Analysis
- max time kernel
101s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
- Size 2.4MB
- Sample260708-vm5beaet2w
- SHA256 762840742f3f03ad6de79fb7a719906032aca5863690446d1da0b090cc232098
- MD5 b0bc86b2f30906a09c8f4ec87b03a994
- SHA1 6b531ed94fbec8d9e8fe260448f4587a1452762b
- SHA512 bd1c68be99ac07d284568fa605437fcdc37ca30449d391c4868420ea36cac6bf054e48657b32c8a9e06db49ef5abbf511306445e892c09d713218986d4a1dc90
- SSDEEP 49152:X5zg/85WOoHTOrK9PE/a5Vf1AY/IVEMy8ts9IY00s1iFvLtkmy:pgjv4e/Irsur8+/
- TLSH T1F9C5F121B583C0B2E59211F195BDAB7A8C6D7E340B3641C7A3D43A6D4D709D3AE3EA07
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 25 IoCs
pid Process 2392 alg.exe 5412 elevation_service.exe 3736 elevation_service.exe 992 GameInputSvc.exe 2756 OSE.EXE 2328 maintenanceservice.exe 5636 GameInputSvc.exe 2192 PerceptionSimulationService.exe 1248 msdtc.exe 2036 perfhost.exe 1452 SensorDataService.exe 5732 ssh-agent.exe 4004 AgentService.exe 4496 SearchIndexer.exe 3412 ReFsDedupSvc.exe 1592 locator.exe 484 snmptrap.exe 2824 TieringEngineService.exe 4552 AgentService.exe 5800 vds.exe 1992 vssvc.exe 3244 wbengine.exe 3320 WmiApSrv.exe 5884 wmpnetwk.exe 872 SensorDataService.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe - Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\311523b314575bfe.bin alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db SensorDataService.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118750\javaw.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d196a66fc0edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000594b5765fc0edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc8dcc5afc0edd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8c07364fc0edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{EFC5D365-83C1-46EB-A505-AAA1260D5EA9} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{CE9ECC81-72B1-449C-8C85-D2D6209B6CD7} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe - Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 5636 GameInputSvc.exe 5636 GameInputSvc.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 2468 explorer.exe 2468 explorer.exe 5412 elevation_service.exe 5412 elevation_service.exe 5412 elevation_service.exe 5412 elevation_service.exe 5412 elevation_service.exe 5412 elevation_service.exe 5412 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 828 Process not Found 828 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe Token: SeTcbPrivilege 992 GameInputSvc.exe Token: SeAssignPrimaryTokenPrivilege 4004 AgentService.exe Token: 33 4496 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4496 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4496 SearchIndexer.exe Token: SeRestorePrivilege 2824 TieringEngineService.exe Token: SeManageVolumePrivilege 2824 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4552 AgentService.exe Token: SeBackupPrivilege 3412 ReFsDedupSvc.exe Token: SeRestorePrivilege 3412 ReFsDedupSvc.exe Token: SeBackupPrivilege 3412 ReFsDedupSvc.exe Token: SeRestorePrivilege 3412 ReFsDedupSvc.exe Token: SeBackupPrivilege 3412 ReFsDedupSvc.exe Token: SeRestorePrivilege 3412 ReFsDedupSvc.exe Token: SeBackupPrivilege 3412 ReFsDedupSvc.exe Token: SeRestorePrivilege 3412 ReFsDedupSvc.exe Token: SeBackupPrivilege 3412 ReFsDedupSvc.exe Token: SeRestorePrivilege 3412 ReFsDedupSvc.exe Token: SeBackupPrivilege 1992 vssvc.exe Token: SeRestorePrivilege 1992 vssvc.exe Token: SeAuditPrivilege 1992 vssvc.exe Token: SeBackupPrivilege 3244 wbengine.exe Token: SeRestorePrivilege 3244 wbengine.exe Token: SeSecurityPrivilege 3244 wbengine.exe Token: 33 5884 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 5884 wmpnetwk.exe Token: SeDebugPrivilege 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe Token: SeDebugPrivilege 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe Token: SeDebugPrivilege 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe Token: SeDebugPrivilege 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeDebugPrivilege 5412 elevation_service.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe Token: SeShutdownPrivilege 2468 explorer.exe Token: SeCreatePagefilePrivilege 2468 explorer.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 1620 sihost.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 3528 2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe 6020 StartMenuExperienceHost.exe 2468 explorer.exe 4964 SearchHost.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 992 wrote to memory of 5636 992 GameInputSvc.exe 91 PID 4496 wrote to memory of 5148 4496 SearchIndexer.exe 105 PID 4496 wrote to memory of 1544 4496 SearchIndexer.exe 109 PID 1620 wrote to memory of 2468 1620 sihost.exe 120 PID 4496 wrote to memory of 4972 4496 SearchIndexer.exe 124 PID 4496 wrote to memory of 2448 4496 SearchIndexer.exe 125 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_b0bc86b2f30906a09c8f4ec87b03a994_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3528
