Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 06:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 1.7MB
- Sample260804-g2m4saed45
- SHA256 5e671d4129498e0ac03fbce58c99de52f0bb9d8d8e7bbc429a4ef2a63db9c8f1
- MD5 9106103ff3399d503812cb2129a4bb7c
- SHA1 3ecf6a9010a8d9f6a9a010bbd7e3f0c0f092ea06
- SHA512 6e19d05cdd64bcad118a29b935bdad95a5c1d32865325b95b6331fbea9182cb5bf071bff754eff71d9a1536734948f0abe5fd736c139cd966271ec29978c6024
- SSDEEP 49152:+NZCWOLT49XGQ6m6K2MtENyv1PiqMymJ/+hE:cwnLTiGQHDtPiqk9+
- TLSH T10B855B1667F94128F1F33B71EEB992645A77BC71AD3AC50E6280125E0DB4E90DA32733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 3688 alg.exe 1832 DiagnosticsHub.StandardCollector.Service.exe 3420 fxssvc.exe 3972 elevation_service.exe 1904 elevation_service.exe 1816 maintenanceservice.exe 1868 msdtc.exe 4304 OSE.EXE 3904 PerceptionSimulationService.exe 3248 perfhost.exe 2236 locator.exe 3880 SensorDataService.exe 4544 snmptrap.exe 4576 spectrum.exe 1708 ssh-agent.exe 2092 TieringEngineService.exe 5008 AgentService.exe 1460 vds.exe 4960 vssvc.exe 3740 wbengine.exe 60 WmiApSrv.exe 3520 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2222a10e3a3ba122.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003053fd9cd923dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e190d99cd923dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e7a239dd923dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006604a69bd923dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe 1832 DiagnosticsHub.StandardCollector.Service.exe 1832 DiagnosticsHub.StandardCollector.Service.exe 1832 DiagnosticsHub.StandardCollector.Service.exe 1832 DiagnosticsHub.StandardCollector.Service.exe 1832 DiagnosticsHub.StandardCollector.Service.exe 1832 DiagnosticsHub.StandardCollector.Service.exe 1832 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeAuditPrivilege 3420 fxssvc.exe Token: SeRestorePrivilege 2092 TieringEngineService.exe Token: SeManageVolumePrivilege 2092 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 5008 AgentService.exe Token: SeBackupPrivilege 4960 vssvc.exe Token: SeRestorePrivilege 4960 vssvc.exe Token: SeAuditPrivilege 4960 vssvc.exe Token: SeBackupPrivilege 3740 wbengine.exe Token: SeRestorePrivilege 3740 wbengine.exe Token: SeSecurityPrivilege 3740 wbengine.exe Token: 33 3520 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3520 SearchIndexer.exe Token: SeDebugPrivilege 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 1832 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1464 2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3520 wrote to memory of 4920 3520 SearchIndexer.exe 115 PID 3520 wrote to memory of 2892 3520 SearchIndexer.exe 116 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_9106103ff3399d503812cb2129a4bb7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1464
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:3688
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3408
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3972
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1904
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1816
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1868
