Analysis
- max time kernel
129s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 1.7MB
- Sample260708-ffgjfaa161
- SHA256 4d6f03f5c36e4f33d26796c94ad5258c83ef958589eb24b19ddc0d06d9971b30
- MD5 31ddc2e8f2be5043357681b2e6757b75
- SHA1 8d09ac7a2697a0552271c939a53b3c3494b09dec
- SHA512 eeaa2d72a9cf643a523cf1a148c13543de0d249fde989b7dfc7e7a9453abbfc83d721788a8dc5393557a46c2d38ed5d7a2d2de85584fea384da7937e23750c3a
- SSDEEP 49152:wNZCWOLT4RfGjrmiK2MtENcXKEFuDHchip:GwnLTuGjqdXKEFuD84
- TLSH T1DC856B0667F94128F1F33B71EEB992645A77BC71AE3AC50E6280125E0DB4E50DA72733
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 23 IoCs
pid Process 2580 alg.exe 5960 GameInputSvc.exe 2084 GameInputSvc.exe 3432 elevation_service.exe 240 elevation_service.exe 5000 maintenanceservice.exe 1676 msdtc.exe 1888 OSE.EXE 2468 PerceptionSimulationService.exe 1336 perfhost.exe 3728 ReFsDedupSvc.exe 996 locator.exe 6088 SensorDataService.exe 5912 snmptrap.exe 2600 ssh-agent.exe 2036 TieringEngineService.exe 3520 AgentService.exe 5888 vds.exe 5100 vssvc.exe 2812 wbengine.exe 4308 WmiApSrv.exe 3180 SearchIndexer.exe 4908 AdobeARMHelper.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe - Drops file in System32 directory 30 IoCs
description ioc Process File opened for modification C:\Windows\System32\ReFsDedupSvc.exe alg.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4038ff482468fd14.bin alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe alg.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup AdobeARM.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeARMHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeARM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca6bea30950edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a761d430950edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GameInputSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059b4c830950edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe - Modifies registry class 40 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{38AD21D0-008C-4C6C-AAA5-284B6C050FCD} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{EB082484-1924-4724-97E2-090FADBCD02A} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\NotificationData explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2084 GameInputSvc.exe 2084 GameInputSvc.exe 1636 explorer.exe 1636 explorer.exe 4908 AdobeARMHelper.exe 4908 AdobeARMHelper.exe 4908 AdobeARMHelper.exe 4908 AdobeARMHelper.exe 4908 AdobeARMHelper.exe 4908 AdobeARMHelper.exe 4908 AdobeARMHelper.exe 4908 AdobeARMHelper.exe 4908 AdobeARMHelper.exe 4908 AdobeARMHelper.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 824 Process not Found 824 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3812 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeTcbPrivilege 5960 GameInputSvc.exe Token: SeBackupPrivilege 3728 ReFsDedupSvc.exe Token: SeRestorePrivilege 3728 ReFsDedupSvc.exe Token: SeBackupPrivilege 3728 ReFsDedupSvc.exe Token: SeRestorePrivilege 3728 ReFsDedupSvc.exe Token: SeBackupPrivilege 3728 ReFsDedupSvc.exe Token: SeRestorePrivilege 3728 ReFsDedupSvc.exe Token: SeBackupPrivilege 3728 ReFsDedupSvc.exe Token: SeRestorePrivilege 3728 ReFsDedupSvc.exe Token: SeBackupPrivilege 3728 ReFsDedupSvc.exe Token: SeRestorePrivilege 3728 ReFsDedupSvc.exe Token: SeRestorePrivilege 2036 TieringEngineService.exe Token: SeManageVolumePrivilege 2036 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3520 AgentService.exe Token: SeBackupPrivilege 5100 vssvc.exe Token: SeRestorePrivilege 5100 vssvc.exe Token: SeAuditPrivilege 5100 vssvc.exe Token: SeBackupPrivilege 2812 wbengine.exe Token: SeRestorePrivilege 2812 wbengine.exe Token: SeSecurityPrivilege 2812 wbengine.exe Token: 33 3180 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3180 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3180 SearchIndexer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe Token: SeShutdownPrivilege 1636 explorer.exe Token: SeCreatePagefilePrivilege 1636 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 1360 sihost.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3812 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 3320 StartMenuExperienceHost.exe 2816 SearchHost.exe 1636 explorer.exe 4588 AdobeARM.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5960 wrote to memory of 2084 5960 GameInputSvc.exe 92 PID 3180 wrote to memory of 1240 3180 SearchIndexer.exe 114 PID 3180 wrote to memory of 3120 3180 SearchIndexer.exe 115 PID 3812 wrote to memory of 6132 3812 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 116 PID 3180 wrote to memory of 3160 3180 SearchIndexer.exe 117 PID 3180 wrote to memory of 5336 3180 SearchIndexer.exe 118 PID 1360 wrote to memory of 1636 1360 sihost.exe 123 PID 3812 wrote to memory of 4908 3812 2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 129 PID 4908 wrote to memory of 4588 4908 AdobeARMHelper.exe 130 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_31ddc2e8f2be5043357681b2e6757b75_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"2⤵PID:6132