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2392
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5412
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3736
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5636
-
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2756
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2328
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2192
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1248
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2036
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1452
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5732
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5148
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3816465931-3623202676-2955785815-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3816465931-3623202676-2955785815-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1544
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2868 2836 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4972
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2540 1792 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:2448
-
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1592
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:484
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4552
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:5800
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3244
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3320
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5884
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:872
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2468
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6020
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4964
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵PID:3100
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 49cc1ce64cc8ab03708d1932ffb1f80102a990313150aee69a6c39ed12c706aa
- MD5 97baa4f8a889d4bceac1c6147c4cd591
- SHA1 c341110dcb381ecb99c46de28dc21b5f2f734e06
- SHA512 bf57cc4bc1b8498974899d3092d8fd3321efcabf0c3999125e8400a2825c979dd9510c35ec6a6122a0350d76abdacd413af530cb3640ccf076d2ec7c16f26e82
- SSDEEP 49152:5b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnv/IVEMy8ts9:P3q6mjBI/Irs
- TLSH T11AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 61f39c7cf1a2855993aa04e2bf6c4fa2d4a8c63d08a53818eee31f8fb4998bec
- MD5 f237dcbdd22162e7ae2d8b3d1b9f3cba
- SHA1 a3f3b98d45843e015a5e1e664459c0334f996436
- SHA512 67d46b08b836f00b9725deb44c5dd0440f9c62bc0a6a1706caf15b4ef524547edbf12d169310e98f04fe995f939896f68b4c015f2875f6f9a3eaf9c67ae6a3a5
- SSDEEP 24576:2XYJcRczA9Y0n0Jq+hM1iGI75Vn7Tbtkmywjp/0isbto/QUwInM48+8tkZB9T:kRc6Y00s1iFvLtkmyC/IVEMy8ts9
- TLSH T1FB65122863D409F5ED57923DD8B28514EA33BCA58B64E78B03E0A92A1F333D45D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 845KB
- SHA256 df1fd72461cc0a59ea770f60d4bae98b12bd75bf5eef86395a8ac3f9deb5b253
- MD5 749505af27e43c5298440ae8331f8478
- SHA1 aa390a2ca2a1f701c8df093be4d245c7a41a6954
- SHA512 6c6079f81772077285d9416d0e18510243b3c8226d9332a50d9437da5ef3f12f9b2c767f4eab1935f38392437462687c2a94287d5124611d110403327ff22a2f
- SSDEEP 24576:TXYJcRczA9Y0n0Jq+hM1iGI75Vn7Tbtkmywj:jRc6Y00s1iFvLtkmy
- TLSH T14005F128A3E408F5ED67923DCCB28505EA33B8A547A4F74B03E496661F233D45E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.3MB
- SHA256 5df745e0f5547a9d50d580132ae7c28774739b73b7e56fbe9d71fe676dbeafc0
- MD5 6f8850abfcddb5d698512d2c889e4a39
- SHA1 0f6a274296dee52ff1c7f19aacfe13fe74585c45
- SHA512 58b8f1b7c2869caec3143bd608a63d85ac589b44291e2db2e30d7bc2cbd5555ae7c1c43814fbf6ce98eece39dee438f1162c670a8dbdd2e785dd7bef26149504
- SSDEEP 24576:M0QeQUT0q5xzrMn/0isbto/QUwInM48+8tkZB9TjKwv43EvpsWOMN+VYghVO8T:MvUT0SBW/IVEMy8ts9nKwv3GWZo
- TLSH T10BB5D025F6788731D073C0B9C5D2A69EE97230825B308ACB5286D76C3F677E68936731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 2.1MB
- SHA256 8878d933b25a25a9fca3a403d940ee57baef303100b4b5b6a087e8393b93ea06
- MD5 7af4b9ff7d5fc4774f7cb50a0f528aee
- SHA1 6a7a332ce8260138e3968190b45d752e5931e48a
- SHA512 6dc3c4ff329d313e753fb83b20ebbe881e34c500fab5177fb1f6952ac9971d2fcc2723d335391450f30debbafeeb98c4256a150bfa6bdac036535bc5b03c19ff
- SSDEEP 49152:X/ezSC6vUzPv8Hjyi/IVEMy8ts9HKwv3GWZo:PezSC6v2X8HP/IrsZ3Gb
- TLSH T1C7A59E25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.8MB
- SHA256 d2743ef9865c2e5d77674a0552463a1675747c4a6fe3d2be555e74db1658ad47
- MD5 22485d626f971d34d97ff8b363435061
- SHA1 8dde71e3a1e1512f140adaf0eac50ac6784f1afa
- SHA512 5d84093a9bf2bcba001e241232e99036c445cd3ec06eb7b2cf1c8ed73cacf60de4192870b5121908e443e5b030b933acb9af741fc8034568f9c0239abc5252af
