2d6f9b23d08255b0151ea9be40b1509882cbee4517a5d8e742265f3d9d516b36

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Size 2.1MB
Sample261113-mwpcjsax2m
SHA256 2d6f9b23d08255b0151ea9be40b1509882cbee4517a5d8e742265f3d9d516b36
MD5 67348c93762c228db99e6f76ba5143e8
SHA1 ee3ad3e12b9d16be35749242c1b0ee3403fe0740
SHA512 cce9953fe76ce127b38ff2cf4d576c9013131293ae70a51f54a71c4547ce1bb787f93fd31a1c1bf4d25a0539aba298e934b6c429c536567b61bade600baf4302
SSDEEP 49152:j0pxcrSD204a1CdDJR9n+/Q8kJh9hNhBX36AQgAT76sQuE:j0pxfYf+/4h9hNhBX3zqGsQr
TLSH
T141A5D0527DA04436E431013488AEC765DA9ABD768371A89F77E4343ECA3F9C3247626F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1876	elevation_service.exe
1704	elevation_service.exe
4828	maintenanceservice.exe
2632	OSE.EXE
2880	PerceptionSimulationService.exe
5452	perfhost.exe
264	ReFsDedupSvc.exe
5844	SensorDataService.exe
2648	ssh-agent.exe
5192	AgentService.exe
5444	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\733fd64b31e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\java.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ccf8da85c73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6485ea85c73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008b251aa5c73dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb95efa65c73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f6ca91a85c73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000627bf6a65c73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000967193e75c73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeBackupPrivilege	264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	264	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5192	AgentService.exe
Token: 33	5444	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5444	SearchIndexer.exe
Token: SeDebugPrivilege	4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4568	2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
Token: SeDebugPrivilege	1876	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5444 wrote to memory of 5464	5444	SearchIndexer.exe	101
PID 5444 wrote to memory of 5812	5444	SearchIndexer.exe	102
PID 5444 wrote to memory of 5244	5444	SearchIndexer.exe	103
PID 5444 wrote to memory of 4072	5444	SearchIndexer.exe	104
PID 5444 wrote to memory of 2752	5444	SearchIndexer.exe	106
PID 5444 wrote to memory of 3452	5444	SearchIndexer.exe	107
PID 5444 wrote to memory of 4852	5444	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_67348c93762c228db99e6f76ba5143e8_amadey_darkgate_elex_mafia_magniber_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1704

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4828

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2632

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2880

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5452

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:264

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5844

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2648

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5192

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4072
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 94bb7a3053d2def027b7f2ef1793551b26f35840161666f9b9c19a88d3f7bd9c
MD5 6ace913c04e6277ac9780945e9a16d92
SHA1 d58ddc47a9d2092258278407ab5409099e8bc6f5
SHA512 f9fd7328bad8c947ef70f497b9d5bf37755ee48f9378aa51cea44aa688ca8cc19e3b038b7ff3834aedb1c369fdd5c07029f240156c368c040c8108e10694bd31
SSDEEP 49152:ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnjAQgAT76sQuE:M3q6sjBvqGsQr
TLSH
T102D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 68c33719795853ea3731f4e2a55e83d4f1b082e0c2af6fe1bab505e2505a8146
MD5 1d528715f4ff2e6a26535d4052b5d808
SHA1 d66369efe4002f407c79a8c0f0afbfd734a90e38
SHA512 4d5f44829abc8e5e6df545246b58b6c9c6ed06331f2827abec8a2430e2a4ee76f7c8c40a452400723e330ed8356dfddfb9c45475161b4e8f387c31fc0aaa5a0c
SSDEEP 24576:0XYfDtczAaAfYLH8AcevDN0FImbwQuq3Wia7gD:ztcJAQgAT76sQuE
TLSH
T1DA75F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 55e8300c5b3de1d0defb9ba0d2ec841a5bbde6f2a7aaaaf25a81f49d0af18689
MD5 865d860a32d1beece08b3148e761047f
SHA1 e9576f5e53d4ae5ff410d7ebf0d87e9c9dafa443
SHA512 cc3ba7f21ecfab13d5dc532ad1faec9a06c69f783cec51d20c1b165919c24c4d252994d37652ffa3b9c4ba53b450ba62b4abfb0b539ca716e4189b6129675c33