-
-
C:\ProgramData\Adobe\ARM\S\29431\AdobeARMHelper.exe"C:\ProgramData\Adobe\ARM\S\29431\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\29431" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\29431" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4588
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2580
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2084
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3432
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:240
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5000
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1676
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1888
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2468
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1336
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:996
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6088
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:5912
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2600
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3520
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:5888
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4308
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1240
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3120
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2704 1904 912 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:3160
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2908 2892 912 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5336
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1636
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2816
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3320
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 007fb345017d203eebfe4c2f6b28007206d26f86fba63bf3fbf029f0b9707aa6
- MD5 37c9cae71db0cacf6ce237d53cb1d30f
- SHA1 881012de767e3678e21837fd2e83228b39f75a03
- SHA512 c38d3e97a70d513ccfc772c5c50d6a28d9c28a21f5a4d07163abddd0fcdaf65e14918e80875f0daf9ac74239c34da14696bba7a2e8c20c65cc5c4faacada8fea
- SSDEEP 49152:94O632BuPkFKRrdE6oh7stBhuXjfS4LWxnAXKEFuDHchip:c3q6gjBdXKEFuD84
- TLSH T10CD59C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 845KB
- SHA256 fc970d8c6c87b683727ab82a8bc89cc839f9239e0bc939850de4d4b73c5cc493
- MD5 99a17ad24067e91eedd238ad4c5a392a
- SHA1 1a3221beabe7aa64a04a76d97173e05faa9452e4
- SHA512 8905fc577b45e5b76072298faab4c9c4420ad9019651a6891e294f93f25cddaede4135ee8fcd008f98c26ebe4904e570bb6b5b18fe5204e328d73feb839f8aea
- SSDEEP 12288:v1XLsyMWZxZV9a+2czAJa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:NXYJW0czAJXKEFG1rDHmj7dip
- TLSH T1C1050129B3D009FDDD2B827CD9628912E673B8914760EB9B03F499251F237980E3EF55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 8ef70948104135f7bde7b4b16248dff2a11918afd38c26880a892ae9303bb987
- MD5 415d043878401e154a432740cc0cf0fc
- SHA1 ae8e15a83e6db9952b2f4e7741d2c16d55da1262
- SHA512 c5cea4e65635f28bf20fff933317d5a03031aaf94b7d49d9071a1dcdacc6c0b09f5bf84a3d123cb83cd7eefecd9f3b1742594a0bd2cee970754eec9af5fe72f6
- SSDEEP 12288:qwsNYVQe/U1L0E9QVQiwxpGZIVuhrHsPwa8lKYK2krUyEGGgp9IobHGqR+pf3jJk:e0Qec1L0EXxOrMPwXKEFG1rDHmj7dip
- TLSH T1BD35AE16F6748335D073C0B9C5D2A69AE97230825B308ACB4285D77C7F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 c81016dda4066d02438c39bd9b24f727660a7eadf2735c4971d7b887bc57bf7a
- MD5 93ba4089a5b6f66bc6ba7535f86567bc
- SHA1 c819af130df2de5f5e0b39d528960e6853ea8188
- SHA512 4565b4034643b982d477d4c128561bc9b599fec08a3f312ff2bdfa4c2a6c99814b166881c1d623bcb15951b9549ce5c38fc5c93fdc823e413bd40c0d0ca09996
- SSDEEP 24576:wAacezSC6vUyD/aqgrvW/6q8wyuGXKEFG1rDHmj7dip:wcezSC6vUzPvuHjynXKEFuDHchip
- TLSH T1D8756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 919245ca08d2a505879954994f20bebe260762167e0cbb1c0162d901c487aa57
- MD5 e63fb3201f236969a637ca58ce1e04b7
- SHA1 a3f4775c01bcaeed86d392a79b8c04b307e2a405