- SSDEEP 24576:UaboPVZB1v/l+/Y/0isbto/QUwInM48+8tkZB9T8Kwv43EvpsWOMN+VYghVO8T:UaGZB1Xl+w/IVEMy8ts9IKwv3GWZo
- TLSH T1FC95C025F5B48331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.8MB
- SHA256 1e94799d738597eadd5f92a5b730a815e9598422b0d2bba98670f030297dffdb
- MD5 3012d2a47e84193c7ded3692c420b3cc
- SHA1 c9a3c6ff03a9639b8080cfe08e60a49740eda553
- SHA512 038bf0f37605622b2a3e1ec6447810f13a3ba6457f47dcd95a4b551f98e75585d7714fa55e29c68b79497d3cf42e63e00754ff36c736fb7f6d5fb2d00404e2a9
- SSDEEP 24576:xKL/0isbto/QUwInM48+8tkZB9T/Kwv43EvpsWOMN+VYghVO8T:U/IVEMy8ts9DKwv3GWZo
- TLSH T1B995332C15CD4A71FDC6AB70FBFA7AA4F5A71CD45C50026266A3BF861D301F0BC62269
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 2.1MB
- SHA256 c3ff09108332a2f5c198a48effe503d997a0749c7ae5c318e208ae074620b2e4
- MD5 ef0a51c65d190133ab482461b36da7c1
- SHA1 9f7c0a8c8b797771e579ffbe4d8bbcecba2dd844
- SHA512 b9e47f0944cd65b92634dc73d08955ec7571d3abc79bee9d113839f0c07d2ec3eeadf3078ea7a5cecd16c9552117205fee2f8c575d9a6b61a82d51aa5ddb1513
- SSDEEP 24576:5JIUQ/0isbto/QUwInM48+8tkZB9TDKwv43EvpsWOMN+VYghVO8T:5JIUQ/IVEMy8ts9HKwv3GWZo
- TLSH T194A5F13BAE28ECE2C67A9DB89B918740E77238704F6193C7E165C30E9E235E05D75C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 5.2MB
- SHA256 6b04fcb58787c2f5216c6c605e76587d8980fa00ac4b7657c9b2b23ede30c13a
- MD5 7b09afe9805ae562c783233fab9a216a
- SHA1 12b617bcb04c2a0ed16c1bb337a10c7035877c28
- SHA512 5842e60a87a06865022a9cb377cafd97151d3156251ae7e7797b269e3f4db1a1b71757c91d14079cafd715bfc891fd4b0d8eeb85528c8205ea69bc4a68a4ecb1
- SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJX9DN5JyNRV3THV:PQvGAdlCEL8c/XRNG5C1/Irsx3Gb
- TLSH T1D6468D656BF880F5E0A7E174C97A85B2F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 2.1MB
- SHA256 b99c3142e6ad205b35bc007df4ce4d1c49b2bde3350939f3d4fed88dda5b9171
- MD5 d785b2909bfed4a36ed5744cf3818f31
- SHA1 1f6f1eb64abfe47f0b209890ce06e480c4663e69
- SHA512 4472d590fdbe7133f9dcfd03346ef5c3415caaac65a3028ba3a8c319c26307610f62c8a50b76bbec803bcf5c3f3f4063a5096765759fe6b7fc20e868c0cec060
- SSDEEP 24576:bcewsAjm/0isbto/QUwInM48+8tkZB9TXKwv43EvpsWOMN+VYghVO8T:gljm/IVEMy8ts9jKwv3GWZo
- TLSH T1F3A50130FA74D432C6BB0DB26B76D716647D79604F511AC3F3A89E8E19302D12772A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 3.8MB
- SHA256 b2756a4a747de2b78344977d86d8cf78767839dfdf8abccfd3fbec7ddcc05e95
- MD5 1d6db30f81629a7106bf396690ce7d26
- SHA1 6910a6b1cb52252aa3de195a105629422d2ed556
- SHA512 62600d4000900a4bf4dfb8e6cb88bd0f2650d4d7bd431327c3c0044c535b69e539b9dabf06689fdcc5aee29bc0618a0907f5f842579c042798cb39c734d2a9eb
- SSDEEP 49152:WIbRquA/m2yL5zdfFiV+XenmE3/zG/IVEMy8ts9MKwv3GWZoa/IVEMy8ts9:1oqEVjnmB/IrsK3Gba/Irs
- TLSH T1BF06BF1976A8C2E4D1F6C77896A2C647F37178154B3097EF4266460E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.7MB
- SHA256 30fdf3058dc90b99ec577f4f4af05d81239e3d1e4e9e80038a1f44e5c1eb0372
- MD5 f71c7072cf2966db2613b2143ad5738b
- SHA1 3c40e2e654ce7685b491666c2ad01b23abd00516
- SHA512 9e976492ef6e896be7efbda98b4efbfa2dd372034001781519bff83c84a752192b00cab63069f50ca9a03c886c2d711e3f44298d62f0bf7133c38c05867905ef
- SSDEEP 49152:JAM5Foiq5R/IVEMy8ts9EY00s1iFvLtkmy:hqj/IrsOr8+/
- TLSH T1CD85DF80E7F915D4F5B3AB78A9B69570EA77BCA65E30D20F2150910F1E33A909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 849ab2ca99bdece84b6358fc4e8c136cfc659c669d390d66765f1f7e020ec94c
- MD5 95760b422b0db1a7c2adc99d935c6dfd
- SHA1 de8f002a3fd669a8dc87091c700797129885e6d0
- SHA512 b08849bb86b81e068a6bc0956db245a75a42171cc4f54d626a4a9b314f472f710deed065ae8bfb25772e2e2c33965e027c3d6a6dd92d56f0db53dbe68ac300ed
- SSDEEP 12288:amw5HEjsChNlBFgl0WDm+CFpzFkU8isg+LBZ7SOsMDIvwKxCG6iAeMrJeyAwp+8I:zwuEOWC/0isbto/QUwInM48+8tkZB9T
- TLSH T13B65F10936940CFAE9A79238C597D135F7B3BC522A25D71F03A0CA4B5F37361AD29B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.9MB
- SHA256 99454bff2adad21bb32d9d1d791d1f47751bb80f3f041a3ebab7abb0edaeaecb
- MD5 f0830125619d4559234233e08c01fd5f
- SHA1 7183bb0728ec5f158dfc07f6eaa3688080905018
- SHA512 113c9c3399f5bcedbb56c8348be6e998b798c4a55fed32e0e86803b8d5937b227eb49d6f45a2a6c2afd05f6f5ef8285abb69fce05b80f761c8778332358ec65d
- SSDEEP 24576:lZu//0isbto/QUwInM48+8tkZB9TDY0n0Jq+hM1iGI75Vn7Tbtkmywj:c/IVEMy8ts9HY00s1iFvLtkmy
- TLSH T1EA95231922D820F2E596623DE8F55908F777BCB69F7913CF05A2264A1F336D25C38722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 7.2MB
- SHA256 ce69c6282d5197beb4f03751de41d746723424d113783c49894444005d4e2052
- MD5 0ce1da91254219bca02a6c486c7a9b56
- SHA1 9cb3c2a099bc19de6f4a1cd4ac113d7049978ca1
- SHA512 4fff648ce95da08b88fcbf128cf2f62f22c7ed2e60f9eb5a27cb1ad48573b261c20fb9683402d4163243ed99fd07118f6b2f54643421ae692e4574f28e540f56
- SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3s/IrsVr8+/:vQyiKanX+PN/rsVwq
- TLSH T17D768C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 cd347181a63daf0e412c800752b777572572743a57c0db841bdf2edab50ed74b
