Analysis
- max time kernel
114s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 1.8MB
- Sample260708-empmysa19j
- SHA256 fbce7d4673dc2960626ae52716f5bab5614785f9cc48e2183c08bc9dcb54d66c
- MD5 ede17aefeb0ba5ffa83a90f94835286d
- SHA1 a18667f6a2d0f59e70623988fc2e213fce661c8b
- SHA512 29b0220b444500ea4c5494ac018875103e5f8f47dd5436a8daeba67f9ca5f0a5940f54af4406b20b61efe37ffbe64779fac99bf17c041b108831be56a38a30ea
- SSDEEP 49152:nNZCWOLT4iWGs6mgK2MtENCWS1SZBnHTAsi:NwnLTaGsBJcNzAz
- TLSH T191855B0667F94128F1F33B71EEB992645A77BC71AD3AC50E6280125E0DB4E90DA72733
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 23 IoCs
pid Process 5480 alg.exe 4904 GameInputSvc.exe 5892 GameInputSvc.exe 1684 elevation_service.exe 4272 elevation_service.exe 1000 maintenanceservice.exe 5784 msdtc.exe 4440 OSE.EXE 816 PerceptionSimulationService.exe 1228 perfhost.exe 1536 ReFsDedupSvc.exe 1648 locator.exe 1856 SensorDataService.exe 3260 snmptrap.exe 5156 ssh-agent.exe 5820 TieringEngineService.exe 5308 AgentService.exe 4760 vds.exe 5712 vssvc.exe 3968 wbengine.exe 6032 WmiApSrv.exe 2916 SearchIndexer.exe 3280 AdobeARMHelper.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe - Drops file in System32 directory 30 IoCs
description ioc Process File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ad393ecb9f43e826.bin alg.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup AdobeARM.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeARMHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeARM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071f511e78e0edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e5759e68e0edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a45a66f58e0edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2cb7ae68e0edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dca8e7e68e0edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe - Modifies registry class 39 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1921861047-1272335887-115070671-1000\{499EB623-714A-4ECF-8A4D-1F32EC8854AB} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1921861047-1272335887-115070671-1000\{5BD2DF35-51B7-40FC-8EAC-25D51E02AF4E} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0200000000000002 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5892 GameInputSvc.exe 5892 GameInputSvc.exe 1236 explorer.exe 1236 explorer.exe 3280 AdobeARMHelper.exe 3280 AdobeARMHelper.exe 3280 AdobeARMHelper.exe 3280 AdobeARMHelper.exe 3280 AdobeARMHelper.exe 3280 AdobeARMHelper.exe 3280 AdobeARMHelper.exe 3280 AdobeARMHelper.exe 3280 AdobeARMHelper.exe 3280 AdobeARMHelper.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3852 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeTcbPrivilege 4904 GameInputSvc.exe Token: SeBackupPrivilege 1536 ReFsDedupSvc.exe Token: SeRestorePrivilege 1536 ReFsDedupSvc.exe Token: SeBackupPrivilege 1536 ReFsDedupSvc.exe Token: SeRestorePrivilege 1536 ReFsDedupSvc.exe Token: SeBackupPrivilege 1536 ReFsDedupSvc.exe Token: SeRestorePrivilege 1536 ReFsDedupSvc.exe Token: SeBackupPrivilege 1536 ReFsDedupSvc.exe Token: SeRestorePrivilege 1536 ReFsDedupSvc.exe Token: SeBackupPrivilege 1536 ReFsDedupSvc.exe Token: SeRestorePrivilege 1536 ReFsDedupSvc.exe Token: SeRestorePrivilege 5820 TieringEngineService.exe Token: SeManageVolumePrivilege 5820 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 5308 AgentService.exe Token: SeBackupPrivilege 5712 vssvc.exe Token: SeRestorePrivilege 5712 vssvc.exe Token: SeAuditPrivilege 5712 vssvc.exe Token: SeBackupPrivilege 3968 wbengine.exe Token: SeRestorePrivilege 3968 wbengine.exe Token: SeSecurityPrivilege 3968 wbengine.exe Token: 33 2916 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2916 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2916 SearchIndexer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe Token: SeShutdownPrivilege 1236 explorer.exe Token: SeCreatePagefilePrivilege 1236 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 1292 sihost.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe 1236 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3852 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 2600 StartMenuExperienceHost.exe 5912 SearchHost.exe 1236 explorer.exe 4496 AdobeARM.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4904 wrote to memory of 5892 4904 GameInputSvc.exe 92 PID 2916 wrote to memory of 1184 2916 SearchIndexer.exe 114 PID 2916 wrote to memory of 1528 2916 SearchIndexer.exe 115 PID 3852 wrote to memory of 3364 3852 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 120 PID 1292 wrote to memory of 1236 1292 sihost.exe 121 PID 2916 wrote to memory of 3964 2916 SearchIndexer.exe 127 PID 2916 wrote to memory of 6100 2916 SearchIndexer.exe 128 PID 3852 wrote to memory of 3280 3852 2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 129 PID 3280 wrote to memory of 4496 3280 AdobeARMHelper.exe 130 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_ede17aefeb0ba5ffa83a90f94835286d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"2⤵PID:3364