- SHA512 b50e1fc4b9788882a0c50183c96a3f0ea0ed0fc7bafd5517625a584055fb1940da425ddeba76b44719e199220542aff4b9cc6f39d6a3217989ef23e1bac08693
- SSDEEP 12288:haJjBP33vTni7B+l1D0RKsMBYWrlx4jf0Im98ma8lKYK2krUyEGGgp9IobHGqR+M:habPPTi7IXrl+dmXKEFG1rDHmj7dip
- TLSH T138559E66F5748335D073C0BAC5D3AA9AEE3230415B318ACB1246D76C2E677E6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 599KB
- SHA256 d01bc0b94a1b331ef1abd26d85ad3e38d7ec4853b5b2f021b1fd432087fb9f8c
- MD5 f799e663025e03dd173c16edd2375da5
- SHA1 75b69f06274aef950b3f658ce7a7b781dcf63545
- SHA512 1ca853a3d4ba1f1f25030251a31cfc6449b46821f1539aa33aa49e18b99350a274412ed1139ca027f5d1c541c4329f1cce6195d543dfe6c2cb045968c8a94a23
- SSDEEP 12288:Q9wa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:Q9wXKEFG1rDHmj7dip
- TLSH T1A4D42303874043FEC3192DB9721B6EA590B6D7E04D851EB865E43A559BA89330BCFF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 859KB
- SHA256 b67a2c27bcacdb092eca1c15b3418c9ccbce0ef4e19d1254becba992ebac2028
- MD5 e9a70d791621a60bbbdae99c065b042b
- SHA1 a8369c7c6a7a743df21dc9cfca1d34b36fd2a35c
- SHA512 626ccd17b1193b5f9c9200cc6a32909ee9ba0779235e5d94bbd6dc8d4b60acbf0e5579e72057fe34212ba50e236d8e5943465577188df750937d9e3c32305104
- SSDEEP 12288:YeBNUbTVO86Uya8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:YJIUyXKEFG1rDHmj7dip
- TLSH T10315CF3BEE28FCE2C27E5DB966518640D7B274704F52A3CBD164820EDE135E10E7AD29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.7MB
- SHA256 784d96aaee7b48ac4de8c32cf54ef8a22fc0566c6aeaa6e0aacae637f32a275c
- MD5 6116d85ff353165de593a853ea330f1f
- SHA1 114970be82e1636fc48a7839f32abb19d769280f
- SHA512 5271ac22a4700f8c1040b08915475b0681ce4d8800729fee9c84962d940a66ffd9b793ed4bbf46b5a99e8ab458ff21279c699e15a8c250e0a4cdf09e1a0bb2cb
- SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3THH:DQvGAdlCEL8c/NRNw5CrXKEFuD84
- TLSH T1C3367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 928KB
- SHA256 58ad8c325e564884a405bcf8bd3924639690073511fee5216226564510b88b6c
- MD5 b13582dad6c8c721a37a64e459b291ec
- SHA1 22c840c2c52bd4064c961c2774038439790de553
- SHA512 ef3bc5148e02960d5ae1319c1cde40ff4e427eb4979c77284e072e30d63fcac318ce159b73645cea8a19ab75a4ff5555a2d9651faf5b8be67100f14382612ed1
- SSDEEP 12288:gGwSfxL/2Dc3bDLLmt0LDQewsAj4a8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVw:vmewsAj4XKEFG1rDHmj7dip
- TLSH T1BE15E031FA70E036C37F0DB62B26C716147DAA604F511AC3E3E85E9D5A642D2137AE1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 2336ac8c68523df27d88b10ac9c71eec82c5c0ccd772e6698c5ca712061148c3
- MD5 31fdd2ebd20c94bb477b29ad59450a6c
- SHA1 27421f50c041140837639af21aa130e73f10d29b
- SHA512 da4f9517c926ace58105ac7e03faa2e079eeaf86dc63a391fc995f7c0a3edbfa1ea3f645a975cf504629d4d2e2c32a43f1377ed8c8833d1b8260b2096d0f67d7
- SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJHuKEFuD3:FUEtQevvqc2W1cpV2X1322uD3
- TLSH T15B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 f91930cafebc85a03055b5397e7320b15d798b6bc7996bf3fdef826871757092
- MD5 9330fe9df1a2be4d2dd133e12ba82898
- SHA1 bdad2bc0773b28e9f41ad72692b536e0a123cd5f
- SHA512 e430741ec3150b614b1788d4004f1e7310636896f39a1a8872bdc223edcc64307a8abbf2a68de6dab29e221f9aaf42aed0270db2f815685c9b7939d0a002edb5
- SSDEEP 49152:BobRquA/m2yL5zMfFiV+XenmE3/zwXKEFuDHchip:Yoq1VjnmVXKEFuD84
- TLSH T1FDD58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 e3cd911e81ff69bb3250d566c88f20fd6668b73daf2ce2b833f06e298c85e5f7
- MD5 9ca4152da649c1ea6a2e5b7eb1306a21
- SHA1 10413b231955217a4a7de9ec194a170cd0e6385b
- SHA512 b0fb0ad9c5358d13c4a04cef56bf1efcba373d6caf4b4e3ac05854828431eb8a6357d2c96a7d88eed0b3b7ec2608f3e1fc28df90600dbae966d1c77b7c86171d
- SSDEEP 24576:BAhGLveFoiwtA5l7S53GXKEFG1rDHmj7dip:BAM6Foiq52XKEFuDHchip
- TLSH T1B945AE81E7F945D4F5B3AAB8A9768570EA76BCA65E31C20F2160D11F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 825KB
- SHA256 a51e7e9f9f631e2f95232f831a8ec00535feadf25451c27437a7871b4bc31bfa
- MD5 c49775b110cf69bc361bbc9457aede36
- SHA1 765c6ee748d58fe04e199967dd3672c2551a4a01
- SHA512 7d56b169d80e042996f776746dec1aaee911d27dd0b9f6bd2e5523f29752801cadb6814bf66be8a75fc9e98adf0c4730b29f5ad4554644947756cec57523da82
- SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+C1a8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnV:Owu+OWgXKEFG1rDHmj7dip
- TLSH T13B05F14677A40CF9D6675638C247C536F7F2B8112A21DB2F17A0C65B5F273226E2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 675KB
- SHA256 207d968f4c9c6d25c0a77fcb3f6e3b29fdebb537056857488384d056f08569db
- MD5 9477e11f4ec5770b26e980f18676c53d