- MD5 3db7e59a30c3c97953f7f98dba88c71b
- SHA1 3385b2af5f87e72696c48f4beda6ef1b37e7f473
- SHA512 84adf27d99c367330ae3d00f98bfda8d580f4e437e210005c38c85228a85736ccadf480a1f64d239cc5228d3bc962e10d1e80938aff345758d70931fa72c74bf
- SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U+:cQRQyi36YOcPDLvw2gAf+PN3s/Irs
- TLSH T1A6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.8MB
- SHA256 13f2537c30556219370deac9c0af18ceae9ae3073a143e88deedbd8be78e4879
- MD5 abac52fc3b58d2e03c35077f877e6a6f
- SHA1 f77171c70d2c28b74a5e90732e31d1a9882ae7ae
- SHA512 30bb4265698c4eb0fb39726e61e8df65572471fb84ceb4869f41f9b3dd57e89871c8f542b5aff69dd4f61ddea069ef2145caa53020821e22639468561735cbfc
- SSDEEP 49152:k68Qg55nhkeWu7PNU3/W/IVEMy8ts9FY00s1iFvLtkmy:OthTRc/W/IrsVr8+/
- TLSH T1CFD57B33B2F600A9C44DE1769F4A872196D27C758FE0E3DB855172061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.6MB
- SHA256 10d8b2b7873a47e7d2dfb2039a3bb2d4e335f0a2250a5cc24c2d04de00fc60c8
- MD5 ed8a393e810a97f0f14dd02573660ebf
- SHA1 59c83ae670c558d8aad821faf49ec6d9f2a3c9f2
- SHA512 41d677e44afa48e20a6818f2678907d552047f033e7880d33ff2160bbd96a4ca60476b4dcbfcc4e08cb13409e5f601d62f2ac742ecb3d5f3e05148774bde1c75
- SSDEEP 98304:vy5112gYy5azzVvU69nLKnhZL/Irs0r8+/:iLIHRWh6rs0wq
- TLSH T1C1269C13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 8df2ce7bbfa9aa7192994beff875a52592384b0b3c089d6a18d229867bd7bbc1
- MD5 f84df48acb5dca720d09281f8aa91839
- SHA1 ea64309e52c7c62fd7474f4420b626898f423f28
- SHA512 bd92693bea27057d0304b7a8c35e2a3c93992da5f9aec81367ce9df4cc9d0d98345d283a019227f5a37bcba4a83f1a6026c84aea00372d5dbfcbb887402a897b
- SSDEEP 49152:0B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glk/IVEMy8ts9:uu6JmIxd2dk/Irs
- TLSH T103D59D13F1DA01E8D06ED578974A9232F962BC490B34B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 f0fe8607a7355889471528f4365814148184d96226e465acbc5ea4fcccc16646
- MD5 79137b36b83a388cf24727c5c4d13054
- SHA1 565474bbe45ba7edf85c914ea2c4a19c93d7c52e
- SHA512 8e760ae9cf0f8a55fde935601d6e2c579f5fd5e46d299e69d0dc3a8f88ae099b6e53ec8f48949212005a2b4edaace65598dd5fb8055fab0e8451ebe687815d7b
- SSDEEP 49152:91hpsNoJpF1A67U44CwH7R4xw/IVEMy8ts9:9mifPqRB/Irs
- TLSH T1A2B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 2087571a77472ec5896fb783ec78726e2cecd3b1cedd5624822c4594d794ff60
- MD5 4d6c28149e4994bc531868d57051ba68
- SHA1 cc519ed38308e132b26ad846b3e77c770db9590b
- SHA512 8cb25a356b619d6ccabdb7bb4fba16f9cb8390d8a18014d58b3bad1f56f3e178b5fcf9d66f03fb2db5a8c5c017f239a0afa61264583afcadb9be240587f7f907
- SSDEEP 49152:vSuZQIY0Be2KkRVtOnks6NMHq//IVEMy8ts9:V5dKqi61//Irs
- TLSH T112C5AE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 7df8896e1340cf45d1f0d16e14d1847814ba1d1df4182c0ed57b3b2f7f1bb48f
- MD5 5952201607591c66555bd0356c35ad54
- SHA1 9bd47d29dae80a7b0933974e9d9aee7f79475a3b
- SHA512 9bdfc9a24c5cefdb94203bb865f2e63af007806fc2809649315f74416d6289fe6f04ea424f772a7b7c3e57e8e1eb2844cc54c7535a58d81605c2c665fee68063
- SSDEEP 49152:ehtSn8EApI0figjgiDn0AP5w0/IVEMy8ts9:/X2iWph9/Irs
- TLSH T1B795BE13F2D900E8D05ED174C7568632E962BC160B39AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 69a12f8afc100bf5fdd7b064b938c6fd8de9303b7c7eb5362e0b1827c53a28ec
- MD5 b9cd1ef3c03da62d89cbddb79b9a4d68
- SHA1 086ab9f55e1ea20cd7211fcd2a3e74988b44becd
- SHA512 848861d4ab3d4666926b602be94f541dceac5d88d733d531a8153fbdec565c2ee835a57804375e23205b4a346071635b8e0c102ba51f33aeb1247bd3bd20fc78
- SSDEEP 12288:zjpzFkU8isg+LBZ7SOsMDIvwKxCG6iAeMrJeyAwp+8tkZB9p9/:zj/0isbto/QUwInM48+8tkZB9T
- TLSH T146552309358A09F7EA999330F1FA7594E43BBCE2FC6412A711D33C095E37AF2641479A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 5d11d6d50a68e06e7bc85dbf8341467e9ca82bd9f2d4a1ef5957afbdc30de40b
- MD5 bf6c69c55b22f7a0e21833ac9203cc0b
- SHA1 01826a541d3b7ca3b25cb1fd039ab362a3b4966a
- SHA512 d045646a64a53b258c0cad76ab2d0a7823076655deac3db7d4f594a5dbd636e4d0dc106b5aaa6ceaa824b0e838d207fb422a599873cc51e8d8b580f203485b8c
- SSDEEP 12288:HqpzFkU8isg+LBZ7SOsMDIvwKxCG6iAeMrJeyAwp+8tkZB9p9/:Hq/0isbto/QUwInM48+8tkZB9T
- TLSH T1D1552309358909F7EA899330F1FA7594E43BBCE2FC6412A715D33C096E37AF2641479A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 621f21fd7126636de596817dc93be71ecc565714e6e643b0f9fbd7e8d95be096
- MD5 14fd0c648ae16426014b13860f5410e9
- SHA1 6fb41103e264512ea4cd5747393867ba6122d30a
- SHA512 fb8c27eb9a612735c09a13aa52f33865a4a6a3d90fc31105b4121e667f657b9a16494a5403a019117450ba861c66b474b557a01595f499bf40afa05157f7cd4b
- SSDEEP 12288:TIpzFkU8isg+LBZ7SOsMDIvwKxCG6iAeMrJeyAwp+8tkZB9p9/:TI/0isbto/QUwInM48+8tkZB9T
- TLSH T135552309358A09F7EA899330F1FA7594E43BBCE2FC6412A715D33C095E37AF2641479A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 545853a5bb999311e1e8944d4ffe441fa6db6969bb8f11445f0c938153f1766f
- MD5 e55c67d1d12314c07ec7181fbb579954
- SHA1 71d5a78766066ea55de26a2846d3bf7fcc4bd4d9
