6a00dc247f63951bcf3133621f85e4dfc8529ebbce9d
SSDEEP 12288:6L7NVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:QNQCBq/McxvN2T/u1mWXMHM9
TLSH
T1EA65232E9DCC9A96F76787B1445D52361E2EBB78BF90C0E7B50022B52770CE19C39E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 89c7e0fcf0a8b194c0cbb89054957f145bd48e47d1c3684c97387d10647ce938
MD5 91261fe81eb78ac1e37cf31f30eaef32
SHA1 eab9458be9082d247ab0b7a8b3551a7ceb467290
SHA512 f31bb54417b3ad0e8643b20f7de7d0ee8c067c6a2ce5f75386b919fbd821ffa3fd3d2462b057801ee0340182b5668b52dec97316c8f9187aba2441f7f77bd4f7
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYnQCBq/McxvN2T/u1mWXMHM9:Ogb4mBIBhGFhCM/XxvYT/u1XMHM9
TLSH
T10365AE1E22EC02F5E1FAD2B88DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 418e9c6b77a46b949db9c635197e158500af69e10f680c6924efe34f4c41cdbc
MD5 17a0d0c5cc9414eb2039f08602db8d00
SHA1 e3df54db99ddbdec3e8fc82d014d167acdb72e29
SHA512 ccf95bb45fa42b115c18bad7181a82c684a28d68d6f42b19b05e4bcd09d569c9b140f9f2efeb420b982dfd9b3f5e6bdf2e7e8616518fdad57eee8228afb2200a
SSDEEP 24576:KG88u8FpJqH1hzria7/mEQCBq/McxvN2T/u1mWXMHM9:x7ZFPqVoa7/4CM/XxvYT/u1XMHM9
TLSH
T14795026976E502F0D477D13889864663F6B2B8251364EFDF07A88B511F23AE14B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d50bc0329d712f6759b871aa54821b3a9ca60567eb8104eba8907ee966cc9811
MD5 24304cdd375bc62f0806350a48b4dfa7
SHA1 ddbd96da4a9bf461d76e39b2085a1e53e2cef284
SHA512 5ac3f6fde512539c18eab8f2bd289d1bb3e21568929f74f77985d01bdab895d07115ac50257fd263029bed865681a212c5b7665a7b62f156447ca1a711a35264
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9CM/XxvYT/u1XMHM9:nG05lO43bpM/XxN1cHM9
TLSH
T1B8D5CF6E62EC11F9D1BBD17CD9C6460BEBB23825033456CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3dc82c8d4704ba15051f0cbed4f8d8a342aa946ed61a4864c4fa00d2a2fc8d29
MD5 bed5ccdc4078975bab491d9c48ead98a
SHA1 82d8e89ac48dcf04e899dfc0df2e9ec650f1387a
SHA512 5ad71bf1139f78b82f84a9f5779240280f5eb64585b58e0a2a97afe528eb75bd49c320a90bae90d5b9c22e755da20a8bbdfb2a83ab42ba6b96b284766cfe1297
SSDEEP 24576:/fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnaQCBq/McxvN2T/u1mWXMHM9:Ha5POZ3+Jt2pasx2+m1CM/XxvYT/u1X/
TLSH
T1DC65BF5EA6FC01D5D1BAD17DC583861AE5B1342553319BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 13c0a9d467a972cc657d242b6a909ab5ec853ad7bd76e1b77273518c2709cfd1
MD5 d11725ba5293b472e7024bde64e6b7e0
SHA1 bad738bc9ceaa35ff9f287d761679bbd5255c949
SHA512 37990c99d58563c15c6142cbd8dbaad8594201e2642c01fdc9fa3df6f02c837165c004882e8c423133bddcfb47a2796391761c73bec48e263f1278a826b39ec3
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7FkMQCBq/McxvN2T/u1mWXMHM9:DNc/zEOVHFYCM/XxvYT/u1XMHM9
TLSH
T1D0858C1A22E901E4F1BBE1BE89779546FA717869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b42f7e1a52a280ce691b7ab66597b85bd2270001dcc760986402e4c3ffed4b20
MD5 5b9d7574d99041a56921ad64bcf2b7c8
SHA1 f0f6fdbbbe2b4e8a37613ad11d670ba45ca964f3
SHA512 a13142bb7f56dbebf1b7ccea1b713cd4f3c3d05cae841929132c07f31c8fd5ad3089fadfcc252052c4c524c2f98dbfdf9603b739df3abe3c29f10e79e260e1c0
SSDEEP 24576:Y8kNvNnaFeYhJNtmZBmWQCBq/McxvN2T/u1mWXMHM9:Y8MwBtOmnCM/XxvYT/u1XMHM9
TLSH
T10555AF2EBAF846E4D1FEC6B5CD238512EA727461173293CB5290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 acfd04eb566450b5addabe7e2fdce621400eb472bf70db59ec39165e8f65729c
MD5 404d50ac5e672253642f836ce1229d57
SHA1 f768653a5200f9b88a214780d8b51b3e509f2f25
SHA512 e9f170a47a6b5c789ae45fe8071e074a2dd5293abad641907be6bdec20421295ad41bb1e501902bcd0f65062266a60014071a4bd3704c24f5c105b5ba9c18407
SSDEEP 12288:KHvUrBFrEjwaQoVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:KPUr+NQoQCBq/McxvN2T/u1mWXMHM9
TLSH
T10285E12F66EC18E5E676E17D89864719E772B8721711D2DF02A0817E0F63DE8AC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 a122a1ef89b75d8865907ed94c890d44906c62fc5e677a5fb0827c0e8b1ef294
MD5 57774c81a796b8b1ce7d1144877c69a5
SHA1 c626b00e1433541f2ead687284bbab969d04123f
SHA512 260db41348446ce285f921c7e02bec625cfd156fc2db7543cc59712033781a61ce88cf0b1031b60828236f27be9c07a4976770e9c1c20381b1639a5b03c65da8
SSDEEP 24576:pD3FHshBIYQgA5QCBq/McxvN2T/u1mWXMHM9:pDVHeBIAAGCM/XxvYT/u1XMHM9
TLSH
T1B195E13EEA9C04E4E57BC2BCCA638A06E77138BD072155DB129481B51F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/672-111-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/672-118-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/672-119-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/672-112-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/672-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1204-196-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1204-107-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1204-99-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1204-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1516-275-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1516-138-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1516-145-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/1516-139-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/1940-333-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1940-167-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/1940-162-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/1940-161-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2496-537-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/2496-530-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/2496-701-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/2496-532-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/2496-598-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/3616-151-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3616-306-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3616-149-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3616-157-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3908-227-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3908-400-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3908-228-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3908-234-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4056-171-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/4056-1-0x0000000002600000-0x0000000002667000-memory.dmp

Download

memory/4056-6-0x0000000002600000-0x0000000002667000-memory.dmp

Download

memory/4056-7-0x0000000002600000-0x0000000002667000-memory.dmp

Download

memory/4056-0-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/4056-650-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/4120-191-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4120-185-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4120-184-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4120-384-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4120-382-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4120-380-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4260-136-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4260-134-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4260-124-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4260-130-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4260-123-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4268-205-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4268-390-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4268-199-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4268-197-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4668-210-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4668-221-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4668-217-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4668-211-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4668-219-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5624-364-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5624-173-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5624-179-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5624-172-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5624-597-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5624-595-0x0000000000740000-0x00000000007A0000-memory.dmp

Download