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4304
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3904
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3248
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2236
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3880
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4544
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4576
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:2064
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5008
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1460
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3740
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:60
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4920
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:2892
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 8de6b0a138386765f06705e40fe40a05e9dc59a3a0e05458c509b0832e7cc945
- MD5 ae783cb8d6b91a8e50c4294ebc99ef1d
- SHA1 5846ef9d3d3c2bd444727dd5c03e7c8bf37b4216
- SHA512 7f29aa56375914267d90d6af4609061a3bd96ddcbc2ee6a24d84a3bfcd365b8ba7765edbc6db377e3466ce7d98bccbd6c82254a8c456fc083670a85e26db607b
- SSDEEP 49152:5b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnFv1PiqMymJ/+hE:P3q6mjBAtPiqk9+
- TLSH T1CFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 3b8d38f92bc252adb89b4a0aabfd5c7987a78ebdc081498e0610693ab9fb3171
- MD5 0c4d5e9bfad59f55c371928dde9addbe
- SHA1 ba4bb7b21154cffc16abee28007a95e90abc0ca8
- SHA512 374add87fef41dfb0973c69605336ce564aeeab95c3399b2ae4def5c25fd1f6842dc2709e9a9ca330c8f2fc26a9c9f880787be7e2143f016901ff6a00e37db2f
- SSDEEP 12288:81XLsswWkxy2lRq2czA4rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzIT:KXYfDtczAhBMvjRA+iqMIjmJ8c+hE
- TLSH T11F65013963E409F9ED67823CCCA28512E773B8554760E78B03A4996A1F333D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 1065b29c76e8f50131828368c97c802627ccd9d1a54104c64531cd803bdf5281
- MD5 275d7241fb9bf586d1e86c9a8338609b
- SHA1 a27d675fee95243b67dd9e30e73087288085dd5e
- SHA512 06371876fe53f99c5775faf020c56d88a506f26a792cbdfc151ca7ebc1d5ae40c375f09d8fee7a96957cd27db116b6fa8a09133c272e7ea741dd076270f78924
- SSDEEP 24576:r0Le5ji0hmxhrMGBMvjRA+iqMIjmJ8c+hE:rPji0AzOv1PiqMymJ/+hE
- TLSH T17A85AE26F5748731D073C0B9C5D2A68AE972308657308ACB4286D77C7F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 a3d01f1b5b1ce9990164f656508f6ebe27443166dd7a566ae05aa954b70b56dc
- MD5 9474769426cc44bd9076c758717fa616
- SHA1 35002e59d30167af61ea070beddb766f8f006fed
- SHA512 24946f0e681e9af60dd2c5eb8751c47708258da6d1377c5e7374da2dff937d35e231112747086263f34cf7f18efe0252da343753d452cc041a363922fc0c4ef0
- SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWj6q8wyuUBMvjRA+iqMIjmJ8c+hE:F/ezSC6vUzPv+Hjyyv1PiqMymJ/+hE
- TLSH T1E7755D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 efa27765f70c18bcf517c868c46aa8ff1d2b4d5f31b74a77e861b4a48aa84bef
- MD5 a518afbddcd7a826539b57211f267c76
- SHA1 c22236f8931ce309e6a8e3fa248e96b0db0d21a8
- SHA512 7bacc09c8a60ced37d33da3be58eb13abcf15896ee7be15d23529888725c0b29a1ecad3cd7fdb99bab65042da7bda8200463f676e307a0ee3ce5684ed8008355
- SSDEEP 24576:fVbqPb88hv/l+BdBMvjRA+iqMIjmJ8c+hE:fVO88hXl+uv1PiqMymJ/+hE