- SHA512 8df2bc836decadd4a96c74be8cdb27ae53f5b71fa6ba35f4a961708c154dfea11e567157972086e2f57553f3cf917eaf24ff36886f6fe4ab5893a6c432fdc978
- SSDEEP 12288:rVBpzFkU8isg+LBZ7SOsMDIvwKxCG6iAeMrJeyAwp+8tkZB9p9/:P/0isbto/QUwInM48+8tkZB9T
- TLSH T112552209368905E7E9A6D330E1F66554E177BCE2FE3113EB16823D091E327E1A834B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 cd2004dcebdf388adc91e28e399c3312934610b64dfdb04d756a095242ddfc37
- MD5 ea43bd62e14607161082fef184ed246d
- SHA1 ed6258724d8f558cfae78e70065f90b31d897e63
- SHA512 e07437d2afb4e5dcee0c7296b7e64963be4537c938cfa744db183cd350609f7e020dfacd9d85cdba6c458b59d6386f6c3cf8d5ab7ac64a483bff47d1d6d2a1e0
- SSDEEP 12288:MJpzFkU8isg+LBZ7SOsMDIvwKxCG6iAeMrJeyAwp+8tkZB9p9/:MJ/0isbto/QUwInM48+8tkZB9T
- TLSH T1CD552309358A09F7EA899330F1FB7594A43BBCE2FC6412A715D33C095E37AF2641479A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 b11ef73556eaad7101be2ee2126c55ada158474541f914bf84d4ed6591d02352
- MD5 93248e06f473ad0da60252613cd0077a
- SHA1 8f49eadc4a2931eebffb2bf4569e7d13db994704
- SHA512 bc35e5214cf31c867acce20d42eb2c5b4527e274a18cdb8c8cd42d8cfcabda5ad1a2b3bf56aa94733b4f17894bcc468d4c6ce874790b5d586966a966d92930bd
- SSDEEP 12288:mepzFkU8isg+LBZ7SOsMDIvwKxCG6iAeMrJeyAwp+8tkZB9p9/:me/0isbto/QUwInM48+8tkZB9T
- TLSH T1B4552309358909F7EA999330F1FA7594E43BBCE2FC6412A711D33C096E37AF2641479A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 282adf7a3ba95b295deb7f67d189efcae1d1e8077a1a4d5aaa6cca0c1af7004f
- MD5 67452d735400ff8327a3cd393d35e7e8
- SHA1 294bf9393ee8d3fc34852e821f295ef218a55bff
- SHA512 3c5ed8d7245d4a7ceff0abe3255c61ce3aa27d557f16bfad17e68e79672d710038df3796c1b3094a77d025fe8cd554badcdd8690dbb4300cd54f1bd0410ec487
- SSDEEP 12288:OypzFkU8isg+LBZ7SOsMDIvwKxCG6iAeMrJeyAwp+8tkZB9p9/:Oy/0isbto/QUwInM48+8tkZB9T
- TLSH T1BB552309358909F7EA999330F1FA7594E43BBCE2FC6412A725D33C096E379F2641079A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 178da381dd8fbd3fb73376f9ac5ff22cccb10512afbdc5dad0f8fcb8d2165a71
- MD5 b01506f3bb654a48fee0af9496ee77b9
- SHA1 6ba7f62c572e5763c619f5628658fc138e7da9fb
- SHA512 5bab8000faafc39fb9cb3233c7dcf70b54e2acf175bd3cd567f17cf88a9cec98196885e18bd13a863de3d69e773eadc73808661b09bd9f94ebb5476142c265f4
- SSDEEP 24576:3ZM4zFVSOK/0isbto/QUwInM48+8tkZB9T:3ZM4zfu/IVEMy8ts9
- TLSH T1AA75015573900CF9ECA7823AC9669905D6B3BC665A70C65F03E43A1B1F333A11C3DB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 70c7666e4b48ec9dfb0d8e5054d3258521dfbc456339bd5ac694068b23aea51a
- MD5 7866a495d492f113dae29de58313e4dd
- SHA1 4273becbc60b2e3f84b469b8728b21711cf5b76e
- SHA512 88e2d8f2073bd993e7b0e20c3397ddeb5be459c745838f9610f3a20a42948547a0efff6596c2f6f4bff2235399bcc7b3a4fed34fa17e4333a5e17a216e39c582
- SSDEEP 12288:sPpzFkU8isg+LBZ7SOsMDIvwKxCG6iAeMrJeyAwp+8tkZB9p9/:sP/0isbto/QUwInM48+8tkZB9T
- TLSH T108552309358A09F7EA995330F1FA7594E43BBCE2FC6412A715C33C096E37AF2641479A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 37a8b8e72faeaa4ab359297c49d3f426ca8f818971bc0ce20b5fe01bbf228c37
- MD5 610dc653fa60bf145ddfde353bdfdf65
- SHA1 01e78a95087b42d3443a40894898bef9aece05d3
- SHA512 be6373f53bacaf8825f1fdf93c9bdeb1ccbbe2d5557f4bbe46673932cf89f981a6c1efc8eccb56ecdab200ecd7abedecf6523c33028ff81fde227234e4b51162
- SSDEEP 12288:1bpzFkU8isg+LBZ7SOsMDIvwKxCG6iAeMrJeyAwp+8tkZB9p9/:1b/0isbto/QUwInM48+8tkZB9T
- TLSH T19B552309358909F7EA895330F2FA7594E43BBCE2FC6412A715C33C096E379F2641479A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 aacf456ad48b7d6a288f3bcb27839bd0fe559de0c59e49f313d62513da948a1c
- MD5 1d9bf6a94f510a54c3e34e61ad655936
- SHA1 acbb37540bc7d602f6257414fbdeabc14a9eb357
- SHA512 f5fa29ca8b0d75ffae65b12cf5dbce3039337b3f4a9ef3bcab20eecb1842e8ff4d245bbe8e5b69323f4240ae04f6eda7831755a3771a9bb09fbb830c16cf643c
- SSDEEP 12288:QyPz5L82pzFkU8isg+LBZ7SOsMDIvwKxCG6iAeMrJeyAwp+8tkZB9p9/:hzy2/0isbto/QUwInM48+8tkZB9T
- TLSH T1C3650207339520FAD5769234C5A21A01F777BC725B304BAF13A01A7A2F376E19D3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 2.3MB
- SHA256 b40b3134c2527cea64d6d9f6b116d68699e241c13b44df56ace61d6d801ac574
- MD5 8b985abf13891f345c1bdd61c83774c2
- SHA1 aeda8e3d286dab664dff15cb33e3fc6cc09cbaa9
- SHA512 a713d9548c5b0a4458c83297f55074346c0ec060c687df31d8f004f049a7943dba6c4de5994769e16cba868043ea5ccfd652d63390f21e88c10efa89b191ff46
- SSDEEP 24576:5Owv6k9RX6wkyAIr/0isbto/QUwInM48+8tkZB9T7Y0n0Jq+hM1iGI75Vn7TbtkU:CMnYIr/IVEMy8ts9/Y00s1iFvLtkmy
- TLSH T1B4B5F129EBDC04E1E1B7923C99B7460AF6B278695B31C2CF0296536E0E37ED05D39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 4.1MB
- SHA256 fa66f6e8b2fd09b9a3cee6b7133cd40bce6a255e9c3806006e01544fce2a1ae9
- MD5 634da6fce3f7b306824ff25c5fbe9803
- SHA1 ee8b1df5cd45c2f5dd733898dd07895c981ad308
- SHA512 76f8c94794c22a7ac48dd3af7117c1cc9101ead4f5d28b6e6538d20630bb02b0f7ed4a01fac61476b9e21b311b6ce85aa95fde5f73093fd259a1e794950ad85f
- SSDEEP 49152:CY/6Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0U/IVEMy8ts9pT:WySzPM/IrsBr8+/