SSDEEP 24576:10Le5ji0hmxxrM7AfYLH8AcevDN0FImbwQuq3Wia7gD:1Pji0AjUAQgAT76sQuE
TLSH
T16585AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 30b024fae94df8ef9635428feb91aeafc0828e29e89d144d44f3b28166d49545
MD5 2c5b61df9aa64d68f3f33d6914e24eff
SHA1 241183cac2de1fea27fc258f2cd650f26e1cd3e8
SHA512 49a9ea3a27b17fee34a9052a095160664b062649647554c270e8b3ec517330f8aeb64b219f155c44e78e2e4731cf2fa86bc4ac00d54d1938c502ab562dd94e95
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWn6q8wyu5AfYLH8AcevDN0FImbwQuq3Wia7gD:3/ezSC6vUzPveHjyoAQgAT76sQuE
TLSH
T19B755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2ebcad45279fdb1ce689994e3774d67bf476b4c62edfaf62f6432bb0d4bf3e8f
MD5 4d361a76eaf88fe577db68cf3b275404
SHA1 575c44304536619f794ea924aa6e6cdc1d778601
SHA512 75f774e352622cd48f7172d67fd74f0a0e3b987dd5593f0adfd1ed63499ec0f1bd51d0e87a7e69504221883cbc3a7e559aed9e2e3a63b80ad223286240368278
SSDEEP 24576:BVbqPb88hv/l+YmAfYLH8AcevDN0FImbwQuq3Wia7gD:BVO88hXl+BAQgAT76sQuE
TLSH
T1B2559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7f9b99d6aea1d4e8742348e5c1fa24a3dd79dee7c419498b177ea89e57bb30a3
MD5 eb6626b459fa5786c87b467680e90c00
SHA1 54ea5eeb4e6e9fad6e28ab2e14a9cfa07d70f668
SHA512 b4e6dc9c211bf72c43fa8279137ca006e8e7d341ba9900d567f83f2db4e9c8d039f0b2791fe13af284451562e5494c01a38946d6499fae7328bd2a57cd891def
SSDEEP 12288:oL3AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:oL3AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1255523574A4C70EAFEBBD1369CBBA5B963D1BCBC824497AA00463BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 040cf228085c97613d6975ced57afa49d6ac0f17265fec1ba971880b731620cb
MD5 5ecf4670c6a96231b85d5f732e738446
SHA1 4a48b209b7aa1e4ac50ddf4b73197a92dca9e6c3
SHA512 c51ac1d6cad4a85dd4743b3758f73ad2ad68184345f08ee549ed6578ee63107f82a45381e188642ca888b5c5da1e9ded5c41122209837eb413d05fce9dfbc7fa
SSDEEP 24576:zJIUeAfYLH8AcevDN0FImbwQuq3Wia7gD:zJIUeAQgAT76sQuE
TLSH
T12E75CF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 20ac5304359419a9d214daffdd0575dda1f2885d1f1f1a3742f907cd502d8110
MD5 2137f95745b5df42828ed6bcf9f365fc
SHA1 16135a0c92cc569fe35d694ce46cd42f3beb2ef3
SHA512 5c843203fe5409cd98b3aa103b42d2bc9247f7c19c9f7f6757872571cf7e4f141f84375a097d44dd22ab607db1a392a5efd4daca1af946350bfe510d0bcffd3f
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THJ:fQvGAdlCEL8c/DRNw5CyqGsQr
TLSH
T1EF266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a003c209ce68c0a4ef88a61d70c4ba745e6a58283e5086069a8bb3b85b282c2b
MD5 03713c5d1278512fdc9d123b722a6ba4
SHA1 9b2b372864e28bb97ab6762f4145a40b78717993
SHA512 9c822811093af3f0d2349a9aacf5bcc945863ef66e8f59f9cabae640d5219a1fc273ff7af98f6dad191af0e7d809165307180dc0dac6f12650418cbd94d4a026
SSDEEP 24576:W0ewsAjEAfYLH8AcevDN0FImbwQuq3Wia7gD:HljEAQgAT76sQuE
TLSH
T11675E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a7d0e9476c39f777d70eb7fa541cd27d02cd7780d5470747c4f8e00138402150
MD5 08b6916e393b0a955470c377451ea24e
SHA1 1ee06199f1eecfa967faf5d35e528e4ade5b297d
SHA512 97ca5e3eb49acee7b545dfd8b6f8308526635b21c490c9a722e9f9b03f11d20f3427fad952e84b7e58767628cdce7b19c8801927a9ead2760f253bd25ab244da
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHnj:aUEtQevvqc2W1cpV2tI32
TLSH
T132474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 12f64d52b145ff8a115df959aaff0f6859e8d27db797e0e2a78b19de0efba03a
MD5 659a41c761dff9683ccf450ecaf72e34
SHA1 953f6d37d3f1e17f682011b63f534197e8dfae7e
SHA512 ff5694feaa14ff08975bde7fbed07d1a87d423e1902339732a0737d888a4a5de5a3b497e1fa09ed367728f31bca909963b95cf37134de599f4cc8c17a3a14ee7
SSDEEP 49152:eCbRquA/m2yL5zTfFiV+XenmE3/zkAQgAT76sQuE:ToquVjnmGqGsQr
TLSH
T134D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 41560ff537104e6b6a6eaf4ea0e5daed8631c70704a862b2d9c074eec15201b9
MD5 68d89d542e5efa5e190c82b29245c066
SHA1 0dc840108c32006e0d3b4a641d3bf7510608e648
SHA512 48a8c639e66ee5bbf3ba63ad5c256dba65c2974f09d18d8f97c3f6a1b8f382a206affaa244953d1066c5a8ab2638344a7735fe6c4d2e28c9568b480428562417
SSDEEP 24576:4AhGL3IFoiwtA5l7S53dAfYLH8AcevDN0FImbwQuq3Wia7gD:4AMUFoiq5tAQgAT76sQuE
TLSH
T17C359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 61c902a43b61866b708252b5c3fb927e63b515d8be7239b06f781b45acea5ec0
MD5 fca7ec0a11753a88e81056454a41c7c8
SHA1 17a60bed2a4a6f0ec126007baa75f6fb99f686df