- SHA1 99b14712f8913aaf20cc45673c05818a772738ae
- SHA512 276d54778c700882bfa076ebcc11e1fc21658f8e64f684a21dc2b18b438e084aa52804a1e7efd1ddeb2d19e2a8d9347b7af2cf858f7d58eefc2d35fe0547d3c6
- SSDEEP 12288:Spf1Igga8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:UfuxXKEFG1rDHmj7dip
- TLSH T104E4120723D021FEC266167CF5A25A45D3B2B0A21B7603DF12A416555F66EE30F3EB36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 35d622bad422e147ccdd72d1b3b0310a902d23637940c97cbeb04645a5fd1f3e
- MD5 c0f1965a35effcbd940f519c3e6c4edb
- SHA1 7da68f5420c995a6bce099859d74997e5b0b47c7
- SHA512 2c69e7761997bde116467e0d368c47e713d46b9f3f61b45954910b1b800f219e2c806d93e19a4bab8adac1f1f609b15d15c941fd1f27926cb3fa84c9e280f5c6
- SSDEEP 98304:RQRQyi36YOcP8Lvw2gAf+PN3lXKEFuD84:IQyiKa+X+PNNKEFuD3
- TLSH T11C667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 a3c5a2ac18e8b2e88d98f76b8696fdd6ec261d3cf8ed456ccf3d9045df7d2ef4
- MD5 7756039379697454bd1f9ffbaf4fd415
- SHA1 3857e2fe7f92c9e8f88ec88710e4ce610d7629c8
- SHA512 ebae70b86993302d3f71dae44358298a26fc8f927c2b0bad74deba7d9d26f24f2747c32c926b8e736b34bec1ecbee27ecf8f0a03e23f03d996e7e282d92b3de0
- SSDEEP 24576:Owv1qf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0VXKEFG1rDHmj7dS:g68Qg55nhMeWu7PNU3/OXKEFuDHchip
- TLSH T1F7B55A33B2F200A9C44DE1769F4A873196D27C718FE1E3DB855572061BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 f0f609566929f322062a8fff59d537a25e5851503666f0c798d343e0ad14ee1b
- MD5 023bdc2bd94756111b3b3caf61ac912d
- SHA1 d31b5ea847756e0f97291ceae70051e603afa256
- SHA512 ecc8b9264378c1b58be6063f22727073e8e831ca7ba58e121d76331f65f1b499af2b1a6c6b1d164407255798acb042bf5ec10ca07bb461c8b19507ac835ba7f3
- SSDEEP 98304:yy5112gYy5azzVv569nLKnhZtXKEFuD84:7LIHAWhnKEFuD3
- TLSH T11C167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 8b856bb75ff6289f4ce6e38eac15a5dd4b26b2d05879a0102aa711bbe1d25dcf
- MD5 e8c1a9e6b3a5d4d31c5aa9f9e764773b
- SHA1 bc4a83c612a4990bd780787c91662ec84b4a42a1
- SHA512 c62d8eeaf1dc2fe1f2f3e2f1fefda862f03683c8f526f4b0c28f314dc9ca23d9f9d7886b538aa504ecad9b770a2aabcbc1b8832b601c1d49a74515309dc65318
- SSDEEP 49152:My+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl5XKEFuDHchip:Vu6JmTxd2d5XKEFuD84
- TLSH T1CAD59D13F2D901E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 a5bde71e1968616f8ee8f37064c973ff66c14537f0249312ffa18f809c2f4725
- MD5 5b321bb23f893001466cbeb678ad69dd
- SHA1 804c29965175617988a4dd9acf529cb4533beb8d
- SHA512 02ef8457170b3717413e1872ac858bfe1cf891a41733c54c0cbc29d8fe56a2b366a239a585b2b7bf433aeca8dfb6be8ffa6692d694ecd59c75c11ae1c87405ad
- SSDEEP 24576:4+wvtk9RX6wkyAIDnXKEFG1rDHmj7dip:aMnYIDnXKEFuDHchip
- TLSH T1F635D029EBC804E5E177923C99B7460AF2B178691B31C6CF1299536D0F37EE45E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.6MB
- SHA256 afa0bd451ec45ceec193d4e1e62b681e27dbfe9366815d2da587d48e4c18b3b8
- MD5 c956bd85aef14b51920edbb8fe6b6c5a
- SHA1 c4a7439fc1560ffdbc8ada495d87fbb0ac1f2739
- SHA512 9a91e6c4eb7be37a1450cdcc5c8d157f89a60410160d8a97c2edde74694f90637b2ce7ca6d538ce04fc688cb58857964df37e8c0d982596128ebe606fd58a2dd
- SSDEEP 49152:rY79Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tjXKEFuDHchip:qySzPVjXKEFuD84
- TLSH T1E8067D57A1A801D5C1B9C1B98B1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 8259f82b80bb803516ff336c0995d22908484aa1d1069a38549cbaac70bc38ee
- MD5 5a9e8256c49cf480b5710d049ddd52d1
- SHA1 b6872962f996284dc68a5c4926c37f432b8270ce
- SHA512 92154821ec48b2bf473117ad965adc036af0878757062d8e7de5e621a64d5cb1240aa03b3ed71ffc90cf5bcdc17cb5d965c538c39f8430826aa39e57f65dc3b3
- SSDEEP 24576:ku7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYtXKEFG1rDHmj7dip:ku7JUQjXirIhCnDHUPfF/3XKEFuDHchS
- TLSH T1B265AE1EA3EC02E5E1BA927885154A5AEA71742E1F31CACF12B0437D6F63ED44F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 718KB
- SHA256 7d78f892ae500de95ca260ccfbafcf473708b27b7df4a6101da4248b88a360cc
- MD5 553ab38a6832688c046681d46b86f656
- SHA1 501d4f0e9355cd86cba9fa7d804d53f27a36fee5
- SHA512 182e218cb2951251a3ed864afdc2aa2515b06421e4bb94b518e6309082550a8dd25cc8d7f7e602c695043e7ddeaf467307bed11627c9a56708bd93f560ba264b
- SSDEEP 12288:wF8fVa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:1VXKEFG1rDHmj7dip
- TLSH T127F4010AD38402E9C12E2679D3065A41F373BD6187E193DA63D0F53E1F7A6A10EDAB17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\ARM\ArmReport.ini
- Size 102B
- SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
- MD5 c42592fd019ec4a186471c670ded3b4f
- SHA1 2d5a5b980279b0305441b007778a31c18e84cfb7