- TLSH T181168D56A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF0AE3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 2.0MB
- SHA256 67889f1d47f371d68b0d7833af9e859e415ee93252e0150fe3f36640ad0b62c7
- MD5 41991ca2ce6ff9c00c2ff7dc168bae1c
- SHA1 ac088a17bd17f0d3928120afa999bc397bf8603b
- SHA512 e630c73f593e5c9afdb860205ee846c2c831c86ac01153c3e272bf49766b450749dfa4c66750810347d342bb9ca06b41df227b7df8d578849bab2d213409580f
- SSDEEP 49152:FK7JUQjAirIhCnDHUPfF/k/IVEMy8ts9MKwv3GWZo:4JiglD0PC/Irsu3Gb
- TLSH T109A5DF1DA3DC01E5E1BAD23885554A5AEA71782E1F31C6CF22B0837D6F23ED45E35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.9MB
- SHA256 f8a6b5a714cc9126889824784d20b6fc0585c4746cfb1beff2258a2afa7fe1c2
- MD5 4772be9ae31f5be047cb64d48505af71
- SHA1 8fc318b99e55f5a74df943a4909223b6a6e9514d
- SHA512 5f3401ab55714c364b3aac002af358a8be6982b06c30e46dff9c7c7c73826c8f52cd95952abcea9dfbb84148acdcdbfc1051bd09ec8268c34daaa259cd2c4eb2
- SSDEEP 24576:B//0isbto/QUwInM48+8tkZB9ThY0n0Jq+hM1iGI75Vn7Tbtkmywj:t/IVEMy8ts9NY00s1iFvLtkmy
- TLSH T14A951209D28802E5D45E6239D7A65A04B7377CB68BF4A3CA16D1F93E1F362E05CE9703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 d05c2c04c84b21ae885a3ba07b6e239aacab1bbf09bf2061a2b8b8371ac78030
- MD5 42385b4eb625aa02dba7a7a70e6d2f17
- SHA1 90499723d96f50c906f67a34836f5e71509b0070
- SHA512 f5c165e0063d480577f0981e65228d117da524544c684b156997bdd225c4b76dfe4ba8b777ebd23c7f27a9986199e3248a694011f3fcc678f453025b54e8a11c
- SSDEEP 12288:/s89U3fXgyp+LUogcIR+kufMY715j4z7c1tvJ:/sUUPjkq5R+kufMY558zY1tB
- TLSH T14E3527007626C74FC6AD40325E33D6CCAB707D42EE45AB0772C9973FD576658BAB2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.3MB
- SHA256 923b3e294f856374ba2383094f24e7d5f6d838204539053df46ae90214a2a1ac
- MD5 e00fef61b542c0c3a955a4594f7a4253
- SHA1 0a729435781cc5be839c860bc8d2f9866fa64619
- SHA512 64bf07462d52cf3395fdf3bbfa5f0f50b2ae872af71e2732ba1272ca53c1855e0988a4d699a0ace6662f3e10b0588f654830aab083c94d6a8315d8aab608d7d0
- SSDEEP 6144:to15KTHPMrcEq1+0ijHG4aoSQtMxXSQtMxb1Vax96+gB4:b+0Wao
- TLSH T11355D8405537E28FD2F620B2076A5F4D7B64EC07B749AF26B38C453AD86BB1560B93C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{BE6232F2-B875-4CA7-98AD-A2AFB8BD2C59}\resources.1.0.0.41s
- Size 1.6MB
- SHA256 d787a6a7028d1b47083798511571305ecaf86113dbae56330e3cc8dae9e2be81
- MD5 0f021e6d1a1ac7eb7d12869cd0980bd5
- SHA1 773620b4bcb40f45366913f69906354a1832b4bc
- SHA512 2ce57752299c62b75abc36b10daf7875dbe2e9b04272b724245f3670ad66fea2abe5ef81714522ae5af654218452ace48e27546e2f938785914ba3e73e844b6e
- SSDEEP 49152:StgHpuFwTi6Mflt0dBISxkVTesxcwlqP8rA1D:6I0F2gltSSjpx0D
- TLSH T18785338C21BBAF67874954E164426ED8BB722518119A50E63F232A33E7F7DCA1144F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 a2e2d010bf0d7aa21057892a73b425f37aa4b09791df5eb33db04b2c5d792bbb
- MD5 bf1cbafd99b4724ef44c7d58884eef6a
- SHA1 5196f14fba0b548f22c8b59aa3fa3ce9d2cc547f
- SHA512 cca038cba32a116e4cf569c3bccee97bfd13cd1ad90eca6920611ff4dff3a1ef5a8b3c85be43d1fa71153b18d5959a75b0dde040e13ded4895575dc2f418de06
- SSDEEP 12288:y67HpzFkU8isg+LBZ7SOsMDIvwKxCG6iAeMrJeyAwp+8tkZB9p9/:FH/0isbto/QUwInM48+8tkZB9T
- TLSH T1C155231526890DE7FDA96330E1FAA124B42FBDB1EF2412D765823D096D369E1AC7070B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 67487ceeed03383eb8cfdb8edb2314683f1fa4698ca454e3e211e1dc739d9d41
- MD5 fc71ce0c74a24d2734c41f9005adee09
- SHA1 1fed95b44f0a1b905046a983d20840b71d3052bc
- SHA512 5eb2f738611818ebb1f1f3d23d7ef8db29499bfcd747a51b8b9856f1ac8db17a38c4da382c4e46cb1de464c58a011c21caaef12d94ad0d59ad8f09acb571e162
- SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYl/0isbto/QUwInM48+8tkZB9T:Ygb4mBIBhGFa/IVEMy8ts9
- TLSH T11365AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 2.0MB
- SHA256 d9be461e39b46e6a26c3b61ab0c0fc88ed2e0ffd7c776b8ee7ff2532a761f566
- MD5 16192cf7191e996c9bf2fb88f1e31455
- SHA1 e2fc59dfcafd8687695d748b92688d5058dbc549
- SHA512 5d18f9b8e8a34f6f5b1d7b7291e5d8e0677e55a724bb389f3521f8675d16f434ce7731e39b5c86fdf5399f6ffbcdc0913149b83ae1042349db93d75fc32ffcfc
- SSDEEP 49152:ygb4mBIBhGFa/IVEMy8ts9WY00s1iFvLtkmy:yt9/Irskr8+/
- TLSH T15EA5CF1E22EC02F5E0F9E2B8DDAA4417D6B278164731D2CF1251426D2F3BEE49D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 660KB
- SHA256 26c494d784ef61fdadb444bee37cf793eee4eeded304a89f07003465e93008f4
- MD5 eb4c4fff44edaa07b78981d3b0e226ae
- SHA1 d37e4142775206bf73d44f4d297bcf2350654446
- SHA512 0ba01cbcd50cabbd6ffe8c8fa6904fc9b54a506be88868deb894e5f5a92c1a9cb187a3e797681473d09938b76b88ef572951b97babf7b4897e8d40ba89eed3e7
- SSDEEP 12288:vNGDY0n0qYLOIjvJM1iGIlCa5gpUn7Tbt/ADgqDap77FcbfOg8tEHW:VGDY0n0Jq+hM1iGI75Vn7Tbtkmywj
- TLSH T1CEE4222C61F83090D439A33E68755919797A78F58F2C72CF0DE2B2BB5F412E06A39E15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 624KB
- SHA256 423f998e8e9b2d15fc181f5b59cd7021f6f689490f2c3b869a78d57155cfb583