SHA512 1263bd05e658643dbc837999ed0471cf64e06e33b39bd3d8b7f1a1464de564e93fa32e80d211c07142e0a4ab6af79b5aa9c93452bd561f3adbf01814769ac814
SSDEEP 24576:hwu4OWIAfYLH8AcevDN0FImbwQuq3Wia7gD:hwvORAQgAT76sQuE
TLSH
T16065F14676A81CF9E9A7813985A7C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d6ffbdcb41e0574bbe047a1ef1358cb2e1b47150b5ab309fa36192f568288608
MD5 3aba324295382c489b8b4d9b6d559e45
SHA1 1ddf6f0639d6754399635cca9040df24947062c9
SHA512 294e74b0b1624114f526eb5aa14b7557a53ae651860a752c4d76563e359d749457a01ba056c783cfdcfea13c1d5653d155c8c8ec817de523802f667a41e2af55
SSDEEP 24576:7ZuTAfYLH8AcevDN0FImbwQuq3Wia7gD:IAQgAT76sQuE
TLSH
T1BD55125B239830FAE5A7C139CCF65659E3B278A6532283CF0115079A2F37AC59D78B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cad114b1bf7c160d0907f58d389fa6045df6707bbf638f262ccea19a2bbfb1a3
MD5 67e733b7bffd260d32254ad7a941c7ba
SHA1 6fac6577326461944a2e3006f71787d900a65991
SHA512 fb58f649f5cd992c19e7dc63af9bbc4fd245f4ebb7907a620a04d284f127d8f8532b0d8e50a515a9eba8b26f7366dcecd995fa3d074c86d2b8f433a79ddc4a5d
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UF:oQRQyi36YOcPbLvw2gAf+PN3LqGsQr
TLSH
T1B0667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 10478af083b2f67ecda5a55cc0847115cc6f05146390257d9b41714f886f9684
MD5 8711dc1d6576d808e31863195c9431a1
SHA1 a0a0866839ecf6c8217a93450f5f249d4f5761ed
SHA512 3165174b81193ae2fb6ed020a1b97c89adde83f4892acb65132b51d419bdb73caac0934e6de1ea625df8bf6ed464bffafa1b54f3457769ac72ee815f116e970c
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UF:RQRQyi36YOcPbLvw2gAf+PN3LqGsQr
TLSH
T143667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 73140ad7a563e6a33a81b59483cda6726ee66c8d4f0e2a7bec357faab62cb11e
MD5 ed266fa0507fb1f347b2d47bc87d9bf7
SHA1 ef054b79eedfb525246415979858bc19362fad82
SHA512 bb12abd5579b89133f6eb5fab91ed40a0ea9e32b3f34485eab16c0c6f3e6eb1c6fd74381222e5a1a4ce66a9cd0e7229412c8f7c438d4f9fd4446275be99f831e
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0jAfYLH8AcevDN0Z:G68Qg55nhceWu7PNU3/UAQgAT76sQuE
TLSH
T10DB54933B2F600A9C44DE1769F4A873196D17C758FE1E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 781e1d67bb946ba90c7988a2d52880b8ba2e55a3d4ec01f95cd7874bb1c8fb4c
MD5 72b3f3a228092b66e0070a526e3ae786
SHA1 9ccc0e7844f694075acecce011f37230c6059aad
SHA512 6aad791e2994b540cc53c2f33dc5e50fc7ceb623099b3339f85530cfa77f75374651e6dffbdda860b3c3ae6f7f274aedb2bd1f8280f89e16ab21f21700281b35
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99L:Iy5112gYy5azzVvt69nLKnhZcqGsQr
TLSH
T1CC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 308e8433099dd76ab470c974c11e29cd44250501a74d74a582ebab78665dd47a
MD5 092e65d5dedde18af28ef6e859945c40
SHA1 fc56f8ba6e3039921e0ea6a83a9d60d5635015f1
SHA512 cb0651412f479bd5bc2272a5bd8dd198455c722f5f2e8fe2ea92875de97053643e47f14fc49c790a9715061407e67ad785697d010c4b9feab916fa0a6a497eec
SSDEEP 49152:BB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glqAQgAT76sQuE:Xu6Jmdxd2dDqGsQr
TLSH
T1B0D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 166115d214ee5e96116fdef0a4d9a2523e28d565cad3b33b9e05d2f851dceabd
MD5 5bcc60ad4c8915279e45a0e2c7abe940
SHA1 7082a949b1b07453b8e7baede295e041ee98b106
SHA512 8c2fed762b9de8d987efa20b496f21a5a945609666731c098c29087817995ae21c6c014fd25a27eada41d293f5462f8937e47b1e98c9081c0e370b60b9c0738a
SSDEEP 49152:11hpsNoJpF1A63U44CwH7R4x+AQgAT76sQuE:1mifPWRGqGsQr
TLSH
T1A0B5BE13F2D900E8D06ED17887569232EA62BC450B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4788a6e4d7ba7d5f5c11b1e6c4f192df05cc097f3beca7ff8ad742ee0c0c46af
MD5 4b1993b9598e979a321c33149f09eb52
SHA1 d0f67b38e62246e74a52ad1052263e1221d8d229
SHA512 9306354eb794ff588391e12588f229bfcd845b7353f368af6b3f8d5e664398e66e1d3aac9d449d2da420a64400b09f8788604c366d95d8d292ac0fe728a3e487
SSDEEP 49152:USuZQIY0Be2KcRVtOnks6NMHqTAQgAT76sQuE:G5dKii614qGsQr
TLSH
T1CAC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 25ce823ec1d0eebbb962bb4287f84e9422a6e2b93a8630db4ec1708e61f36cdf
MD5 92342da78252d6cf4f3b5d224c7de694
SHA1 3d97578ed7c8284c1c65e99a93be96ccde79ea5f
SHA512 d17928ec8f5317c3ede90dbff61d62e9571239f2c35cbbf9f23fd27820a55eb7d9582431c1819f8b612cdf9f168cb304896401bb67f0bd7a10f0cef307d6c456
SSDEEP 49152:thtSn8EApI0fig3giDn0AP5waAQgAT76sQuE:8X2imph6qGsQr
TLSH
T1E895BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a664d8754802d4d3d3a3bb1ed315df2bf322bfdfeb0063dc3cf143cad7b7de79