- TLSH T18D559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 74fae30de06ffb1ac455185e9982736d29bfa5b17415c1075e21384a2540d4c4
- MD5 a727bd6d813a7ceacce3fefdc7a40b12
- SHA1 d76b827b0bea94d502059cdb7a3fd5ce0d682eb4
- SHA512 d9e36b140c2ff81833a28cd7cad5ad2e5593c5fbf6c22aedb60372479cb26c19a9c854079b362a485375321977cf66508618fae47889b725d636e9b451c33bc4
- SSDEEP 12288:zGDrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:zGSBMvjRA+iqMIjmJ8c+hE
- TLSH T12645233600A80A95FF733F3C6DEB67A3C245EC7DB550A203B51676DB563C1E4A88A607
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 cf2eed052f1a8925b09c3f922d335c75fb5b54d7508032c9ecbb14a2aa7c8f89
- MD5 8707b66037ef409ca09a595c2c338205
- SHA1 29598226dba8f926e78be946aa2b695edcd47007
- SHA512 477fd6e5155236547a9a2bf0254a7f0bdbc9a2858af24b8414d5a80260c2978afc0c80d3c47448e62849cc0b741862bb467ed0966b896dc1715f2559b442ec5b
- SSDEEP 12288:NeBNUbTVO86U8rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:NJIUFBMvjRA+iqMIjmJ8c+hE
- TLSH T1D965DF3BAE28FCD2C67A5D785A918700D77278304B62A3CBE175834EDE235E05D7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 b9fcae62cd274ee39b2da4f481c47babe7fdb70314029248bcafae4336e1caa0
- MD5 c6059fcbe91a72ef8990dd13cbf1590b
- SHA1 feed84800bf78e7f593babf745de790ff8e1dbd4
- SHA512 94377b205679a09dc6382f3eb153c60aec59db61713bdd8ae65c79adc62fbbba3e443c371418f0c34c673aa784483c37a98f7642e4ed80c89acdf5b676f9db75
- SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THD:gQvGAdlCEL8c/WRNw5CjtPiqk9+
- TLSH T135266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 27325a8bbd374d90844a24e37520146d066dffe8409577fe7bc2d495b9f397c6
- MD5 67b1d82e902b01324fbdfa824f91e25f
- SHA1 463745af70d6bf800ac6070708096850f16396c5
- SHA512 d74ac91df21c96871755a5bbb3de6fbdf8be06ca4df9a4a7b58b3078292cdacaf8aea4f5d57054d8bf6c9c2b1524df48b8e48cd924dea5425f06cdad5e355760
- SSDEEP 12288:VAwSfxL/2Dc3mDLLmt0LDQewsAj6rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2FuQ:2fewsAjjBMvjRA+iqMIjmJ8c+hE
- TLSH T1D575F031FA74D432C7BB0DB61B36C716542CB9204B612AC3F3A89E9E59342D22776E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 2de8b751a797a90ed0180f818d1390f407409e54ec1af7eb26f7c33facaaf95a
- MD5 a0693f9d66341ef3e4ee7a0fe29d228c
- SHA1 ab250685b40cc873f849c9b39e06fcd917cb3688
- SHA512 bf037b92109cc66227ab06c34f63be006b51cbef3233e821bd8b71acc5e010619618d90a2381f886885692f24db933185d1c6972a724967c7019d1f5346cf5e3
- SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHmaT9+:/UEtQevvqc2W1cpV20I32maM
- TLSH T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 dc7fa9bb9bdf86d71df3d4a3d25fa5aff4642f63a0d846e6add1ce3331d8cef1
- MD5 5b9396bd9699918e1f0b3396a0b12146
- SHA1 9276fe8712a13726f0773aa05580e9fa32854b0e
- SHA512 c79802116b55e315bb6e49db793b47954ac5143925bc8eb10b3caedfa038ed554876c79ef2b905b381d109d35db6dc79d36c5bf2dafbada358dc38539c7c302f
- SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zev1PiqMymJ/+hE:UoqtVjnm3tPiqk9+
- TLSH T11AD58E1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 d5cae9aad06828a7760db06d559b57dffc092682d063f70c590e6dfc2becc3c4
- MD5 16a7ad0853c700ff3694bfbfd3516d83
- SHA1 fac7752477e60648ad0227f58df9aa3e84640783
- SHA512 f3105fde611dc164cc32f6b664209812416b88e5423ffa717fce70f6665ce0391b0413ff82ce8bb67d70a91cad0ac76b327d5cd823e072ce5e52865ba6da2bfd