- MD5 a2417b41fc74b47495ebecf42f4964a8
- SHA1 fb344709fb9a8b2a1b83a13d719bef0ed587e03a
- SHA512 2a2124c36d4baeefb0c0385ff938631d4aadc6740008f974e16200245a15e1be834a24c3697babaea7ae7fb448c08c972bb8817aecda410d205a4c322cedd206
- SSDEEP 12288:GbY0n0qYLOIjvJM1iGIlCa5gpUn7Tbt/ADgqDap77FcbfOg8tEHW:GbY0n0Jq+hM1iGI75Vn7Tbtkmywj
- TLSH T10FD4231C91EC1580F544B73E38B6590C3D4EB8FA8FBD72C71EE2329B1E852D15939625
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 2e460522b5aa6dc54c562c7623a56514583027254abb628ad4d6f97f6f26a2b0
- MD5 769f65fde6ecb99bdf1ff246752ae621
- SHA1 c83edd41d1e04bc822de737bdcd675714b6532de
- SHA512 6c3de5ddf8a0f34b19f6212af0e4278a71049786b5d4373b31f9e93cd823926c0a295b74fe2f692be3be9fa65daf82df95b2e36e42fa1583ff17ab1e02856acf
- SSDEEP 24576:QG88u8FpJqH1Ozria7/mK/0isbto/QUwInM48+8tkZB9T:D7ZFPqVJa7/t/IVEMy8ts9
- TLSH T12B85F12576E101F1D47BD138CA964663F6B2B8211364EBDF07A88B451F33AE14B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 e4a5e8bcd9e29b8567a01ce59c3867aeca46dc592e9834d364a26d3468e0efd0
- MD5 edebef8c7fcb4c591754b174e3c7dcfd
- SHA1 d6df73c9753eef2866ce9a7ebbac1feb9d1c67a5
- SHA512 ba32f0fdd6b26e6ff1462ec16f2e310f22475c724c073d3ecc61ac49f64a25747d9b15bd327978eb6cab724228e040f0867555c693d81ffc2a1e86b7fb7dd6fc
- SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2Y00s1iFvLtkmy:XG05lO43b7r8+/
- TLSH T108D5CF6E62EC11F4D1BBD17CD9C64A0BEBB23825033556CB02A486A91F27FF4597E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 5b7f3c4f651d3206b9385692621c61fbe5b177e4046f7b69e78ee63144dcd386
- MD5 68fd5985ac0c134af156155821776f7e
- SHA1 8b37fab231c90bb3be0c3f4a4d3e540c2f317171
- SHA512 91cb9f8775c26e80de10b079f8c7d56c621ef103dd1256e4bb272100f0c6ba3663bc0f5ab8738a3aa69a762ea5bdaa7ca89e8f53effeaa71b0342e3124e58e1e
- SSDEEP 24576:tfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnU/0isbto/QUwInM48+8tkZB9T:da5POZ3lJt2pasx2+mW/IVEMy8ts9
- TLSH T11165AF5EA6EC01D5D5B9D17DC583861AF5B2342253319BCB022182BE3F37EE89D39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 6aaa190a9ec33b8a92c078b426f53b43ebfd3b3f40ec04fbe78cd70d89b71bc4
- MD5 14f52eb6cccb48cea8d497d5f67a43a2
- SHA1 e07335e3d5d0d17bc9a86a28f2bd458eb1502535
- SHA512 9201003f92f69f33b49a4a48264171f34c02ab614eb4e977094794fca4d88cec5649d439536fb5d7fe7b6ef5fc979c77041967599c07ac5b130c7b9416b5d0e3
- SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7Fki/0isbto/QUwInM48+8tkZB9T:5Nc/zEOVHFN/IVEMy8ts9
- TLSH T170858B1622E901E4F1BBE1BE89779546FA71786553308ACF0291851F1E73BF46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 2.3MB
- SHA256 18c55d504d8da6a70b9a5e737a58d9b7c1d3509e30fa86e7bf6a49fa58c59825
- MD5 a664d3444c8e8ef9e349f72872c38a62
- SHA1 6664ceaa1018cfb91267609cb059cea8fbcd9ea0
- SHA512 707fb8366a154b1be75cc538420480664f3630f90b2ff506851217d49ae3bd11d27eaa01a48cd0f720cdaf4cf56e4fb6a111f00f61f7ae74312ae48ffa1b33c1
- SSDEEP 49152:5Nc/zEOVHFN/IVEMy8ts9kY00s1iFvLtkmy:MIAH/Irsmr8+/
- TLSH T175B5BD1A22E801E4F1BBE1BE89779546FA717865573486CF0292811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 932KB
- SHA256 82294ad4e383e1b9094f9e8d9c014d04aaaaad682cf0cfc5b3cf6feadb3ff6bc
- MD5 2b321db079a05ba483729fee2dcaa0f6
- SHA1 9205d7b0ca8fbad0d2411533d47eca63c8210b76
- SHA512 4b359a60071061245706d9a814f161ae652bb6b720be95a71e88e8a9f9d73b2502d1c06991101a52e56ec7952db7a04f23e5069371fcbf6de9c27788f143ea82
- SSDEEP 24576:1JnJPbzB4S9Y0n0Jq+hM1iGI75Vn7Tbtkmywj:1JnJv6S9Y00s1iFvLtkmy
- TLSH T1E615D03DD2A810E4E4B7D2B8815A1A59FE31387D2F2669C719B4D5353F02FE0A939F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 6a85849b16539bb88c231272466f4de218c613858ff4698d4bafe4dd78af7492
- MD5 135ccab7d1b58d4cbf243d2b52d121fe
- SHA1 fa63d56960a9fdad4b968f4873e93c3debf65c0a
- SHA512 c05565f90012db311598d59fba7157680b075ea8d083ae6ec67fe4fdc02a971654d319cadd1950d868ac7e3e85e64e8ea17b8d2b7523b7f2b12506e312ad99b4
- SSDEEP 49152:XCLHGeeV5ijCmlDWDkxY00s1iFvLtkmy:Sdr8+/
- TLSH T186A56B05A7EB4184F8F3CAF5CA2694169A327C549B34F7DF4E80CA6A1E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 776KB
- SHA256 d24919d06a2aca2ec4bf1b61a083a3e5223782bf817df6439c0cfab13ab6fa82
- MD5 e8558437475849f61ad1d38317d35ba0
- SHA1 b14cfc28d7ba91b661f7aaf2a22ae8bd643fe402
- SHA512 e6cbd67b06a0adb5c7907413ef63b6277066604d1e0667a6f89d74bce93674ac94e935feeeb9ef500c55773750f4b6c455652fbfba9691d507f1dc57c62031ea
- SSDEEP 12288:YkHck6j5ZI7zY0n0qYLOIjvJM1iGIlCa5gpUn7Tbt/ADgqDap77FcbfOg8tEHW:x6DIXY0n0Jq+hM1iGI75Vn7Tbtkmywj
- TLSH T1A4F4011C23BA10F1E067E03E95930505E6B2B4B58B6666CF0BD491BE5F93ED8B93CE41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 760KB
- SHA256 e55b701a730f30a964ef359f39b2dfdd4bef3c08daaa706b9d0d0afb49989bc2
- MD5 e4ea15249214be46fd4150637b16ca25
- SHA1 5899131ba3985132e2070c84c7c59b49059b8454
- SHA512 5cfcbe5070a7dd96e3fb00929c606b648c3e76b9fcc1f08e231664e017e587e46d19d7245e0cc1d7e27dab9e841d75adf15151b768e92d0878340594d054aa92