MD5 8b6877b99514904aa51c163d5972c99b
SHA1 15e9cdbd36bb2c6a45dae89fe6e3850699c485c9
SHA512 cef47d878db6b5d72e0aa45f9bea046489f11d249906aae777cfb0db38e26ece991d355f2158bcebe75c2403022a9aa36d666f98cbb78b73cbf27eebabc9291b
SSDEEP 12288:UvAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UvAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14E55235B594C70EFFCBAD1368CB7A1B8A3C07CBD9346539A110A278A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8476254c439658fac004fdddfd8fe68f9a9f25f49891c1759e60d5f9a4b17482
MD5 e4c773b91f6b417695916414ffa19f73
SHA1 33dbeab4b1286b70a83fe1e5b4a487b780c94db2
SHA512 79aa63196454247a0d5ec32222bcf294ea52bcba5c31959cba95bdd43580c3eb4c8e20fbcdd8cdb3801172548ebfed45dad02c40a7bf7ffa9c6c158882d648f3
SSDEEP 12288:lQAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:lQAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A455235B594C30EFFCBAD1368CB791B8A3D07CBE9346539A110A2B8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 56561e88ddf1d8d6f268e08f5adf4b8237fee67aa68464722381183d72f36b96
MD5 b65c86ce86ed91d4c2ff18b9631f551d
SHA1 4bc07fc4826bd3d6b167f82539d91e4c441c4ca8
SHA512 7beb709a7b18947cf18b4c16a7d21c1ee8fce2af7d189ffbdabc3fece1c907f644599e7ffdf3e2ec87a4a4e578809b34570def4c4b90fa8d6b55664b4c64c8f1
SSDEEP 12288:m2AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:m2AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14A55235B594C30EFFCBAD1368CB791B8A3D07CBED346539A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 738093450c56ca4d15373a8625b44fe5a26dca3e0edfa4cd8bdbbccc78dca9d5
MD5 9203be5a3a0e5151d1160ac23c5d5e00
SHA1 7592772eb3754e5822ae07785e6c977cdc18e815
SHA512 bbe0ac8d1ecc0a35649a8123cd0f40be01574bdbb8d0c64414c50798ad2ce3bbe3e7b918a98a7cf585e7c89ffa0f0c03e0169aca9b61732f6555c609eb9a1830
SSDEEP 12288:1V9AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:NAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T128552357165C20DAFCBBD135CCB791B9E3E1BCB9930293DF46011A8A2E3A248D1B4E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ab9bbf7a9bcb8276e5691f90e39be7a2b6c672da965a3e304a7b09790ff07109
MD5 3918f5fe6d8ae0702f7356f157e3ce7b
SHA1 852a0a1330ba29abd8fae33a9b1078319e532030
SHA512 e2a95f7174447d4a7cb47e0b2db04d64c4c9078b29d3da59207875ecfef77b9fc94d0cfb84e2642728d6c9357532b71783deddfcdf8b3c6535b55bd021ba5a4b
SSDEEP 12288:olAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:olAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14455235B594C30EFFCAAD1368CB791F8A3D07CBE9346939A150A278A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 43c15539670f9bef64bafd30664cd47f3569797a80db01d064c5d648639a6cae
MD5 de122a96d2536a7019849c3c9270e57c
SHA1 29f65765a3e81364401e082673a9dc24df9d4ff1
SHA512 377c73132a2d9c8190d5dcb6b17443a7ec078afd20ce3ae7e5e1dd24993b61019a1b146b99f602c62f8e335404540afb174370b60f9a3793d29a366c81aa522c
SSDEEP 12288:78AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:78AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B055235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A110A278A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4b3edea0247ad4462388ea09c0042ef4ec756f3262c7239cd51b2b8351c9a51b
MD5 14d1d6d37f0416d172bbb376099a4356
SHA1 74d51504eff1165bc45baae01bec86dbd1a30cea
SHA512 4644a520d5452c2c2f825af5c5dda6d1c95640ad1380f3e9b25f56e8703dbc154a6b67ca1f59c79efff2fc289bd91664df9cc31767a2842db39183324c9a90b3
SSDEEP 12288:cYAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:cYAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B855235B594C20EFFCBAC1368D77A1B8A3C07CBDD346939A150A2B8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8b2eb75830c1f852ec60b384274608987f23ce870193da03403bcf9c9c66f84c
MD5 3bb441fe19e4eee87ab920322bdee6a1
SHA1 2bc049be78566a65d8fef09c1dc4c5144f15e1c7
SHA512 68940976100656321475f9f5f5ec3405d2f4d72feeed942b92fdceb40c9e2e19af19a8c5e3bf41f3167ec5c628263045d39ca3edd2427512559865dd5941956c
SSDEEP 24576:rZMRzFVSOwAfYLH8AcevDN0FImbwQuq3Wia7gD:rZMRzfsAQgAT76sQuE
TLSH
T1F2750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2715b12fb0898269b446f44c3f59aa5e0414121732da42ba1a59c06e35903b42
MD5 e645a21609b2c8ed5802a8047274ecd7
SHA1 262ca422847287811bda5cc49959e36afc616779
SHA512 e96e59432333e65045defe9f5a5196c29748be7e8af3457fb1c25dffd826f77d90934305a0f727bdefe6fa0a01cbea869bfe4cb38491d8b1721a1aa4158df978