-
-
C:\ProgramData\Adobe\ARM\S\20587\AdobeARMHelper.exe"C:\ProgramData\Adobe\ARM\S\20587\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\20587" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\20587" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4496
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5480
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5892
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1684
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4272
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1000
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5784
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4440
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:816
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1228
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1648
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1856
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3260
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5156
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5820
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5308
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4760
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5712
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:6032
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1184
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1921861047-1272335887-115070671-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1921861047-1272335887-115070671-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1528
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2968 2964 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3964
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3032 3028 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:6100
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1236
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5912
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2600
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d52d1c2d1fe4dca65cb49754b8b39fe2428de2271387f6bd0034f2b2bbe63244
- MD5 b84ff8f95373423a25404960517bbdef
- SHA1 a31ce7b93c0be97812dc7bd2468d89dcc0a2da12
- SHA512 22aa1424c331bf9230745e9dd3f93c4a723136336376b41383a2f272ac402435ceb676ec4ef1b1677d162584ba7ee2361cc6c336067732619bd773a722d20b5d
- SSDEEP 49152:pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn5WS1SZBnHTAsi:/3q6gjBGcNzAz
- TLSH T103D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 849KB
- SHA256 63a26865767c4b8df493dc2eef29023fde4973830bec8d5566b448fed37f0454
- MD5 dddf88e924de0d9f6d31e28d1bf24388
- SHA1 f2ae1a0b0b6e4adb4f82cf8a9daabdd410dfc90e
- SHA512 3183816a74914a9b5de1aace80bdb919e7e838340b95621545a732657262d52c92f571c22621e6d0a9f3637bb36cbfbcbfd00781ee408ad33886e312b2642268
- SSDEEP 24576:6XYhztczA/p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:LtcuWS1SZBnHTAsi
- TLSH T11805F128A7E009F9EC574239D9A18405FB73B8518764E78F03E49A6A1F233DC5E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 36556c58a07321b483986328b93082ef409f39661752f7400705a589787fd948
- MD5 9d058eae4e22812b41a9c64020ebd122
- SHA1 04b8520e3d766c121543a3a69a3aec76b554ea95
- SHA512 5347673799225f21bcef26a6a5c0e12399c75c7cc34a8cdf1e385b7ba269fb31d7b106c764c51b31502c40f0714baca06c4e3114ada5f26990a770ac23968377
- SSDEEP 24576:T03eFFU0hQxOrMjp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:TrFU0CoWWS1SZBnHTAsi
- TLSH T190459E15F6748735D073C0B9C5D2A68EEA7230825B308ACB4286D77C7E677E68A36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 a40a8e9ff5aace9720b3ced1527efcce3281cedeffe7a029411fb5d7c2cef703
- MD5 e3c9ba41792ec5b16ac3a4ef75759fab
- SHA1 811254f73697de69de2e8fc551a9480ba6f37d71
- SHA512 6276636c50d974988f522ab5ea738511ee81c10d9b20ac5f5dd4794e4ce775b7e0b7f8e9ffdb5e00cc0599828e925b2ed8ca328b6a66e014c14533ab29891425
- SSDEEP 24576:ja4/ezSC6vUyD/aqgrvW/6q8wyu0p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:l/ezSC6vUzPvuHjyXWS1SZBnHTAsi
- TLSH T15A755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.3MB
- SHA256 beb56cc95fac127b8489f8e9b12a9804a49bfd24fc6c37c4218e93bf113ea143
- MD5 f312244f17c32657105871ff6cdf1518
- SHA1 5d6d00d22bb2391b55098e51c66a85e79a39323d
- SHA512 09dc5a876e3cddf9143e2f5a6e58985a5ba90290370c2b5bef043a913be793a2af3767729e30f8fdee8453240ec561aae8f54e3fdd654ce1d03a886fb00f7f2a
- SSDEEP 24576:aAbEPr8Fvv/l+dVp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:aA88FvXl+DWS1SZBnHTAsi
- TLSH T11A559E66F5748331D073C0BAC5D2AA9AEE7230424B318ACB1246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 603KB
- SHA256 7d9cea357bb58d05443dfee22d207de3ca2db191a6e280c664d284a719965628
- MD5 d70b7e7f1bbc2a64e81a1c3610b054ea
- SHA1 20e832ba26c262dae10d53ce1ae3743385c764c2
- SHA512 07fc2ce51afde8b9313bc03f9aab03fb327aaa2d45604ff925ef5a38b615a1a86f028f2c24b3200eda626dc28ec442ba632b539dd973f5afbfced6ff2d252e54