- SSDEEP 24576:qAhGL6IFoiwtA5l7S534BMvjRA+iqMIjmJ8c+hE:qAM5Foiq5nv1PiqMymJ/+hE
- TLSH T1CC35AD81E7F945D4F5B3AA7899B68171EA76BCAA5E31C20F2160D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 5e902d2322247072cf35a47788d797c9c00e3717c0491900193d436d8c8a2838
- MD5 f7576e34fda5339f6d20d2a5253f88ac
- SHA1 a2d2ffa6baa02f44edfba3524a78ac3e4b9c3638
- SHA512 7d0bdc4d2f2f2187458a9b412005f61437748ede25442d2ecd25f6a6428507203ce6136409ddc8b1fba73b154dbcdc2c9b20ddd3b9b6fc27d72b81396b972658
- SSDEEP 12288:Amw5HEjsChNEBFgl0WDm+CtrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:dwuROWnBMvjRA+iqMIjmJ8c+hE
- TLSH T15165F11A32A80CF9E96356388597C236E7F2BC163A21D71F1760C65B5F37361AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 e08567f1f781cbf561382d03e3ec56cb68b1a93550f294c9f7096b17e7fad0af
- MD5 91f6e7e8adf298b1bd7b45786aea01b2
- SHA1 37f21a4ec21d63881232164f841da80dcf6fbd36
- SHA512 3dabea7a2cf03a99ee12209d060507d8d5c3c21ca64f34e8505655a99bf1f28a0a08c4eb476ded5615d67560d0cf7054a44c6917f3783b606a16698604c9f13c
- SSDEEP 12288:1yZ1IyqrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:sZuOBMvjRA+iqMIjmJ8c+hE
- TLSH T1F655122A22E811F5E673173CDDE65742C362B86A733183CF262552AB1F37AD11D39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 c90e58ecca43e85c2f441f19f29b91c4345c43401a521c2c90c85688b60432bc
- MD5 d6ab3489531ef415f1ad85409114f76a
- SHA1 673e7524c5f4084a8d85b314da576c354adac2fd
- SHA512 418fcef85bb6719350fa297751080c597d217b911486dade0d3af9d1775f04ffa1099459c498383de2750e1d1ef34cb950d7e199d5a990819d1b33c50d635d4a
- SSDEEP 98304:vQRQyi36YOcPDLvw2gAf+PN38tPiqk9+:eQyiKanX+PNIaT9+
- TLSH T127667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 f79abc75aa6605b549f134d3d54c90748ffca303a51adad92f153f59a1dcc05b
- MD5 41850c638bd0d8884f40b37743fe24c6
- SHA1 a3f0aa3f13f0b3a31fea667fdee93b4c4f39d0a0
- SHA512 813a6449e60ef1eb0e1de964a457c561847dddfc55ec71015322bff7be1d46f06a608a40e904a6bc224ee9e8204e69035e379146e93825a5da5a60da209a5afd
- SSDEEP 98304:QQRQyi36YOcPDLvw2gAf+PN38tPiqk9+:HQyiKanX+PNIaT9+
- TLSH T13B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 739ff6a6c57c5f521e32769dd2f5dfa393991bdf8e18aa1409d8b04839751235
- MD5 3bce04e593c4fd671454553f28033dbd
- SHA1 7f2d86a2eba26d617e24b112e1895885182e9cd4
- SHA512 0388fe4f390ba578bdfa612d4ace23be2b013304e5495e406dd82fa7d008c09b6b8d80e5368fcfcaa8266ddbbe2142ba46db6212815dd1974fe43098d65488e9
- SSDEEP 49152:Y68Qg55nhkeWu7PNU3/Ov1PiqMymJ/+hE:ithTRc/OtPiqk9+
- TLSH T182B55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 66a6067dca25dc42548113330a5b96b72b04eb4c400500eccefd1148d64ad443
- MD5 d179c3010084facf0ac252eebc83f9c9
- SHA1 6271e359e65cf5287d58ba862918a803c9bb23b8
- SHA512 8e652d67083c12b6254403f679d262ab9f05d970b3bf68930591879c9ee63cf976d6626c1d9b3f1dde4e4d2988b75837e52c09086ab24d364b38f0d685593405
- SSDEEP 98304:Yy5112gYy5azzVvU69nLKnhZZtPiqk9+:xLIHRWhlaT9+
- TLSH T122167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 ab68c21aa45d470fc34a9fd1f409fdb48f2380f8f76cd8822a14fb1223ecbd55
- MD5 da5ca0076b86899d0eb77e42d59ca587
- SHA1 6c6f3f8d897f08abccc001f407f379e15c5ebf55