SSDEEP 12288:FDAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:FDAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18055235B594C30EFFCBAC1368D7791B893D07CFE9346939A150A2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 415513b4ecb3e5dd42ebf145f09c7a2111a76f2146e8083ab66e7725174f37c9
MD5 b96b4a98c6e135728ec29f0aa58bb256
SHA1 f66c437dd7fa916db618808c8f38bd20e12b5401
SHA512 074a9aa98eec5233d1b78f57c77226f8a1d4bcff0ff2738565eb322ea1b3cff97e11e88711378aa85880b0edfd9db7767644c0d17a982f9da3d96a5a8fbcdf64
SSDEEP 12288:3nAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:3nAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1BA55235B594C20EFFCBAD0368DB791B893C07CBED346939A150A2B8A7A3D418D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a640e1a3590e3174a38850144980b808c29fde62dc4b05232f8995719d270db4
MD5 7cdd866ca1968e8864539fe61a738c45
SHA1 8342745af9497246db492f719d91383fe8e20787
SHA512 ff26457e169d56b6f0a620afb906065ff8e4aa1dd94bc9ea8fb6f1379a55105e20a6022b53538e82e20edaf33726ec589cdd1ec1e3003d85ad6278f924d706b4
SSDEEP 24576:szy0AfYLH8AcevDN0FImbwQuq3Wia7gD:sxAQgAT76sQuE
TLSH
T10365010763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 96d9539eb82d95a95d28141a169f05bd1b2a5f517556b4c5bbfe952225b9b29e
MD5 9351384025c8944f70e015a763e0a1b8
SHA1 5fae2a8c7683e1fddbf77ca0a087cc21e4da5d19
SHA512 5ce179579e6dbc992a9d3b64dbfef0e25261128663bef03d2a8001a8da398ce4baead8d7863a4514b53e28cff5aa56ffdac30ac4dc781c26774f15b0b7ac6336
SSDEEP 12288:EDAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:EDAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D455235B554C30EFFCBAD1368D7791B8A3C07CBE9346939A150A2B897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5c69c3ad83f2892493a50e60b4931ba1422c6adb0d1b385ab5cd4b18ff30d756
MD5 59e42f1e73aa52dbc98984caaf15f58f
SHA1 42ee91454727789986a96dbdd6d6dfe7f94ebb9a
SHA512 dd4c717a55ab4f71e5145350e73180afb3590bf30ba15eaa497c5b17773b2d955725ef9757b20687dd2e37f09435707e806ccd0d2bf8c143946443994a1cd46e
SSDEEP 12288:iDAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:iDAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15155235B594C30EFFCBAD1368D7791B8A3C07CBE9346939A150A2B897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d63b1a4ff32e590f723cef4ffbc3e1e26e9bc9fa642c434746648be13690b3c0
MD5 5a5242cb65be5396df8b58e405185156
SHA1 ce5b4e234b9cb6f5c83e9e225bcd5458a746c8a9
SHA512 8064d16932e0124e8497e0d8de316408b730f85c76df1129bb974f332d5beb5ae9198392040a5ec608cc959a7cc47a344ff4e47eaa42f72d0a3404ca602e5923
SSDEEP 24576:8zy0AfYLH8AcevDN0FImbwQuq3Wia7gD:8xAQgAT76sQuE
TLSH
T15B65020763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 40deb1d72a6f7543136d70ee3a3201529a6ee681873bfc764718847e879d88b5
MD5 fb39eadc86c8f2560f1ef4d671b1eb13
SHA1 93c34b392163ebbfc88e3d9b4ba750f2c5462682
SHA512 ab2a336fce5444c1748187c7b4ec652920890d6ee312e5bec737155da624f3a8e9701200dc1a7da065189100748ab168e03d59bb2071715e0fb3ca4b0d519c85
SSDEEP 24576:7TDaLl3z0zDGAfYLH8AcevDN0FImbwQuq3Wia7gD:7TuLlj5AQgAT76sQuE
TLSH
T1A3750195B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 e316f61bc7bb6fd8e52fc385677ae9f453accdb4b9fe1d1e20d5b7086af057ea
MD5 c64d186ef5b4666c706d1e9e7f399d50
SHA1 897f07d29a3255ad2308e7b0f5e8f8dc5ddbf78c
SHA512 99b44c526d38762ed8da5b2bb74b5b12439ffba721ecc16e85a44f4a0f8516b2972e333e3f40c57402d4c4dedd76e28965b3948d0e4d4f40954da7890ab87408
SSDEEP 24576:u3vd9CHKy7GZyAfYLH8AcevDN0FImbwQuq3Wia7gD:wvd9CHKyasAQgAT76sQuE
TLSH
T18385CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 784eee2118e323214268c6a3a6eacce4eea7b400fd012d5fda8a825bc752440d
MD5 e39097fc6fceb84a1d64d308e852a772
SHA1 d632b74772c6f036aa9f825072b4d8904e27aa1b
SHA512 ddf5fac470634cefbbe0a5c784d4383ae8d06d5d810e8080389bca5e8b0b5a8a45e657a548567649d3eae9d5b55d73867314fca66199767364484d423d833730
SSDEEP 12288:3WAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:3WAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A655235B594C30EFFCAAD1368C7791B8A3D07CFE9346939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d6a515cee330676a21daeda5a9dc8f18dc1de2a25e1d88aa39377d6a848a5d78
MD5 b97912a70ff1fbc683b830e3741186b1
SHA1 e3d278933c7f39cc8f38f420ddd2fb39fb64a105
SHA512 0c24bc7353d16d0f881d3739344574255e85919febc4852897ada52bec964481ac51f5975c8347fc92a3ff2f88b69e0f870d34cb11b13c3a9f89913abc83f517