- SHA512 dc22dbfd7fd36284002bcaa73c2224d42afa850123dedac16c37ac48abddebf6d0c7db1d02793dcc9553d226de60a2cad8075a03be7efb4caa29e92157bb36d5
- TLSH T172B0125313D54C10F4101801CDF444337F2270C0680AC00CC0D1111744F0CC0CE622AF
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\ARM\ArmReport.ini
- Size 1KB
- SHA256 85511905bfbba3df435e44c0aa9e01c2e4274a8ed47c1895c1140c085b43f553
- MD5 fdd06fbfbe9e561db33339b5b82f01ac
- SHA1 f508abad429c1bde5439c6a40d73f6678797f95f
- SHA512 9b0f022efc4cd230290d8c7a456e6760fa8a8156ea72b4aad4b939a91a34cf41c7c676cadff595394c624c8c7ecf36806a5cc1d203466fb64d9dc2c5ca7ed46a
- TLSH T1E5219D872AE90164F5B35F54EFF9947357323CE22D19C86C80D8124E4CF1A90D5B27AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\ARM\S\29431\AdobeARMHelper.exe
- Size 413KB
- SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
- MD5 522026a14d6bc781d2a15c665e454310
- SHA1 9451a39108326ba578793b1feb62f23a02bce916
- SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
- SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
- TLSH T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
- Size 1KB
- SHA256 ca4816c81e19cdeb1fc5592f91d4c94241a32686150ed4cdb1eb06d7389bbd3d
- MD5 f7554f3dabc351f9234b50ae07b25146
- SHA1 0e2e9ea21ed285816644ab0619125515ebcca72f
- SHA512 c07e6da10b7b8457dd05d48afa5a3d85f6ddcbfa2d25b5fad7edfc89702fb2906a41f1f6b335dfbb8a209f2b38052d5a4bb68d6f53eac1cea7ee0b566668dafa
- TLSH T11411F35A00183623560A6A70DC89EC67ADF2E3424295D857DB00C4C15573FD52F850FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
- Size 727B
- SHA256 63debcafa65ae8e91292dc1feb5839c916ddbba8066a5498fa126ec4bfb9f8fb
- MD5 c0f0431d8d48828143ed696bc0cd8390
- SHA1 39c76968029796d7280f8c626b7979d16a1f6cef
- SHA512 b90cfa334dbdaeafec6f1042d5e09e0c35d1d1426192e8ee8160aed6ac73f0ecac4415d13501aad490f1cd5eb4f5ba5ce27dfb36b6a719f479f106c9c9f0c4a0
- TLSH T10F019422BA2CDD540A068FE4571AC3643E29C304094DCC0F2A10EA04D39BE2B5FEF015
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
- Size 727B
- SHA256 0e3b25d8203b9966ab14f8e7f2a8ee418edc423e14f61a3e910fd72ebb51f324
- MD5 f74f08d542936e8c519e91ee66aa3aaa
- SHA1 31c55ee760baf369880b4a8d1c292cc5fcce3fab
- SHA512 be24535b7401c087eccbc673caf1d0cb3a94d0385fe29f1ca9d6e04114d8f727153e03ce6f344909fcc1acaac75079b24569527b0d7aef963613bf0accf0e7e6
- TLSH T18001945B635802D260439E4C8E1C1AAC37A2062476EC666F7134F3D5E6CCB1E7BCB834
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 a1f94b5beb7cbf9c3a608a3576ab072d303f92c9a8d4f6d0f348cb5e91200bd2
- MD5 8ea56e8ffe7fce997d4f848ce9297372
- SHA1 b435370908898c778a99946461bd38ed8ab6aebd
- SHA512 d188745f3787580ef372151479557056f7b59116846a219ad8e8b5775d2e9481d134fc3e8b802391ea75542138b1c7f79dc3655dc1bb2a6f1d9acada89f13027
- TLSH T18501609E33A0A74838261D45D7CCC07CF2B780C22EC90304B53A35AA92A67EBCB03815
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
- Size 252B
- SHA256 9650de458f77b76912c4fef3fd84dce88514d76ccfe7ec4c6653b78f71fe7aaa
- MD5 f0511aef53e5a72db2447e0dd25dbc18
- SHA1 018fa7372121b5ae6693c381ffe7aa83a4b35d60
- SHA512 f8e94dba7d43fc91835f137354c54926e8f23c104ac6e2bf289d1ba66e6a68e8b4f88fb5ae7c584ea6cb3e273d7905664162fb499304896b05f89245013de276
- TLSH T189D0231077F40322F2D763395E710202D735B96A9801CB0A1763114E583DF500C3091E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
- Size 404B
- SHA256 d4078ac64e8d5d38b078c6f2373c1377e93c8f48faf90e24b31347ea8e325009
- MD5 e96df364a3e5192da40b1bceb3207817
- SHA1 9fcb62a1e4386dac94b0a6506b9fc86ca4718939
- SHA512 51510bee9383276d73e03e42782e0a0b54dd53095447b6d8f471616bc68e60345a2069e302234fdc5f183c98f857ed0f677fd32507b30acf9ccfd081131f2a1b
- TLSH T13EE0C03032F8451EF1E1953407E56D1368D9F24A0402C36A0740630DAB127800CD5524
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
- Size 404B
- SHA256 a527299eb068af6661b63e02d09ac327bc3d2839c4cf2c875f93731c571d3cf0
- MD5 7b1366369ecb463676cf2b8e3529cb31
- SHA1 2aefb7d1575fc65b3e5d73fe8c1049fba464ce61
- SHA512 c48fe286d325ce4f4a7e2786e87880d7eba708a1c77ed56191b12c0d7f84045781a149ab0ba94948f713ab2b5014863c14e1b5b506b48abc65da28382b0082fb
- TLSH T1D3E0C03031F6045DF4F0A4340BF56C1B688DF70A1D07C37E014013456A24B004CD2124
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 44c9c3f0ee8478497255ac66b27cd6549c5c6e5e0797f9bf989c055b66cef6c9
- MD5 9a738dc7ab2e7fc96b5ab13b08d67555
- SHA1 7c84e77c58bfb45469eb7d8c976d6f4dd0bca00b
- SHA512 4fbc1642b789e687ca12fdf6a63ad773b60f67707d17ee95c238c408d9113de7af0ead3e3522286ed3875e5b63bf1de6c420559dcf1a52b66d663bc4febec60d