- SHA512 da67a0afd03e7d08e201ded4e1f083c612bf9248b6a783127f6277ebf004b6fdbe2dd1e49789c9946508eaac11c1d3b517363ce36b1b71049015af311237079d
- SSDEEP 49152:VB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl0v1PiqMymJ/+hE:bu6JmIxd2d0tPiqk9+
- TLSH T17FD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 ced3810b7195d75ad6d612e8f3d364d9237a3c1022adc55b13cdc9116f66262f
- MD5 85cfa0634cf1c8a3b9d26db7bb83bfc0
- SHA1 3e6a78c72d1a65e9a6d05d6f3a270d495b71a491
- SHA512 5b506e34b64512c81211925d440d5189a3f20f2259dea4fabf74ff2b564df45df4876c68c74eb3db34956181fa921c1564844c053089626c4f9cb3d8a1686232
- SSDEEP 49152:F1hpsNoJpF1A67U44CwH7R4xov1PiqMymJ/+hE:FmifPqR3tPiqk9+
- TLSH T155B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 40ee9d6c1f23d6a279408ca0c0022f62713cddcfb13f832bb165453a5685e008
- MD5 16b5b85cc0361a6f3f4b4341f5c23bf8
- SHA1 06975b2ef47036b480b2f41ab7c15224a1651556
- SHA512 db9b4b47f7041f0f2301f97d5ab27ec7cf5567dac5f62e10162884d4b06defdaa2aea9e403d7f58724bd77e6cf1cbc8eb9dad8660b25d54709a16b70277c8e07
- SSDEEP 49152:CSuZQIY0Be2KkRVtOnks6NMHq1v1PiqMymJ/+hE:c5dKqi611tPiqk9+
- TLSH T1A1C5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 42accfd72d62e84802dac5186c37513bf0c1013d202cd31bdce4d60b76e380c1
- MD5 2561f283508114d59ab0fa6766d15d16
- SHA1 218db9b07dab51b67af1f9e1b93680d573088f3b
- SHA512 d4e1d22e17d5e9c83fc1aa9a3c1d693a383c518edf68073319afe6042141aea895b101f87d13c54fd82b2af93f21d514a8c28a9f04bc4f293c5b7c1a7afaa61e
- SSDEEP 49152:NhtSn8EApI0figjgiDn0AP5wkv1PiqMymJ/+hE:cX2iWphrtPiqk9+
- TLSH T12E95BE13F2D901E8D06AD178C7468632EA62BC160B35B6EF0A50B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 0674049e99962b265a3f397c12b1317f6603c1644a6dacdf49c1750b08119326
- MD5 66874a48720432fe1e22ba96a382b0e0
- SHA1 f38bfbbf9c74a6aa2c8f46a43d026bdf9f937843
- SHA512 0f17b0229c8530e88ea1ecc582d870e949ecd03ec23d7e20ded92f8f50c07a079cbbffbcba440a686a797ab8ec04a975448bb0e82e138d9c13a9351a9c39c3e0
- SSDEEP 12288:H7rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:HaBMvjRA+iqMIjmJ8c+hE
- TLSH T10645233A00AD0F86FF323B3C99D65393C285BC7EF651A203761A719B573D1E4284DA5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 a4b369657292154d868240341c18cae75012aaafc6d9b6775aca905a5418006c
- MD5 6d76bcb5f5087716e94b907a8b98a965
- SHA1 2030450bc036de3345762689769b4d391438813b
- SHA512 27679193b20d131b60a699db10f17c944dca805c5707d683b10a9f5d072a93f8d657aed5cb2918c0442909375ec80f342ffee781090a68961e682f3e65575317
- SSDEEP 12288:IGrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:I/BMvjRA+iqMIjmJ8c+hE
- TLSH T1B145233A00A90F86FF323B3C99D75392C244FC7EF651A207761A719B573D1E4284EA5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 ebdb290436f1a80e1776211307cb8a527c02be85743d3707a40df786544e7435
- MD5 4d667527add37bcb7a571d2f99b73283
- SHA1 a7874d5a2b80bef15bb4f98e1387ee2c40524b3a
- SHA512 77ba692e57175ea1157cc86fd3df1d84687f0de883386dd576d50af42c9ad6282973ca1f06fdf8386b746e24b45b4b986ab374d898e3ea02b81c1500fe853cb0
- SSDEEP 12288:I0rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:ItBMvjRA+iqMIjmJ8c+hE
- TLSH T13345233A00AD0F86FF323B3C99D75392C284EC7EF651A207B61A719B573D1E4284DA59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 a6aecaa18234e08a8dab9678ba28996448e706d90115ec02a63a473c92bda1d1