SSDEEP 12288:UUAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UUAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E055235B594C30EFFCBAD1368CB795B8A3C07CBDD346939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5b845a26e8cb73a66a744a4d82293c5a4966f4c20718953ca79ca068cadfca76
MD5 89b9ba2db8426ae163f68d6374b2d2fd
SHA1 cbc015bf2d4cd3b66b984f6065865408b9f94b42
SHA512 d2d75503c5a26067df85cd3d1674fa9bbdde0253066ecc42b68a8e884bd3e1fdb200578dc74fa9e3da3b9c12b535bc714d70ea1876e029273b7731844c6ca5f3
SSDEEP 12288:1hAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:1hAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B5552357594C30EFFCBAD1368D7791B8A3D07CBE9346939A150A2B8A7A3E408D1D4C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8d07eef386a07e2d8578d6d5041ec49324b46e53089f15bb76126d1eee0bf9d8
MD5 9767debcfdb7e74e0cee79b80bd6cc60
SHA1 026d8cc2b1b0758940b87bb6b3c23c9ee5814c69
SHA512 ec9d256c75b461c0bdecf2d96559af25c7a5a3747d386a68f793672b92e4ef4c03025a5fb2fa4ecdecabbaf548d76a6c9b6c7e11886370dca26b426ebbe1aa03
SSDEEP 12288:gDAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:gDAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11B55235B594C30EFFCBAD1368D7791B8A3C07CBE9346939A150A2B897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 72a62294b9d0078324e4b220aa736b6d0b5cd1f8655496888719d62730ab3901
MD5 422501107252ae8630b217b6b622c105
SHA1 7a3310804bfaddd315bb3e63e765ea99d030a6f7
SHA512 d2c6cb9ffffc7ffccf7b2836229eda39aea84bd520ef16e6df2ceef62dc083411335c03ecbb10939c58f7ad906b2b27a8a2a39d03893e669aec675e0f868a593
SSDEEP 12288:NWAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:NWAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15555235B594C30EFFCBAD1368C7791B8A3D07CFE9346939A110A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 7368daf37a18a2659020399463a57784204921e191bc8c045955b3566bc4f55c
MD5 fdbb1d483a05e7ff65ad20742eddc41f
SHA1 d935359fc4f9e15f3b70d33220ee42c70b846666
SHA512 b8c81a71685960b9ca0ab63dca64a49451db560551174331a9b1cf5c9e56a67de7139377a99d52164092818db0e75a7e2739fff2e59a70b2aa5f62e988b84df7
SSDEEP 12288:nLAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:nLAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15C55235B594C20EFFCBAC1368DB791B8A3C47CFD9346939A150A2B8A7A3E408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c0f876473efe95ef0f8d0d0878b0f1483ccdeaa7691acda84e9016d4d71cd2bb
MD5 efca365a901b5c30cd416bff2f837079
SHA1 c0ccda8a7a88ab2e82ebbdf2c0c3f3747f3d9d18
SHA512 766f7e1699dca3a01af3352afeb556e21a5c713e6344bc32295bb9795c7204b5db5e6271c54b572ea1695a5cfe5aa606cb8b2c442fdd62458e0f17c88ee4365a
SSDEEP 12288:nlAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:nlAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D055235B594C30EFFCBAD1368CB791F8A3D07CBE9346539A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 4a6fb5697862d989b9fb00abb7b137face3c0c44b6d674c84b26836ae40a9e31
MD5 a5340345af60293e0249c20d1d756d19
SHA1 8a3d156e46c9d133e168fbc7f1a2d68b013f8be6
SHA512 ea14513b655bf8e1fd047c92a9c1fb868b37db003ca4a1f35fa012723075e63d4591d3a932292b5cdae8bb04c68d2a6cb9e373bba3927eaebfd00eb8e8e4355d
SSDEEP 24576:kfwvUk9RX6wkyAIXAfYLH8AcevDN0FImbwQuq3Wia7gD:gMnYIXAQgAT76sQuE
TLSH
T19F85CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ce415d337790599e4a7c82ecbf0fb02fcbcda0512aa44daa413c70298449850d
MD5 2bdf2d7cccebbbf7ea50582076955559
SHA1 057491277639258d87f8918b7ae7345926510405
SHA512 50889cd1dd61e8aac2ff62c7f316b438bb00aa7d66e80db7c310d34d9ab23cbec13dae78b3bb299e26f565ed13ccf4b77e8fd39983ff3c9031d78d9050ef0fca
SSDEEP 49152:wYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06AQgAT76sQuE:XySzPrqGsQr
TLSH
T12C066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5a274687b454103264ad9b3932c4e7e6eeb2af1199744838c079b67b738be7c3
MD5 2bfd480313c1f4fc3df927c11955f04b
SHA1 90e180e8b24a8a2c1acfdffab919a59634483103
SHA512 01e671d5dd006fd6d2115913f70f415fd360e87420e14410ec7f98c5cdd3e6476f75d5eac2558d82b288b8eee1758574c58ba28cf9506f38d868b134085c4504
SSDEEP 24576:M47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYgAfYLH8AcevDN0FImbwQuq3Wia7gD:M47JUQjTirIhCnDHUPfF/qAQgAT76sQr
TLSH
T12F659D1EA3EC01E5E1BA927885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 751ee1a0c55e2ecd9c4b6392be575a0f1d9d9bcfe2daaaa65dd6d91aa9dfb4a9