- TLSH T121E06F2826AFB6AEF090A8304AF9A4761E4AF2062840D3B906804308BB0AE405C10AF0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
- Size 1KB
- SHA256 1199f9d0907624a7c4f500f78cfd3d2ecb6da133cc1fd002c3655271709f86e7
- MD5 53f709494ab5e67ee8dda7e4b5378241
- SHA1 42b232e514fa2bb6f8e102e137118d436d333bb5
- SHA512 58180e9c006cfbc8ebb8a1ea386b9c6ec5008834837bf4ab5fcd4f1dec9fa23424329cce6f9d69788eb418ba1f6a9f0d76b32af02a25dc12ea25cb83b1dab50c
- TLSH T19521DC807F2B11767272416C95291FA1E49AF4212246ACB8F3C64B9933E3802CECFE94
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
- Size 1KB
- SHA256 ba0926c0edcb1081a99ee6305277ae9e58dd86d917ffdae69d13eb89d853311e
- MD5 de82362306f5bbb38c2f423439239baf
- SHA1 a8303525e37fcf0afc35fa2d51ba590a122c413c
- SHA512 14ee19718398e1999daada1c5b14eb2e5c00e6336060e9d930f794331de43c48a27b5eea92c53142374ce5b4ab9ab3fbc0b7df8381e08ea34a0af3b730f44269
- TLSH T11F31DD817F2B11767272416C95191FF1E596F0216242ADA8F3C54B9973A3806CECFE98
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
- Size 251KB
- SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
- MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
- SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
- SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
- SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
- TLSH T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp1B9C.tmp
- Size 5KB
- SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
- MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
- SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
- SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
- SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
- TLSH T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp70A4.tmp
- Size 5KB
- SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
- MD5 5a68f4aec3689d0dc750adcae8e60520
- SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
- SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
- SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
- TLSH T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp7180.tmp
- Size 3KB
- SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
- MD5 fc2430057cb1be74c788f10c2d4540c8
- SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
- SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
- TLSH T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp78F3.tmp
- Size 5KB
- SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
- MD5 1b7ade3253fc67477dea69ef2147603d
- SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
- SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
- SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
- TLSH T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TmpD168.tmp
- Size 5KB
- SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
- MD5 5bc2d1f7a5fd950dd51547ead6afdabd
- SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
- SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
- SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
- TLSH T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 606KB
- SHA256 f900147d2fa43e0004fa6ab908bfa90873cf8f6f333dc708759a423f6c0bd74a
- MD5 a1aef425baf767d45622a723559fbc36
- SHA1 d041a82e2abf8f9305c5466992a796ac4d372030
- SHA512 4217e8b175cac4c451414c4c3a44c0de3dfba82e78d3278d1f639788103fcb3100eba22567d131d7976bea6d2bd33ea43bc3ff0aaa8194ee24681751e9694b61
- SSDEEP 12288:B87fa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:6fXKEFG1rDHmj7dip
- TLSH T134D42303978447FEC2282EB8720B9935607AF3B14F4115FAB59836509B98D630F9EF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 acb3a7dcbb6c2fc821011909a0346d536405677976ffee983e5ea5b9323df347
- MD5 f03c636f2578e427211a22f6fe81ec70
- SHA1 b8551050df8b56e2b83f16673fb68dc196815d27
- SHA512 c38eee2636832ba22e5eb259a838736bbe8631f9f39e1fbb9d03c0ab3fbbada326d72fee9d654eb512d468d63109d78969fcb83df8e82ba6186434e2bcf13ff8
- SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYfXKEFG1rDHmj7dip:hgb4mBIBhGFqXKEFuDHchip
- TLSH T16E65AE1E22E802F5E1F9E2B8DDAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 660KB
- SHA256 fb73a03ed843a3f6a3ff8d491ab0c1afdb0e4dad8a1b88658e659bef9f39ebd2
- MD5 e130316d12964c4ef35fa24f8e3f4c84
- SHA1 d173bee508f5b497d30307141b4909323bd3446f
- SHA512 83b46f563d397d9434437df4ad8f68a143ff512b1d6f5b8ddc9658e1a323538c9600752dc4a52f1e2081f017cde1b0d47b0dbc60b65bc9eb56ddfcc1b9fc1a31
- SSDEEP 12288:8dG0a8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:gG0XKEFG1rDHmj7dip