- MD5 cb5dd4fd95c8a6c12ff06477bbf00e39
- SHA1 4aae7fbecf0bcc3e395a0118964e92cef2a579c3
- SHA512 027c3a1ca8d1c4dcc08655a7395d58badabc5509cfb860add85b859ad5fe6883213996eda87a3dc539a3c222b9f3eb4a85084de1506cc84e3165b1af41938de2
- SSDEEP 12288:RVhrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:0BMvjRA+iqMIjmJ8c+hE
- TLSH T1F445233611A90AC5FD32AB3CD9A75352C395FC6DF732A30FB605259B0B392E02829F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 c2ecf6e32c49377a077a969ec7284112d20354571fe15bd79908a48c9517e306
- MD5 847370201146062e175ac5806cd0a183
- SHA1 e3cb446ca47ec247362a0171b861a7ca999b5bd4
- SHA512 8e51a5b697e78f0db20454849c5c9b36ab55fdbbc816d07de37a61b52ed761e511b973b263a2b8c4fd0c6c14055f903f24db1c111d5fb4ebe280bc0f02b12835
- SSDEEP 12288:kprGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:kQBMvjRA+iqMIjmJ8c+hE
- TLSH T15745233A00AD0F86FF323B3C99D75392C284AC7EF651A207B61E719B573D1E4284DA59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 b745b9e7f73f9b6c5dd57356fabde2bdc2b13a40f170e851ad1288c1fd0ffb20
- MD5 52faff8c327712b46aa4a2a8b351490f
- SHA1 dc30863e2dfd658a8c672dd5e1a7cb75651d0f6f
- SHA512 1b082411e1e96eb510c62bb0f8f0b93ae4166a5f0a3c8a4d5020d4c5899761a84252e95e1e07891599f99f4d69361c6774bd6f752de190ca50d7dbabcc6530d4
- SSDEEP 12288:cyrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:cLBMvjRA+iqMIjmJ8c+hE
- TLSH T1CA45233A00AD0F86FF323B3C99D65392C244FC7EF651A207761A719B533D1E4284DA5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 0a7f275f9a52f967dfdce4f56b2f33d77fcd0379139381e9fea85870aada9046
- MD5 78975a9eef45689c08a44a7521ffed3c
- SHA1 6e426850c6fb68ca96db95f4395f652acd3a8fc4
- SHA512 4b053b94891842409d758c14c681b251ecdcb34aa0caeaae55cbe92647b77f1bd3cd03c064c7703954a462f2ba699da5b1968b5fbec40ac05b2d1e76151efd93
- SSDEEP 12288:JurGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:J3BMvjRA+iqMIjmJ8c+hE
- TLSH T1FD45233A00A90F86FF322B3C99D657A2C244FC7EF651A207B61E71DB533D1E4284DA56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 ee3506d2d61bb7ceb1c58580f5a62def534a5db927231a294410d2c49aec541b
- MD5 5b17b933966574122d632aabd181979e
- SHA1 207c211ce14effe470aaa8b4fca82cd5c53eb4f4
- SHA512 aed5b5303041b45e96756be19c67dfec996601588637dae1289b672302841b842cb00ea66d2d36fff66b1d69bba65972d4da5e5994f67459f1bad67556c76844
- SSDEEP 12288:/iZwbDzzFEoS2cPvymrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8ti:aZM3zFVSOfBMvjRA+iqMIjmJ8c+hE
- TLSH T1FC65016573900CF8ED63423ECD558A16D2B2BC6A5770C60F13A4366B5F373A11C2EB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 58f0a6a11c059ce0912286d97d9428d5b66bef44a58a56d21a1aa8b1a6f58e54
- MD5 6d27dfef168a71f3e4940bfbe72e1c7e
- SHA1 72fed038dcd35b4fbe4fc03c35fd4186551a94b7
- SHA512 e253f6aa9843d9a774cdc96b348f6ef4794fe5d7a1ee85644099a272def885701ba3f91aadd485ecae39220f02554a5b155771447964e8b5dee6e98a8eb5d2c5
- SSDEEP 12288:1/rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:1+BMvjRA+iqMIjmJ8c+hE
- TLSH T13B45233A00AD0F86FF322B3C99D75792C284EC7EF651A203B61E719B573D1E4284DA59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 097f89cbeedf4ae6c42bc8cd76815f638cc7fabbd1640fa5e69e6054d6eedada
- MD5 0a8351543a06375ae2bd6aa5687e741b
- SHA1 578d6d0f4b5732b87df4307f6e4abdfae9c079e8