- SSDEEP 12288:7G6kyOY0n0qYLOIjvJM1iGIlCa5gpUn7Tbt/ADgqDap77FcbfOg8tEHW:6tyOY0n0Jq+hM1iGI75Vn7Tbtkmywj
- TLSH T101F4120853E82090F5A9623D69734158AE39BC758F6562CF1AE1B33F2F327D0AD35B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 632KB
- SHA256 ebe529a7c077de0e30cccacb1a71c3aca489d9959a3f7b39e8046c5a70e4a33e
- MD5 87a69ae4e072ad2ea92e641efe9869c3
- SHA1 2a488649474a23f958103fb58747b3f289434ccd
- SHA512 530a6adc71e8566b91ce591cf171b8381307c1abc43776630aa3ff385a5e1472180d34298102a8596571d35da669467523e43bb1a9aecd2111347c90fbb2ff04
- SSDEEP 12288:CyNY0n0qYLOIjvJM1iGIlCa5gpUn7Tbt/ADgqDap77FcbfOg8tEHW:rNY0n0Jq+hM1iGI75Vn7Tbtkmywj
- TLSH T1C9D4231C91BC2180E444B73E387A5A0C796EB8FA8F7E71CB1DE272BB1E452D14939E15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 3e9085c93f54a74daf6b29238bdc8316675faca57e80127b171fae6b347d5589
- MD5 df33e8d1668830b541c328647a4ea2e4
- SHA1 f8dbf1b308067e4ac225a1979d1b35342bda4d7d
- SHA512 0969cb80bd15ad240e60f28665a48dad9d35a8f11c4a4ff00f989c4df8d6ac7df901b5c540f3ed2fe82371698ae7a0be58b71bff9eb230df93eeb136658dee84
- SSDEEP 24576:fugqJoTfaidZWY0n0Jq+hM1iGI75Vn7Tbtkmywj:2gnTrZWY00s1iFvLtkmy
- TLSH T18B559D1D67EA05CAE2B2D639D8721493D633B4315772D6CF2448C03A4DABED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 792KB
- SHA256 b0427d4018533c1858f396cc73377dc92189cd158af2121e2626e0dff5f92baa
- MD5 616fc11c06f81670123210b24c7253f3
- SHA1 c6521ca143eabbe4e0b69df4ca934c41b3a75d56
- SHA512 2093ee35df6140385cf50c699959f301c7f6adadc2dc51e1a419be7288f9bb14a58e4890aa679cfe388594869c61dce4d0ada8aebd1f20bf6aa2dec5073fb1a9
- SSDEEP 12288:tpJcm8CNAowlXjwhF4UmEPGY2gpUC0wLq9Fh8nNvGILCNmrXZCe+hVO8T9:trcmRZKwv43EvpsWOMN+VYghVO8T
- TLSH T19205F05EB2AE00B5E1B7D27C8D864656F6B33070135263DF52A1C7BA0E13AE87D35B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 b6871d893fc57838f18ffe02f2c468f06e92f571b902f63773314e238a891648
- MD5 f3236310fa108b6ea958f859d249377b
- SHA1 f84716aba3d67c6f4621d7e54c7719ba38ff6caf
- SHA512 d1893d49166fcf97c793816c47d4667cdc6e4c23a33b2146f4782f19ae4057703c35cea65469743be3f272875be1dc6479d30dbcd911b469f55941c5fc80092d
- SSDEEP 49152:EDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3mY00s1iFvLtkmy:h3Upow8sBvr8+/
- TLSH T1C3A58C3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0174C178BF1BEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 709efcc13e23cbd97863933f19dba814a7468fde4669d116372e7490f8d12041
- MD5 6e034412f6f7ff0e99c9ada05022de62
- SHA1 908e0fc2449485ed773eddc1f9514742130bdffd
- SHA512 06684cb5d80d2d55eb88c603e2189bf3092267b250092c28745b64c5f77ed7aa83b826b178e57cc14c1791315a1da2f7c33458afd59998103422b9214b2e064d
- SSDEEP 24576:zTkNvNnaFeYhJNtmZBmwY0n0Jq+hM1iGI75Vn7Tbtkmywj:zTMwBtOmwY00s1iFvLtkmy
- TLSH T13E55AF2EA6F806E4E1FEC6759D238516FA727461073293CB5290C13F0E679D89D3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 156bbb35430f6c20db0baa31bfde73487f01ee4b32d05e7f37e3d229f891acc9
- MD5 64c584a4966266743b085568f3dbc8b4
- SHA1 1b71b2e1cc1efe3b6c9810a0be7321031a0c9b65
- SHA512 3e4bdc8b03212a986c5c20984e9b15e1ee46e3c974f355d2ed36fde2523661795aa7d51b8025a0f913c66ab75552f080097fdf55087252efcfebeb88f66c122a
- SSDEEP 24576:XPUr+NQu/0isbto/QUwInM48+8tkZB9T:XJQu/IVEMy8ts9
- TLSH T1AF65E11F229C1CE5E67AE17CC5968619F772B862571192CF02E1812E4F37EE8BC39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 2.2MB
- SHA256 b0cc7524eeddd9e78b7d7dc8914b108c66082a9108f0c53794b06fc6b3c9824e
- MD5 73a4605083355d1c453015c32949428a
- SHA1 19bd7c2542537828bbe3ed46af98e145de4764ff
- SHA512 c3889adefe055ef16f25ff500753764ae3dc416041b47ee5c7eac19e4f7910dbc9b04084976fd98d5a78cfb206b20128ce1ab890b15cd48487d85c75644de7e8
- SSDEEP 49152:RDVHeBIAAD/IVEMy8ts9rY00s1iFvLtkmy:b/IrsLr8+/
- TLSH T1EEB5023DE69C04E0E47AD27CD6A38905E67238B9073566CB06D191BA1F7BEE06D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Roaming\311523b314575bfe.bin
- Size 12KB
- SHA256 2295e4f44286043f88b83d13eb145ca7e2c16b1b5fb22871c0e885620761c92d
- MD5 10913e8712226b246e7d99b47ce8c9ae
- SHA1 392447cfd8266b5cf0d800a000c380d776bb2366
- SHA512 2e61d592be3cae2cd4ef6c6a8284e34918a016b227e68bd9a1699e649c229cc8b81b941cdf2dbf4ea076fe6dc7d68e8129d3eec65cdb13a6d245f0deee4f6373
- SSDEEP 384:GYRWNVIQGfQ8odZ1RDDX/11P/iHDwGJYRsKv6o:G9EQGKrX/11yBJYhv6o
- TLSH T16242B0019F5CE282042CD2C07476496966F7777AA507BB1F5901DBBE80125BC5FBA3CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 768KB
- SHA256 cae1b2ff741be13bd8dcaa512f39702769ef68b36f24e88236c2e7b32b1d2fc2
- MD5 31ef2822b37f33c062821602ffe09362
- SHA1 a423b4a23581bfea81203687fcac104538240f01
- SHA512 db2756e5635fc3237c2f0342dc3fac18cb334eebd0ccdbbe5f1fb503c0cb0415ce7187c88d8b1e83ae79440d44c19ea82c2cfc6ea47c31664fbfad4c5a26c20a
- SSDEEP 12288:/yP6b3IkxjbBzivVY0n0qYLOIjvJM1iGIlCa5gpUn7Tbt/ADgqDap77FcbfOg8tj:I6UqjpiNY0n0Jq+hM1iGI75Vn7Tbtkmd
- TLSH T1C9F4121D52E824E0F0785238A87681296579BCB60BB965CF36D5A37F4F31AD0893FF21
- MD5 SHA1 SHA512 SSDEEP TLSH