- TLSH T1FFE4230A66D022FDC2395AB971265966B4B2B2B04B0426FF05E47535CF98DF20B7EF1C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 624KB
- SHA256 dff2aa9329ea7b359fd2c813ffcbe8027c79fa30a6b8a28ebd84a8c28cd37589
- MD5 d6e9bd7b0cc75ed68453ce07c1fa1082
- SHA1 6e578d855fdf0ac0649584f17b46d8f74bdd6da9
- SHA512 8a7d7a6e58337151c197f5937141daee85d8fa1e90673c0b6b81f3aed353c69b47e9f213e7b76b8d4679a0ef2b47a981224b1614c6647f9ddf9140ab92751e17
- SSDEEP 12288:TEa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:TEXKEFG1rDHmj7dip
- TLSH T161D42303978043EEC2182EB972076E6560B5D3A15F461AFB64E835119B89DF30BBEF1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 061f06d81a0f36abc4bcbfeb638da7cb9ee5b8464a99e1241b5e33cf8242241f
- MD5 13a749ac2a64de6655b2acf3aa8a33a1
- SHA1 c369336498be71feb874f8f03dcabe2c76cc6f44
- SHA512 0e09e30ecf9e7c2b32e36f843d3b959de750eb412a86cba831471bcf3388665e711203422f6cebc169aa6792cd8284f6f7194abf699d6ea04e709e72c14ae63c
- SSDEEP 24576:I7b8u8FpJqH1ivria7/mmXKEFG1rDHmj7dip:mAZFPqV9a7//XKEFuDHchip
- TLSH T17B35F16667E002F5D47BD1388A464663F6B2B4210364EFDF06A88B511F23AE50B7FF25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 828KB
- SHA256 890277583ff12fd33b444701103eefbc8c42f1c69c1145a56d4d44dadcf81360
- MD5 3bfe04d4f55d649a959c1f0e3d3c0b60
- SHA1 779205910fbbacd5ab35df08db58457973c46788
- SHA512 102a4f1ab3c1cd880d9b7bcf57e1b519f45b06ff702676b32d18b462f3c74d264991d6ebacb5fdf2efee55692528ddabe52cac14b2c08c45c699002b85c03a56
- SSDEEP 12288:AHvUrBFrEjwaQia8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:APUr+NQiXKEFG1rDHmj7dip
- TLSH T18F05F21F22D818E9E67AA17D9642871DF372B462070292DF02E0417E4F67EE86D3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 6db14f7bbe51384671272681a07178015ddc62d01c9382e7cfc8b71bb67ece02
- MD5 30946b1bd9a283d9981f421d6df53a65
- SHA1 651fade802145daaf4d62758172fdb7768a81c30
- SHA512 3f6cd28631be33d351eafe001dc7e28b8a6b97966f6ced0e3e3b81df8cf0e5acedff0bc86a48d97a1c0bf3738727f068d04120931dae963965934efa1964c9a7
- SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmXKEFuDHchip:xG05lO43blXKEFuD84
- TLSH T163D5C06E62EC01F9D1BBD17CDAC64A0BEBB23415032556CF02A486A91F27FF45A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 c80ce6c16b9b625878404e12747db185482919cb5a399a5bde61223159301e96
- MD5 2b85e0793fbbbe776802411c68afdece
- SHA1 1699ad232a53063f654e7d0a5755ff056d9738cd
- SHA512 3f7b7e28c3b92a881c9bd87888d0a0f1eaca961ee6f80b8b67336fab04f5ce3dd6cd8e554ffe8946357ef68a272f91b6da8b52bfc011a92ee8d6608c6b2db876
- SSDEEP 24576:PZa5POZ3dpbWVM50JicR2hG0lasx2+47eidnMXKEFG1rDHmj7dip:ha5POZ3wJt2pasx2+mWXKEFuDHchip
- TLSH T1A665AF5EA7E801D5D179D17DC5838A1AF5B1342253329BCF122182BE3F27EE85E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 3e93d9e5238ebd27467c9ccbeca33e7114348bea0b464ea6e604fbb134812ea9
- MD5 0f3bd211d41fc90a5b04afa277266b60
- SHA1 1ef0162c66e3970776107547b0b00a44e3b1c1ab
- SHA512 538d4d0a1badf3e707b043a676c74e25e7bbf59269a21a8981fe8a114466bd631744dfe84950a3d650a6e2bbbadb05d1a4cbca1cc9b983b49ab0c491360088db
- SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkoXKEFG1rDHmj7dip:pNc/zEOVHFlXKEFuDHchip
- TLSH T14D858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851B1F73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 932KB
- SHA256 bc92c7db989aa4210a76ab953f2bba0231a3df12d1f882c6f53db2d669607a64
- MD5 3d03092d3da9880b88c51c5977c2824c
- SHA1 689914fc98924433ab5dea80ea82a55ce6ae97d0
- SHA512 be3806acba0e9492304550fd7fb5e43d963e82a99468520b7d0de5911d2a8f80c4baaf3943670c7016233e10776708744b1e854f2ec257c4807af8782de83457
- SSDEEP 12288:6nHPJnJP6szeCs6Rl28dkPa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:sJnJPbzB4SmXKEFG1rDHmj7dip
- TLSH T1F215E02DD2A810E8D4B7C2B4811A1B5AFE71347D2F2269CB19B4D5343F52FE06A79F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 51a065cbb6abfa80e625d72c376a5610ee78243273089dea19a4b3f12f9dbf36
- MD5 1af171dc3591ad91ae2d08583630d323
- SHA1 92ce0e17e9787e63039473f71919372d73b9b53e
- SHA512 f4f43b57774cf2e43346a29ae73bb6c8d111d1a5f5a9ea7666f24074e3501818a646aceec99b5df944fc2fb579bc351b52c78457fbdc892a87cb6fef9961f2b3
- SSDEEP 24576:JCLHGL0MoeVtFumTijCmlKQWDkzXKEFG1rDHmj7dip:JCLHGeeV5ijCmlDWDkzXKEFuDHchip
- TLSH T18BA56C05E7EB4184E8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 776KB
- SHA256 ed43b08c6646f81128afdd1d86aef70273dec647d02d2b1ac22d5f955b0f1c43
- MD5 764072a54604fa46a41f9eb16b0f5f95
- SHA1 808e0951cec73141e176569d8c4d1bcb8f06730f