- SSDEEP 12288:+fBp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:+fBp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
- TLSH T162D42349CF648E60F6C40A31357C4C0DBBF79761CC6E0B0D06A8BB4E6A762DDDEA6542
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 863KB
- SHA256 ce2888c6f297755a417f5471a5dce9d38330d8bd87943bb0ee53514ea4724fe0
- MD5 5d8d638168b89d786f3727bd23321095
- SHA1 20d709cd858e44ee0da158019735b6262bfd9e8b
- SHA512 d505f57b4fbb6251d4c9f7715e1becdc242c6a05f91dea04a2c13f81b253c5c0fc86feb0a028e569a5fdd092e63411c038e3c3cfca2301a3022d424a5a1d8fb7
- SSDEEP 12288:PeBNUbTVO86UTp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mT:PJIUTp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
- TLSH T16015CF3BEE28ECE1C27E4D795A918600E7B274314F6293CBD164830EDE235E55E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.7MB
- SHA256 34930f1196ba63ecd270b0c10766153e2409e4c1311fd35dc257c6ef71cfaac7
- MD5 2046f9398602596e2b668c3ffc3733fd
- SHA1 25c9f37e92cc3b1f3819fb0cb11c4ad14eee2147
- SHA512 d41a8e89ac288611b74097fcfb9f9b45532317c2fd79e26ee3b7abca7917aeaaa7c76f60699c2fba88579622b2112ae5f7a026a6294dc2fad706a30add43d18c
- SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJx9DN5J+NRV3THL:5QvGAdlCEL8c/xRNa5CScNzAz
- TLSH T182367D656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 932KB
- SHA256 c75ec45a09e6d8b553130f57daffe795e058c1343433fc4750d21f42e7ca3e86
- MD5 725036e50fc2f01bb03393a8a32d70ea
- SHA1 640f54a675278745c5d1fe6bf76f6b7a25c030ab
- SHA512 55ce832078fbfede4d0c44d6bb18c28507d13bed9fb3a7c226301c6a05ccdcf4c8a803c06a782aa8e153e21c16174cb89de8051aa1169409ba9b189b66e6172f
- SSDEEP 24576:BmewsAjxp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:kljxWS1SZBnHTAsi
- TLSH T18A15E031EE74D436C6BB0D722B35C70A647D7A204F611AC7E3A89E8E59302D22776E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 00726fdf8780d5eaea586f682657f8c3285e3ea56106cbf0f5acf0cbc9e92c41
- MD5 e4089f9bc196f72326e103335772bc48
- SHA1 e815703e1159c247bee5f691dc85872d5e6c755f
- SHA512 05ac446e3c2c8a0e0815c202f2ac419e09d7fe7b55cf5882b9d09352a221f083963a213633e0cdcfac6841a9fbc187094809d8b88d032a4803e00a0c6f2b04e4
- SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrndPlbuJHzTz:DUEtQevvqc2W1cpV2Xr92Hz
- TLSH T110474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 55879c547ad3695fff791f33456adef84df012f8cb99cba0c7f961a1569b1fa9
- MD5 01c6bed21464ea4365260d4b3ec8156a
- SHA1 8d56cd2ddeebeda4bd7d2f1b3db8e9098eabf11c
- SHA512 529b5f979d5302ba256aa51677f1362581f4990684487943a17dfa9d7a15f20d71f32dce0d5dcef42c041527ee9fa6e218a302244d267f5e6c9b5ab7871623c6
- SSDEEP 49152:okbRquA/m2yL5zMfFiV+XenmE3/zxWS1SZBnHTAsi:boq1Vjnm2cNzAz
- TLSH T162D58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4265460E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 9f5965aadf6596085ebe98a1df55758db2c9053317272a812e2ff1b8f5aad0bd
- MD5 889f9601469e7456b15a85d9d1dd462c
- SHA1 1daeffbebcabf72b78aedfa581fd604dddf2156e
- SHA512 7e9a0b95546cf106a63c4f4f87a297084c44b5a2a52535d1dda480ee4a6da102d0655401d1216144f82945f1e1a61b48a0218b68491d557735c212df48a01fa3
- SSDEEP 24576:bAhGLvZFoiwtA5l7S53hbp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:bAMNFoiq5xbWS1SZBnHTAsi
- TLSH T15545AD81EBF945D4F5F3AA78A9B58471EA76BCA65E31C20F2160D10F1E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 829KB
- SHA256 0e042d06282aacef5ba8f5d4467ff50d58abf8332aaf2e1721e5e9300ceb4d17
- MD5 ff53282e7335684eed3c659af8930b4c
- SHA1 d59c77f6095d3f1f2e5d466f20b7ebd751836090
- SHA512 6d3420e3aff55b3e4e00ba94332da3e38b2344d691d29a79ed245490227506cc647cf2071fcec10976d89027cfd0fd0d4ebb13e006313b3f70b346d6fa6c0260
- SSDEEP 24576:UwusOWUp8SXdo8ke5i5Xh6wnBLTHTAcZQ:UwfObWS1SZBnHTAs
- TLSH T1E505F14967A40CF9E99642398557C436F7F3B8122A25CB1F0760C75F6F33365AE2AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 678KB
- SHA256 c3937d74aa346fe2bfd1cc7fa73f05aeea8d13b3c1162e18cbc388b0f99145a9
- MD5 5eb5c5c1ad0c0abaf28a589b0dc0dce2
- SHA1 cf3fa7b1201c2b17fed37396f79a8c23fb62cbc2
- SHA512 3baaa0cce4cb273169fba14d44a9a6148d7ee57927b1110856f2a40769975b4beddc4b5cc7b0fc6937c37349a0657d46ce40a69e53fb51532ff840ba96e9a800
- SSDEEP 12288:vFQ1I4Mp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:NQuTp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
- TLSH T1E5E4124D57E445F9E1C60638A9F44809FBB370629B3A43CF0668475E2F33AD95E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 56cd859491ad3f77d7bda99ffdcc10d3257220aa216ec055583d2c6a8bfe0647
- MD5 85c6013813e4e33caa7100048102b649
- SHA1 ef7b3ceb700091a6dc94824cf2c4cedb4aa7a832
- SHA512 b0871469e23028cc8f8010e513e676aec4834b8f0044f1169ae7f672ae08bbb828b877943b1b32f644976d9eefe039cb5e8556d9869c6d0fa0f02238054676dc
- SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U5:WQRQyi36YOcP8Lvw2gAf+PN3pcNzAz
- TLSH T180667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 abd1af666be4e849162772696fc759d5b911aca7331d5e40ab013eb309dba7c1
- MD5 6ea6c2a6024e51c8e3c7fb4cce6479ce
- SHA1 ee735bfb17b10a115f008a1ca19da0fffebc7b93