MD5 9644e4c38f3d3392b0e643f5cc8d4477
SHA1 a1edd30a6db9043805d9f8b4e74330e7c10c84f4
SHA512 b1fcdff372e3fe6bd8d481d14409e6f14ec78173b53de4f60dfd5fd3dff89b94cb0b7a023b90727f17ad702d0b8f3204e8ed2ece43ba01237a5a0dcf8011f155
SSDEEP 12288:1bsfTAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:QTAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E465010AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E1F3A6909DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 ae759b904b334eabadecf82fe97e7f3f62352d354273a354650fbec314e57a51
MD5 01b7705c5e27137f8ba0b89a117340f6
SHA1 65d47ce1f94e04cdcbfed9d6ecec1c3fe9a53ba0
SHA512 3a50134c8346b160e0bcac2b2c6c0d68857e17363b3aaffaff356060c9c5417257dc36d8caf15c4c7df7a9cdda85576479c12430e37079d86e10a19df12283f9
SSDEEP 12288:ZFRfQU3f/ixgvk0F56N5SPv2YJXPpAirk+s5:ZFRIUP/Z80F5tOYJXRAirtq
TLSH
T16C352810B666CB5FC66940325E37C5CCAB707D41EE84AB0372C9873FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 61d2e34b7bb4c51ca68a95bd7b790df5251cb6593a7c002b518340ac1095bbac
MD5 c270376d9f3a9585bc27d3c6b06e780a
SHA1 2e817942dc1849623a1c005ff700cb793a90b953
SHA512 5997353b44d89b0b85ff7761e78309b1480ff19ec88d7ca9fb3e4d424c09fd866b6bafae8cd8ca60f50fc43f9911fd5e2156f5904714fb4b79102f29dcba47fb
SSDEEP 6144:3CWzHEqCVdxBG2qhzItYp4INKA/KpA/+krC3e4LTjvtMxjSEjvtMx2rU+5KZfKHn:3CWz23Gnqe4L2YfuVss1fnqvpB5IU+
TLSH
T11F750940A537A78FD1B72032072A5B4D6774EC47B7496F22A3C9093AD86BB11B1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 57246c9958bc7a6e1ab8c3b6f34c3019a67d818f2f3a77c7149063be782499d9
MD5 1840db0aefd22cc92dc649f508e9bc7c
SHA1 0fdf3cfb715d215514c225f8e391464b598921d3
SHA512 70965e02f2fbdfbe936216723f06681782d90b2b2b1822d2847046dc7d4abfe97ab210c90103edfd934d2606a6eefaaca15ef22e43a7d93df670964708c08ea2
SSDEEP 12288:a07bAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:bbAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T122552357874C74DAFCBAD135487B91386399BDBC870092DB640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9bd6ce7e794c9a648e3d29e7a5185985ad9c70bed54427b2dd506223deee1369
MD5 11fa535ada31a3ff27c17ff71ef72a94
SHA1 2aed3e0cd5f32e3f22e6edb5cb1bdc801267efcc
SHA512 c26db3128c4f43b1c6d959293bd670b58a91ce13bb77dd169b7c1ad828db10d629a526311e2e15f7ecfa05dee286547b7f58366d97a993d048c50abe38888462
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bY5AfYLH8AcevDN0FImbwQuq3Wia7gD:Cgb4mBIBhGFgAQgAT76sQuE
TLSH
T17065AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 844442377a02b9c40be2628399cf926ed54e1b629e9d956c606951df9dfd1d6f
MD5 32126883ee874821e79280810bbd664f
SHA1 002319eb120a00e625e3192f33bc491e27c1bb65
SHA512 9ae9b73bccc907807f7f63afbda2fd159028d7e059b972df2a471232f0bb8e5b9d8e8334e3ab19ad5acaddd1f102bee4565133d0a3f489bf5c99b9860d3e7c63
SSDEEP 24576:4G88u8FpJqH1bzria7/mwAfYLH8AcevDN0FImbwQuq3Wia7gD:77ZFPqVea7/BAQgAT76sQuE
TLSH
T13685F16677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9f37aa2db02a35b88c6d836f94b845eff3fd1b54e435038ff07c33d363f68993
MD5 4347e5be87d2fd43e3a621cef451748d
SHA1 0203cdda132211382a2da36ad084a3d3c43f9d5a
SHA512 6087238e9f42fa5dab05082f1422a7c314f697d34a3a78daafe16cb4edf6796a9899a5d3a50c0635f357db2b94cd46b047ce4935eb42266caec3caf91d3ec93c
SSDEEP 24576:wPUr+NQsAfYLH8AcevDN0FImbwQuq3Wia7gD:wJQsAQgAT76sQuE
TLSH
T12865E12F229C18E5E67AE13D89968619F771B866031292CF0291817E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6f4c93f8fb9e657f1f2d693da1ccddc9e2b2a9be0ff62ab1da76d27fc323d768
MD5 20c340549d9c98539a257deabee1bfe0
SHA1 dd62d2c7e31532193a10d543f7dfc98063625b05
SHA512 e37be30e62e26e0b87be4c53736a284f4b564fcc1432bddaa04a7ec3b2eaab151ef44ceb135a27bc2b2777ed6279ae11f149fb4dc46f2607e95d84e4b44e622d
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8AQgAT76sQuE:PG05lO43bkqGsQr
TLSH
T10AD5CF6E62EC11F9D0BBD17CDAC6460BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4c74a84ee5f0203469334054c15aabb6dd7669c69ea93687de2803fa249789e3
MD5 9e090d33d087f826834c5d5e4ee98266
SHA1 7ea8c7b0f958211d8c51087c6f8eb6fcc6979fb8
SHA512 7d439aaca8be721b017c68490ddce3535f025c04ff9b2a70c2d8cb6f27aab2bed70d5ed3d14b48e47dfd7c429b6e27f9fa015003c2a2f4452dd130a4b88b746a
SSDEEP 24576:Nfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn6AfYLH8AcevDN0FImbwQuq3Wia7E:9a5POZ3BJt2pasx2+mUAQgAT76sQuE
TLSH
T10A65AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0195302ab891a8d8bf04050a1e4fd1af4ef56e71d1fbad4dfbd706d81bf1cbae