- SHA512 9f342d563457788a2da203a2507a5f85e682b538cfb3a32298eaadf51fbf788d9c64d2f04c946d81f189f82026c1f7655a4817ef0fef5d7bda7f2a38d9fba3f2
- SSDEEP 12288:U1Huk6j5ZI7ha8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:e6DIdXKEFG1rDHmj7dip
- TLSH T1B7F4010D236611FAC16B907EE2430512E1B2F1B187121AEF06E495798FA3EE97A3DF45
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 760KB
- SHA256 27c744e6e713b606a9430d038dbf1cb121357568da044a89b8cc4b8ff79be109
- MD5 92a6ad811f409db12e3012eca3962a7b
- SHA1 cc6404b15c9c26380c33c081ed361419ff583332
- SHA512 1a369a56141e033e1fc13b46a8f0638dc9301ba1090d99c830dc548ba968eaa114fd3b8be2bdec6faae4a7a3c0a0ffb05d2d29f4dcf56a23d435ef301cfacdd0
- SSDEEP 12288:NG6kyAa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:0tyAXKEFG1rDHmj7dip
- TLSH T15EF42202538451E9D2391A7CB22386A09975FD205F0117EF21E0B63E6F75BE21E7AF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 632KB
- SHA256 b6cd826850093dbf3a5b092da7ccbf3d821067577ef6cfa4af28c521a84f24a4
- MD5 efab7f6547e4724298ef7f25555125de
- SHA1 d3c93936e645de1243adbc008a15ddb526d1410c
- SHA512 0c38bd0be2063a874ff1e0db70876ce6c3a63c9daa9c4a690b20b4dd20526c378fcfb780cb22f5a6d56ba8ae58079ef4bba3e9a22c9a1e89b5464288572c988a
- SSDEEP 12288:tgza8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:CzXKEFG1rDHmj7dip
- TLSH T13ED42306574013EEC2182EB972175A6590B6F2B14F4626FF74E439318B899E30BBEF1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 d7dfcc2a95e8def0a8d35c247797342c596ac7c5c02d4eb136c00c30be7759a1
- MD5 d6e5ca90f9f4c56b52c8af18dd4ac95b
- SHA1 a456e6c769ccc787b77642aa07e526b70bf2e8bb
- SHA512 15fde0e2164911d8e5a9056f56d4aa93d4809f1c244a114c8dce4af4f7a3458b7e48f0a84f4cae4a6479b00e69045926f189d2323e89f303dd91ddd2773fad49
- SSDEEP 12288:oEgZSZyFDK3tT5Tr7aVLIH9lH3c4za8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzm:oEgZXoTfaidZ/zXKEFG1rDHmj7dip
- TLSH T1F5559D1D63EA05DAE2B2D679D8231493D633B4315772C6DF2448C03A4DABED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 792KB
- SHA256 187b903fa5a42a283cec112b9f035ad1be4e333a30a91d95085d75536323fb63
- MD5 1289e87f306d2639eae336464daf1f2b
- SHA1 ca467f4a2c2e090adb6b328e9234925e6dc22552
- SHA512 c197757dd3e9fc9a146ce6db037f5b63cc0a88bb116728ddf48b6dded816aa22dc9e9a36f8ec9d6b1fc21a749e308a45a4a77395d50deefd879a05b5f6d2aa89
- SSDEEP 12288:UpJcm8CN8fa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:UrcmRcXKEFG1rDHmj7dip
- TLSH T12F05F10EB3AA00FAD27B917C89424656E6B3B070575227DF02E0877D4F579EA3E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 8a754d77dc637b6ad44207ecf42decc7ca811dfad980fb6145c1a241c71838f8
- MD5 af97cbfc09d48188d59296dade89c012
- SHA1 985af4d3a1ad123dd0adf26b07a54c0e75b7c772
- SHA512 3e33e0e5072ff6f3739fe5249397f328c547ba698ebb083d687caa1e22aba0ae0acac8d71cd56e3a8331e77e24ed7ad87315048311668035ecb479d7f23bae22
- SSDEEP 49152:FDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3XXKEFuDHchip:G3Upow8sBsXKEFuD84
- TLSH T118A58C3DA2E810A8C9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 12feeb10a3c0d8fedd7c2af1cdf5909986f226ea56e9821569fa5aa235d07467
- MD5 ee3e64045107499e040d9a3d22b3cde9
- SHA1 086d89a42fe9e04136f3d725c8d07e263c9a37a7
- SHA512 560ed534a0384d03e15dcb9627c62874e9c959d5a49c3bd4bd90ee34821b10667dafd1dbd24b0a1d2dc63da560a28a96b9a23e87c1859aed9e13985797b0f205
- SSDEEP 24576:mTkNvNnaFeYhJNtmZBmrXKEFG1rDHmj7dip:mTMwBtOmrXKEFuDHchip
- TLSH T15D55AF2EBAF806E4D1FEC6B4DD238512E6727461073253CB5290C13E4E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 988KB
- SHA256 b73914d4bb6a0419bd0ea0e75230bfad8d58fea4b1dc8a55e9bd6a7f2e1f1677
- MD5 36ba82eff92785aa2ce35ba767f5d77c
- SHA1 e19734afb4ed0c842b4334516e5965a54f982f57
- SHA512 15b9b32e6362d9543eccb913a379168141a19aaa1e159726cf34427687a05b7f255191b66214edf41363b6b93a77bfb72a5be2b2f65afc456e6138efc4935b71
- SSDEEP 12288:0QcMxWDXN1Dp/fshBItT1IQgA6a8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUD:uD3FHshBIYQgA6XKEFG1rDHmj7dip
- TLSH T13D25F13EEB9C00E4D57BD1BCD6638A06E27174A9032266DB12D481B65F5BEE42D3EF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 768KB
- SHA256 e2c0c6b23589c1a5bd0bbb6b3739913dbf53f40fa0e564c029052d9c021d2652
- MD5 8b13084f5d7bc73f9ad0ece62161789a
- SHA1 203fa5fc02c6dac255f54dd89cc9b09b29465401
- SHA512 67bb5a5476ea97b262224d10eedf5175da05594e8d54210067788a96069b0d43112e351af6ad2d9fb18e5ee6e1ce7510a00cc95af6669c2473d953cbb223abc3
- SSDEEP 12288:0yk6b3IkxjbBz8a8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:06Uqjp8XKEFG1rDHmj7dip
- TLSH T111F4120E57C011F9D1391678F226822580B1F9721B6656FF31D8663A8F35EE14A3FF29
- MD5 SHA1 SHA512 SSDEEP TLSH