- SHA512 62cee5112d921b5d90391321084d9ab4f1fe361e261a2b657f1bc9045cbe649179c8518d794e4b612361eb74a1930a611e07871b0e02a177e41d660df50364ae
- SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U6:WQRQyi36YOcP8Lvw2gAf+PN3icNzAz
- TLSH T19E667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 539b6727d0d6e376b699d42daaf256184583bbbcc163f46899c19950d921ef21
- MD5 b36ffb4c6754551b23d5e23bf77c8fb2
- SHA1 9d0490e244a02b16edd55006cb49419c5fc48746
- SHA512 d06f50d7902f817ed521d4705cd7562dafc60899720e253b2f4eca6b9b43f3ca4b558fd4c309c6664ab775fdf42911b376ea7f0683a430ca534afc4ccfa0f1b1
- SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0Tp8SXdo8ke5i5XC:368Qg55nhMeWu7PNU3/KWS1SZBnHTAsi
- TLSH T189B55A33B2F200A9C44DD1769F4A872196D27C71CFE1E3DB8515720A1BB2AD47B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 d30464783fcac4e84fb62c692f8a2777bb90150fa14f50ac5a5fa74d48b514fb
- MD5 542bd2dfe3b68152eb6c950997032406
- SHA1 4f802a362d88f4ca781b7ac5c98adb42c9916770
- SHA512 e53fdbd10a914b3903d709b43a6a25a49b9bed998208ed6e653c7f9d9d9a0fdab01e63bc78d4d12049e3ea65d16d8c4961baf6ebf2371b8e521f0d0da3d471a9
- SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99K:iy5112gYy5azzVv569nLKnhZXcNzAz
- TLSH T1FD168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 05acb4e071e0d174f216755e76627715eeb253f6fa6cffbd2c8b3686f91640ee
- MD5 bed3c0540249bf93ae73e453af723360
- SHA1 24e6b07058e770c01c832fc9b57c56a6bb34f56d
- SHA512 3f865bf89c93c19bd745ba5f1f8915e33c30b1e3fa4f6110d7be6221ba60e9f334c760371e1d688f82e8f8aa74e2ef4ef15e18e77a0cee67c0e66f997d08b535
- SSDEEP 49152:+B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl8WS1SZBnHTAsi:su6JmTxd2d8cNzAz
- TLSH T1EFD59D13F1DA01E8D05ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 99380b944dddd939ae4ddee56f05227879b57533aa567233ddd36171b0130cbb
- MD5 f79969330059dbaaf62e9a7df59983e6
- SHA1 3780ec0ca585faa7d82972a63d6c2eccb6b5816c
- SHA512 96a2aa4c5c5d1fff02653c93f06f7399c038750c33a1ded464cdb7633067967d3015ee7855af2e45de649594c8b678ad337f1b6602fbdaef10655e5b45f0c2cf
- SSDEEP 49152:t1hpsNoJpF1A6UU44CwH7R4xVWS1SZBnHTAsi:tmifPbR4cNzAz
- TLSH T16BB5BE13F29901E8D05DC178875A9632EA72BC460B34B6DF0A90B7962F7BAE45F3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 6dcc307b810b7c7e1e808e135b3d1cf6c06842c4cba3eb72425435902c042ca8
- MD5 b69f6a489627b297db9ab5e2cd371aa2
- SHA1 12013ca1837660ff5ee4a00b9da3e9998e549367
- SHA512 65114ef9ce918a19663ab913e6a63a4c7aa3e1bd263e42b1341e8221a2e61f964263ffb7a558ee6ac9a38ff031113196b8c011de26d12a899e6e7201a07fb62d
- SSDEEP 49152:LSuZQIY0Be2K6RVtOnks6NMHqQWS1SZBnHTAsi:Z5dKoi61QcNzAz
- TLSH T147C5BE03F2E940E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 48bd57c9a24753da000258af7c5f898c4f45fe550e6763e1f18b296cd1429640
- MD5 d2d859c27c3e443396633f6557e36965
- SHA1 d53a044ba8366b4f5a6581431f10b5a2c304e7c9
- SHA512 c9a755dccc5d30d3a47c2b6c43d9f3c1fce75f3ca63bf96452dae04c25e0ee240fc6c8fb05629a0c3adb4d4f53b9ebde2d832c15b5363bf4f236725492e49350
- SSDEEP 49152:jhtSn8EApI0figTgiDn0AP5wNWS1SZBnHTAsi:CX2iyph0cNzAz
- TLSH T1BFA5BE13F2D900E8D05DD174C7568632EA62BC160B39AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 602KB
- SHA256 ac30b18250f51461a061631c174dbca170114c79f54882e65a1561e595d13d0b
- MD5 638e40d684d79f5a9e580e32d3556045
- SHA1 d806d56acf590a360d8316f44c906b58bdad0027
- SHA512 44be7e066aa05433883df98b67f8d998cfc320e89a3799c8f25e60fcd478e1e7998f2ea43fa6db2c5f151fc4e5652e56fe3074fb9882cf314f243b29d9bfe709
- SSDEEP 12288:7Tp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:7Tp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
- TLSH T142D4230DCEA58E74E5840A317638484DFBFB6362CC6E070E179CA60E7B632DD5E66981
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 602KB
- SHA256 69c91e36a6f24e1c9dbd32138493baeee9b3356fa8a528b965eb06321c1cff8b
- MD5 eb0b2965b52932480e08c80949f92d2f
- SHA1 3bab588e1511fa8918216df84b6df9684d1b609d
- SHA512 890565281838e108a55b2578928fd69b520ae034695e44b79059524f7bb265c9ebdc100816444192bcbf91dbb747da2b5dacd4b29a1a0c17a9631fdbff4d253c
- SSDEEP 12288:V1p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:V1p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
- TLSH T192D4230DCE658E64E4840A317A38484DFBFBA362CC6E070E179CA60E77632DD5F66991
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 f2e904b4e6cd557220cf6b0dab95485f35f5889e4aa0417a703c7d2153371109
- MD5 6a90eaabefaed59223e2dac0c002728b
- SHA1 d57d51d63f30b794b5522a075b1c3253373c4f10
- SHA512 75e0da388152982da13389269886a72bf0743f32821f8a812a4be396bb215de0269995b4bfceecbffa1883c56ca27cc47049ab83471618e5f09a635a766eb5b6
- SSDEEP 24576:lfwvtk9RX6wkyAIWp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:eMnYIWWS1SZBnHTAsi
- TLSH T11335D029EBD848E5E1B7923C99B7460AF6B178694B31C3CF0299536D0E33ED45E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.6MB
- SHA256 be702d88473bee360162b797c9d477b131bdcefcbd021dfe3612a46f2bc5d87b
- MD5 0293590708e0643f0cc0bb3c398e84bc
- SHA1 3a08a87ab87ad24751bcd08e6130f4aef07405bc