MD5 46cd285099013f0a95d76da0701910be
SHA1 e178efa3653bf420e64ed65ec17e7430484e80f1
SHA512 cfe1bdaa327180ffa5fd75b74630be68ee6107b7502633cf71806fa8868dde45bf36f46f01c9cbe00fa37bea1ace053fc956963d6260b86516a8e9d8384d22c5
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkoAfYLH8AcevDN0FImbwQuq3Wia7gD:3Nc/zEOVHFhAQgAT76sQuE
TLSH
T1B1857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 efd940ffe9e2901b755ff0dc30faa394e643dda50e69ac49ee3f0bbefd8b5eba
MD5 1e2be31e5dd5e4da66b6e5d094876222
SHA1 b5d6d749a66788e974f7eab05bb4c5fda7214f80
SHA512 822a47b078698f51ad6407d6a9a96c8709d64daf27416eb5b0b93d12573bc52b59f99508739306c515ed20bd3cb62974ad6e23152ec012734bef1ace3a8d169c
SSDEEP 24576:9TkNvNnaFeYhJNtmZBmOAfYLH8AcevDN0FImbwQuq3Wia7gD:9TMwBtOmOAQgAT76sQuE
TLSH
T14855AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f24c87e0d876ea3be8fa596cd28bfc9aa07b43792e2c739b3054341ea2b13556
MD5 ffac79ab04df743c885f7ff3fc3f28e9
SHA1 142272294f74a67abea5da7578a8720724600a26
SHA512 105702c8afcd52e781177c5d40800f6e2fdea76bc836a46c339e4782c07526ea259b6abc6a1c7dc6e6e153d3d941fea9f2856f5fcb64e6352cc48b66f61011af
SSDEEP 24576:OD3FHshBIYQgAPAfYLH8AcevDN0FImbwQuq3Wia7gD:ODVHeBIAAPAQgAT76sQuE
TLSH
T17075E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-83-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/264-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/264-319-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/264-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/264-89-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/264-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1704-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1704-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1704-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1704-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1876-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1876-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1876-14-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1876-22-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2632-60-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2632-300-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2632-52-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2632-51-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2648-307-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2648-114-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/2648-108-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/2648-106-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2880-301-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2880-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2880-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2880-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4568-8-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/4568-1-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/4568-0-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/4568-77-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/4828-47-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4828-58-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4828-66-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4828-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4828-39-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/5192-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5192-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5192-127-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5192-121-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5192-129-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5444-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5444-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5444-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5444-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5452-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5452-302-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5844-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5844-304-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5844-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5844-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download