- SHA512 b9a42e31b72e5311e5c49899fa538f821fcfe0f713781cdfb2bd71843d49050d3a9b5b208674636981589e9da18787bf4204d9b9b945da1d5a3416ffdb407b16
- SSDEEP 49152:DY4rNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FWS1SZBnHTAsi:5ySzPNcNzAz
- TLSH T113066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 297847d67cbceb546557b003bf7b34c1734620bb97bf1f9d23f98ff7ff68a1c9
- MD5 de7f94e25b7b308f8056e4459faedabc
- SHA1 ff86a02f6579e4cfd362d6bf67e042d5fc549c99
- SHA512 6b4e81a57ae942ca03b13a37d15013e46f8b39b4baf353be7d13b84a4d382ce26e308035395b0f88b73cdad7b63b1158904b945bfd661c1eeaee34f6737fb250
- SSDEEP 24576:tf7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYE/p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:tf7JUQjXirIhCnDHUPfF/MWS1SZBnHTQ
- TLSH T1E365AE1DA3EC01E5E1BA923885154A5AEA71742E5F32CACF12B0837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 722KB
- SHA256 fbbea99206404d8cb35df209a9bacff8bb66ff686e44e43f534284ee13defde4
- MD5 93d92649cd3c9d0213a6aa9274a35a11
- SHA1 a43b129719b3a692272bbe620d103d7dd7192ded
- SHA512 0841292da8935310cf9025661425fcdb4deeb098aabfc1e6b3484eba4b6c595e840382549e9114b2ff411c2535b782b0ab469174602a4d72e5799fa12be3b6a6
- SSDEEP 12288:07sfJ3p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:zlp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
- TLSH T1D7F40109C2A406E8D09E1235DB644945F7737D2186F6938F13D0FA3E1F762989EEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\ARM\ArmReport.ini
- Size 102B
- SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
- MD5 c42592fd019ec4a186471c670ded3b4f
- SHA1 2d5a5b980279b0305441b007778a31c18e84cfb7
- SHA512 dc22dbfd7fd36284002bcaa73c2224d42afa850123dedac16c37ac48abddebf6d0c7db1d02793dcc9553d226de60a2cad8075a03be7efb4caa29e92157bb36d5
- TLSH T172B0125313D54C10F4101801CDF444337F2270C0680AC00CC0D1111744F0CC0CE622AF
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\ARM\ArmReport.ini
- Size 824B
- SHA256 c62557ca2d044a3b9ebd39042dcf529c783de02b64e466462aa6cb35d24135a9
- MD5 730cdc49a49dc278867956cc11e8fad3
- SHA1 4cf2bf16c29ae4538ba552700533463575edde28
- SHA512 d9b58266132179c39e62a84ad80f32dd3836310b09c2c7b231137a7c70a6c343994466b0579248878f626fa849b3cea3ccbbe7a10c6967bec922241904f215ee
- TLSH T17C019A831AE91520F1B21F44DFF994735B337CA35C2DC86C90E8420E89E1A80D5B2BBB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\ARM\ArmReport.ini
- Size 1KB
- SHA256 fe1e083af082ee40eaf11bf6a41f74afdf748347685ce789be05bd12a279e4a5
- MD5 5f30c6831435ab44dfd9b6443e5cc1ac
- SHA1 fccae710295161bdd1efde260b0c74e224b11d32
- SHA512 709af13edb4b0740a207c1b308e13e0e225b6a28bf84d8d36e7bd72dacecb423ca7528af058b6f4c853ccf7f5b234379da974d015e5add220062c65f6d6512e2
- TLSH T150219D872AE90164F5B35F54EFF9947357323CD22D19C86C80D8124E4CF1A90D5B27AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\ARM\S\20587\AdobeARMHelper.exe
- Size 413KB
- SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
- MD5 522026a14d6bc781d2a15c665e454310
- SHA1 9451a39108326ba578793b1feb62f23a02bce916
- SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
- SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
- TLSH T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 a8f1c3a237a6390ea743f1fd316cf624b098772ea5928803e03e5589095e1d7c
- MD5 4ac5bd21accee967e7088cf47b7c80c2
- SHA1 21759395d169e18e85f66ff648cda438772a7eda
- SHA512 f96b0e13ec887e9d5282861ab36dbda3eef9874ba4a807a6888c07bcc6b937089a174cd7860f3632a0923c12ab957f4da1b33eff6ad78bebb4bb24ae3e5b4fc2
- SSDEEP 12288:O15Vhf3grsUs7FvpbUZf/T1RIQNWHKT/:O1Xh/goXpb4rrIQNKKT/
- TLSH T10B4506017666C74FC66D80321E36D2CCAB707D01EE45AF0373C98B3F9576659BAB2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 925KB
- SHA256 0090d9aa5df25d8fda6e955081460010408a1287738ae4bd01849c0d9a278259
- MD5 afbe3f9fc94f0b90574102eb65a3c5da
- SHA1 5e0d9205781cdd1303545d73cca8657956e4b44a
- SHA512 63315b21bb1b077c61cbdfce972c808c0f98e2863a412e0dfcdf1d258f68144ae8f555852e827b51051081d813623854c3cf7a1b3848495ed86117e15e8a5d41
- SSDEEP 6144:dR4BdjZXnLLazs8LG3+JFGg5XX+htZvCaB:dOxugZvCa
- TLSH T19815084059A7E75FCC3E84F706B2A78DDB786906BB8137006388C94858B35AFF6F6581
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 f5c6189950488e958eccbde807d980fdd84022bc53a29587e6791b9e1805254f
- MD5 84b72e9895a1c8922733b0fa92ca481d
- SHA1 dc86edf0654180fd11bb063b2b78d760c9e21c68
- SHA512 5e5b112c18d039305be4b2519a09f72abcf24dc7943ed5d325939acd099028492dbeab47a7317bcf8e69dfe790434f7a34b742b45a82c051c7ffcc04801b99d9
- TLSH T1FFF0DCFB65BB60423803F96C0DE88A761374D9CF4996D1B261B119C48B942AA624F05E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
- Size 727B
- SHA256 0e3b25d8203b9966ab14f8e7f2a8ee418edc423e14f61a3e910fd72ebb51f324
- MD5 f74f08d542936e8c519e91ee66aa3aaa
- SHA1 31c55ee760baf369880b4a8d1c292cc5fcce3fab
- SHA512 be24535b7401c087eccbc673caf1d0cb3a94d0385fe29f1ca9d6e04114d8f727153e03ce6f344909fcc1acaac75079b24569527b0d7aef963613bf0accf0e7e6
- TLSH T18001945B635802D260439E4C8E1C1AAC37A2062476EC666F7134F3D5E6CCB1E7BCB834
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 a1f94b5beb7cbf9c3a608a3576ab072d303f92c9a8d4f6d0f348cb5e91200bd2
- MD5 8ea56e8ffe7fce997d4f848ce9297372
- SHA1 b435370908898c778a99946461bd38ed8ab6aebd
- SHA512 d188745f3787580ef372151479557056f7b59116846a219ad8e8b5775d2e9481d134fc3e8b802391ea75542138b1c7f79dc3655dc1bb2a6f1d9acada89f13027
- TLSH T18501609E33A0A74838261D45D7CCC07CF2B780C22EC90304B53A35AA92A67EBCB03815
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 a1a7508423618d0a2a9f2ba8dc11be982f0fc32569cec73b015fd047f4400f20
- MD5 23760f47d5824827aa66d8f88be76d47
- SHA1 3fa6a4ddb2c7d21157e32bd67f880115d0676080
- SHA512 e84911670d0fd2fcbe43de0b7095830bd54593170ee4c13f01836d5c255f7fe094763f292d1f945666d1cd10a793d2df6cbaff75af3e621a779556a251db51a3
- TLSH T14BE0C02013FA201FF2B4DB3447D59496AF26F1022D4C56BD1F82185CA809E004C52C30
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
- Size 404B
- SHA256 4f08e507cc5678554bd6db7b8a470deed0b49f98fe6aefbd76b7008d34308d9d
- MD5 5df831173927b401788a0ebb9ff22e7f
- SHA1 528e21f924a6d6c1f7834204049f87aff99c21c2
- SHA512 9b996a5834d9a742c35320fb9d8216caa2caa062598f50d2efd1766ebb8320456612120b303e5f0fbd72476d170ded64e603184e3aae9200a39871903b703f72
- TLSH T18BE0C63032F6045EF0F5B8340BF6AC2AA88AF30A6C03C37E02002786AE24B004CD2520
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 fa4d2ad3f7c6053c1bb6ff2342df4f7cc55860a49bd89d036c3cef8b8a9f4cea
- MD5 d484dbc552c5158cb5c027b854dbd154
- SHA1 51c9e018b686a9407b2c4e328225a745161b3d26
- SHA512 1d65febf111918722be23bd9f3eeb389f027baee2cfa883dc445fba03b7143d08d1ccc62d3dfc337bdd3a4f46169ad09b372aae0507e54c0f5b41e7910ad3be4
- TLSH T1BCE06F2822ABB2AFF090A8304AF9A5B22E5AF202244093B906804308BB0AF405C10AF0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
- Size 1KB
- SHA256 555393e3983e104f2affef6183c940af146023e2b443f60485183fbe15fcae3a
- MD5 fe027c3fd174f578fdf0d0089413f0d6
- SHA1 207f347a50ebf9b59f46d034b6c87591408710c8
- SHA512 a2e8de33eca000cb6e490216f051482ff714cee8d81f6f55193ce7895897444b0bc6b9be4f0fa8fc7ac8321a41bc6c9a3be07ecd1d3117a173cb1c5cd776659c
- TLSH T12F21FEC3BF2881372822516C94251F87E48AF6553B04DE3CF3644B05BB87816CE8FE98
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
- Size 251KB
- SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
- MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
- SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
- SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
- SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
- TLSH T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp18E1.tmp
- Size 5KB
- SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
- MD5 5bc2d1f7a5fd950dd51547ead6afdabd
- SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
- SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
- SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
- TLSH T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp6373.tmp
- Size 5KB
- SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
- MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
- SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
- SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
- SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
- TLSH T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TmpB86B.tmp
- Size 5KB
- SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
- MD5 5a68f4aec3689d0dc750adcae8e60520
- SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
- SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
- SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
- TLSH T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TmpB985.tmp
- Size 3KB
- SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
- MD5 fc2430057cb1be74c788f10c2d4540c8
- SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
- SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
- TLSH T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TmpC108.tmp
- Size 5KB
- SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
- MD5 1b7ade3253fc67477dea69ef2147603d
- SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
- SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
- SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
- TLSH T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 610KB
- SHA256 6b280c41431fed0142ad41f7f922ac6d18213379a74368d58c87fc02822e77fe
- MD5 add7a892dec2e3fb6c9159480bb19176
- SHA1 437d250cd45687583a67ef7d3c0add711c0b6b96
- SHA512 65d9d0b37336a45969efe994d102a19fa66e1de156416a31c465d12a54503c3251c39e1569496e0b32a07c05d5d24b84fe8852a9183a9434e7ff53975f5ecb97
- SSDEEP 12288:jl7Op8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:JOp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
- TLSH T101D42319CFA48E24F4C80A30357C880CBBBFB375CF29474F5658664E6A726DD5EB1A42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 92aa581d48d4df3417ffd798f2a1f4860f580255c1f62906416b72d0265711a2
- MD5 478b7ae696cf61fa29a713dd74ca7679
- SHA1 bf33cb297b4728df1faa75f51833c7df7d690f69
- SHA512 f3ce3eb687f7ebbc8631063dd85bdf1b7eeb53a62fe9afa07999641008249fb00cad0f0f366b17b7666924c81592c33ca21d733e9835676b39a5e897ce8b5c50
- SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bY/p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:Lgb4mBIBhGF4WS1SZBnHTAsi
- TLSH T1D965AE1E22EC02F5E0F9D2B89DAA4417D6B378164731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 660KB
- SHA256 1bce00f16c23035d88c6fd9107ddcbf918913a8178453d5ad4645b77bf013c42
- MD5 228996a1cfea8b9aea93c7f99cac313b
- SHA1 a41fa05da56fb05194f4d6301e03724e0efe07b1
- SHA512 a3255f6fa500e2619282a0ac9954cfd7cf8c5d53af30efb6a043ca881daab4c9634b9d5add595ce50c8d240d488c703e2b826aabe8e7388bc1e7240accdd9177
- SSDEEP 12288:7ZG8p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:tG8p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
- TLSH T12DE4231D8AF149A4D46847356534480ABAF37370CB2917DF0AE4E63E9F226EC6F39D81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 624KB
- SHA256 8cfb0a02b6a0c05800124ead057725135ee1e349dd4f7f47fe512bcbc5afc0e8
- MD5 62836ef0367ddd21b38bc8429d2052a1
- SHA1 d6171b05c371fd1e9c66517f44296fd71670dcd9
- SHA512 1ee92f73a1353691a31abc9877d9d9fc65de4dbc2e086b449ef95490c144a90efde1c941cf8cf62d8ce25f914f215e99e5119f70b39749fd01361a496e72fa49
- SSDEEP 12288:S1p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:S1p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
- TLSH T15AD42308CE658E64E5C40A3135384C0CBBFBA362CF6E07CF16A8A64E67636DD5F75942
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 bf641e4d0d9cb9ec8c16f62672275ad602f9d3e0f524a841e9f1a4ee601eab19
- MD5 d2056ea81e5f3d0d2d88f3f5742439f6
- SHA1 01a8d0b2c22798ca393cb98e238da2f5ff06f187
- SHA512 5bbc49b171889d13ce6bceee5932955ee0e42719cfe2c4dd56552ba1b6898bf87506472083ac3dbed3c5a3cd1b5068d8aead7d35e00a4439a886eeef6f802fb3
- SSDEEP 24576:dAZ8u8FpJqH14zria7/mPp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:yeZFPqVna7/0WS1SZBnHTAsi
- TLSH T15035F165A7E001F0D47BD1388A464667F6B2B4210364EBDF07AC8B551F23AE90F7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 828KB
- SHA256 5dc8383bd655d341c59b768fd50acae9e842634388f99edcddb63cdb2d734f20
- MD5 678d54328d600e28f2804bf48665833b
- SHA1 0184c115b318ed94b7fe5bc733a6c5e1bebd4fb4
- SHA512 a9b463a5b0f1481ef9cfd31fbfbd590281e1aa811c48997748f294086ff9aa58e65c2644eba3a6c6e87447d552416817a7642832aea8b3f94a2fc2691362c301
- SSDEEP 24576:iPUr+NQcp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:iJQcWS1SZBnHTAsi
- TLSH T1C705F11F66A80CE5E676A13D8995860DF772B462471293CF02E0817E5F63EECBD39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 fe8615e5a73d0faad88e61860f67b2c2f38c29a4bc7599c163bd2adde1c9a405
- MD5 b98e63e9906d047a5e9ee53b9874970b
- SHA1 b4ee901e09d701c469640879f0d05faeb07a1272
- SHA512 5daa553008b03584253a6e49db5376d2bab5999540a0f9e20484852c89d47e62cf28c95f30ca94a907ecc28da991dfee111ab67a55633aef44c39552f1af881e
- SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgWS1SZBnHTAsi:OG05lO43bVcNzAz
- TLSH T1D5D5BF6E62EC01F9D1BBD17CDA864A0BEBB23415033556CF02A486A91F27FF45A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 59ff292cf5d90954e861367a5f106e837d40d9756d16b341c36f3469bb5261a3
- MD5 453ec26a6a937f36d893be086d01ea5e
- SHA1 acd795fb34f8c5cce6bcb6c7856a06423ea29377
- SHA512 1cce8efe5a95d2f056ab5513e19929faad8bd0cb65d4af775906efbb280f00b5c748ead32d75b3814fc53d9695ec5dbe762e46dd496fc03a887bb09e628ead26
- SSDEEP 24576:FMa5POZ3dpbWVM50JicR2hG0lasx2+47eidnyp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:Wa5POZ3wJt2pasx2+m4WS1SZBnHTAsi
- TLSH T1A665AF5EA6F801D5D5B9D17DC583451AF5B2342253329BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 06351efd1d25374768eea0ab0696fc2df3aa490df5c55971cee45cbe6b85a636
- MD5 21cb7b390d02e437e0096ef68438b237
- SHA1 0917a934c682f93358d0fc93e7a4d112d61e2c17
- SHA512 bd37274f147a23e1451ddda18b40ae83a9694872a20b0262e5387dacdcc913b945581c127a67aa74a36e1828006c3535f8af4ada7b877bef38a88f7ca88ec9ed
- SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7Fkop8SXdo8ke5i5Xh6wnBLTHTAcZQ/:HNc/zEOVHFHWS1SZBnHTAsi
- TLSH T1B5858B1622E901E4F1BBE1BE89779546FAB17865533486CF0291811F1E73BF85C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 932KB
- SHA256 2d08f68645795626a02f712a154f0ae60161e8017c11b99ebe4a260ba4615689
- MD5 888229bf56a14097ef69033d0a138a3d
- SHA1 75110b43126b9341597edcbc2dd176d4d125e297
- SHA512 b38ada49af0df585de718df668667c3b675064ae5d9fefa612ff550661d70ec325cf77b9338f5820dc35b771451d3795de76b965d42094cec699ebbe00321068
- SSDEEP 24576:MJnJPbzB4SYp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:MJnJv6SYWS1SZBnHTAsi
- TLSH T1EB15E03DC2A800E8E4B7C27481191A59FF71347D2F266ACB19B4D5353F12EE4AA79F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 ef714fb5ec69cb49b38c29160c47330dc94bfd1ce1525fb78cefb9d5d2b3e3c9
- MD5 df5deab6e76431f383e513663b9dc70e
- SHA1 88fdb1cf1af90434d0c995fa4c28c064d610a7b5
- SHA512 9565a694033e0fd07513197bf2fafd7f0db8495501e935fdcf96ab36fca82c07ba9658eaa19196346949efa114c5757ac4dd5a0a9c512cb84a91b59222dbaf0f
- SSDEEP 24576:8CLHGL0MoeVtFumTijCmlKQWDkQp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:8CLHGeeV5ijCmlDWDkQWS1SZBnHTAsi
- TLSH T1C3A56B05E7EB4184F8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32BD4D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 776KB
- SHA256 71b93f8902962e24e8bd37d2651dd69a305befaa2791838d74beed6bb8f31e05
- MD5 e899510fc26fd8cdaf94a3b3c925840d
- SHA1 fd60816ab6aa9b58408b17fb4ec5c6a5c95da5f4
- SHA512 c05338cd6d8ea31f8b2d1db67652ed2edfc3fdb3bb71d683f426b4ed1a721b3c00aa183e749885a2d7b909f7ef5d24179a1ec13ae24ee3b35610e96d93a28f76
- SSDEEP 12288:q1Hck6j5ZI7zp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMi:W6DIHp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
- TLSH T1FFF4F15C637A01F5D0AB903A96920405E6B2B171C7261ACF0BD8C57E5FA3EDCBE39E41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 760KB
- SHA256 b523630d2e4daee67cebf29e1a0e764b2d02c6a5bc359c0541ad91da3644e134
- MD5 4c2d508e8f6a18fb55ff70794883a2f6
- SHA1 e520045f4feda4a5b80e29af03537b031e8548e3
- SHA512 edfd9b63fe891071fe61dafaa7abf10e0ecb39b2516a56de4cfb20edb730319fa785048906af75247236fc44393926a17349a196ad3fdfb18ad0b7e95c6694c1
- SSDEEP 12288:dG6kygp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:ktygp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
- TLSH T12AF41208879449A4F9E90634AA754448BF76B9218F2647CF16D0E72F2F337DCAE31B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 632KB
- SHA256 0f09771c40e208ce70ab50305d0b95547ecb269ce1f0e019dc6f218f2b117a19
- MD5 147f662911471ae5fde480f3da0b7c38
- SHA1 b947d6485745d6d6c50e18ee37c83b1bec811565
- SHA512 037539e27079ce4e9b68797aa475045cfa34cc9af1096e03faadd36d6dc0d6c2ef72416d0103287fdfcf889c6b123fcb1da5bbaef673304cd26c217bd8ae8bbe
- SSDEEP 12288:LIgp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Ugp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
- TLSH T1AED4235CCA658E64E8840A313538480DB7BB7371CF2A07CF1AE8AA6E5B272DD5F71D41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 be9f021ca622a9b647d52ebdcd7d611307635bc9cc0b72b8a4ce643b24251665
- MD5 623730db795fa6d60926473ae32d4234
- SHA1 d47b2aba099fdbfb39b0216257194e047aaf0e1d
- SHA512 7210a4d2e30494988f5cf827944ed0edce4431259a26db9aa78780601c75d894908270b7eb9e8ae628a8b2ea8ca57220ae40b7a6c0b60d8307877de865df649f
- SSDEEP 24576:tMgdLoTfaidZip8SXdo8ke5i5Xh6wnBLTHTAcZQ/:egyTrZiWS1SZBnHTAsi
- TLSH T19D558C1DA7EA09DAE2B2D635D8621493D633B4315772C6CF2448C03A4DABEDCAE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 792KB
- SHA256 dea10849484c50d3ac5303a4ec4a624b91523f93c192a19e734b287ed0cc9c1d
- MD5 eab9f339b0b9c701bb63c9c6fe2e6c4b
- SHA1 bf5911ebe25c4ed91a8ffbc7415dec8da1e74520
- SHA512 d99940321370f3492925e6c4cba3bfbe5c044310036758d0bf04fb7e08f168b964c1131a350aca99965955bafb50e69ff2946f53e859b88a1e00b09a1331e44c
- SSDEEP 24576:KrcmRDp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:scmRDWS1SZBnHTAsi
- TLSH T19405F14EB7AA00A5E1B7823C8954440AF7B37031572267CF02A0C77E5E67AED7E39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 1590f160d792355f8ed76f211f32d3ca93c35fdb32e884392521b863f9eb8b73
- MD5 0ee78fd32f748cb605f065823bf80b7e
- SHA1 c3735c1c5a21d809f8857362823147bd5a83632c
- SHA512 b7bf4db037a083d36bbbf729c9e52240ed0dbd94ee3c545c345979bbb187adbb9425bd1c87facfca70e3590215b823ee60f4a4fc32a6d3f8fb75a9ed1249b105
- SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3tWS1SZBnHTAsi:j3Upow8sBgcNzAz
- TLSH T1D7A57C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 788e9059dc40b86ea093f3d0ca50cd98d07062f0aae8ba4789f5cff642d937fa
- MD5 2bd987f9fedad42fd57efd6745ba76e6
- SHA1 33533e48760299c3aaff25d58484990ebec7cacc
- SHA512 187a40cd5528f1ed040322702e175d1c40278eca2b1476fe606d9db28bd16920f68b1b0d5fd3e28e4d434108a0088a6e7912c0b3cc9709fd278ce3f9f25bee65
- SSDEEP 24576:MTkNvNnaFeYhJNtmZBmOp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:MTMwBtOmOWS1SZBnHTAsi
- TLSH T10955AF2EAAB846E4D1FAC6749D238516FA727461073253CF5390C13F0E279D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 988KB
- SHA256 d2145ecd7de8e7c746ea61e32979b3e5a0273f556447049341fc44386cb9fb5b
- MD5 300f7e44c9f3571a46e0f0dcc37761f1
- SHA1 d62161f09a6d6cfb8de333871d92f1669722266c
- SHA512 1d0f0675cab9b10239073273f567b0612ce6c18de8eb283fb1ecd92e4a033151457d4af08c20b06fd2d54eccc44965ea531e145dc661195733d312e5592d1f90
- SSDEEP 24576:sD3FHshBIYQgAup8SXdo8ke5i5Xh6wnBLTHTAcZQ/:sDVHeBIAAuWS1SZBnHTAsi
- TLSH T1B525E17DDA9C04E4E57AC17CDA638906F7B234A9072256CB02D481BA1F6BEE47D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 768KB
- SHA256 907c42dfb5826a172549a274897227cec41cca796543eebd52d6f9169554350c
- MD5 6ee9d05cdd03782321399468b49fbf32
- SHA1 cb50a86a9c312082c078bb9f3ec69abd701d2576
- SHA512 04554e9d2d855b77842b7f881f917dbc8c6ce85641e5a3e5ad989e2b8e22cc25ced6dc9a047479ec15e6e12ebf6fb8fb8d06411bd0d94035c1f019c1b6980afd
- SSDEEP 12288:JyS6b3IkxjbBzcHp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ4r:b6UqjpWp8SXdo8ke5i5Xh6wnBLTHTAck
- TLSH T165F4124D87D048F4E4680230A9748019A6B6B9724B7A57DF32D8D67F4F32ADC9A3BF11
- MD5 SHA1 SHA512 SSDEEP TLSH