- SHA512 d291f32f51882de3df585a8db321ee1ebad8fc93b258951b47b19de22650c584748c638e51a366321902bf5d24312f6af24fb95459a6d6e4d25f44a70513d6d2
- SSDEEP 12288:OzrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:OCBMvjRA+iqMIjmJ8c+hE
- TLSH T12A45233A00A90F86FF323B3C99D65792C244FC7EF652A203761E719B533D1E4284DA5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 918293dccf0e799359c36a4248f5fd041816afd7c8bd593579e39d895c738b01
- MD5 030f30f73298cec02f5e9851aa50bb34
- SHA1 85be2e4ef47b397a4233e9a8d627a971aa14f3f8
- SHA512 0f66250b51adfa3d9e72970a20687cef4d739de04d8c2a725e32831d78ee2f7b1c08ffd1edf0a3e3e9aa22b8d58247471fca0edcff0a4e6c340fda690986399d
- SSDEEP 12288:5yPz5L8qrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:4zyTBMvjRA+iqMIjmJ8c+hE
- TLSH T16455121722A521F9E5335238CCA21B52F372B83657209A5F276457BB2F372E05D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 b23cad1187d2d7c260f81718fb5bf34c42745c75708d3d4f23bec71de7895358
- MD5 1dbf205e540ba5e1c29a25b3d7f102a6
- SHA1 977da3f636f84132d2a5868ecdef5f180514a159
- SHA512 67c3828a4eb91300527d9b79558b341eef8f85ce0d3548677d442863658a4347bc67a31546e19ba077a00cd492f3e88d598fb1c816f69b3acd1163cdccc88d76
- SSDEEP 12288:p/rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:p+BMvjRA+iqMIjmJ8c+hE
- TLSH T1C145233A00A90F86FF322B3C99D75792C284FC7EF651A203B61E719B573D1E4284DA59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 069407798ac52401f7b2becb331d3903edf4c066b3f458f9566ad174b6e86bb9
- MD5 4ea2423d07ec2f38980427164863bd92
- SHA1 c31f0c05976bb30e32a737be62d9e34b80385216
- SHA512 24336d9567fb146060e603969ecae782fe63ca9f73f54be09fa5d5f44f69587b906ffbb657f2e5f9d79d2708ec1f0f1676105b43352ce4dc5303a0ec5034c6fd
- SSDEEP 12288:R/rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:R+BMvjRA+iqMIjmJ8c+hE
- TLSH T1E945233A00A90F86FF322B3C99D757A2C244FC7EF651A203B61E719B573D1E4284DA59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 1e7ef040edfdd2fe201d22c924ed50d5cb6e505ecaab5ce5523635c3f1223b55
- MD5 43649514de904dbedd96658dc7b53150
- SHA1 4f2cfdad5c83aeebd142b8c4fbf2021cac41ac39
- SHA512 10678f0a451fd830ac61941c285ce9d36e27b277d7028c7de5815c4f60008d7b30870107af3d58bf40cb83b76c3274de0ce74239efaf6f599559de47e0413af2
- SSDEEP 12288:ryPz5L8qrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:GzyTBMvjRA+iqMIjmJ8c+hE
- TLSH T17555021722A521F9E5335238CCA21B52E372B83657209B5F276457BB2F372E05D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 7ca6b333fef05acbd4d2aa8f24fb2dafbc96d5b9f256aa2f4e9e2621f786c815
- MD5 e0af8750b4c9ead24ffc495c91c3a5f8
- SHA1 1d32ac80ae8f464aa7a980b02eed280997ba4b48
- SHA512 0f7a9458a9e48c1b555ce3c79e2b7af946190197730696a4025f1fca27d602c0acdacf46758145ba99b4e2dc801c406b19673e0c90e6bd19f167e5607fd19b68
- SSDEEP 24576:RcP4mcvIjkGOxhKP2l71nNKbrh/8KBWBMvjRA+iqMIjmJ8c+hE:GP4m4IpOO67W8Kjv1PiqMymJ/+hE
- TLSH T12D65AE2DA7DC0096D0BB913885658A4AFAB1742E2F3286CB1160933D7F77EE54E35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 9b0a62ecf2faaadeddafe11c1bf51756a185d34aa741acab4248793e6b3d0c94
- MD5 7f2bd22ca9afba16bfc84850bc171ff6
- SHA1 97b6d6e9bb7285ed5d558da22cfd3fc1a4c516b7
- SHA512 2b7a95cb3697e131d7571f96ec680761774ca48616637a377aa6d1bf0b67ebc44d440805029c04326c5fac8e0bc8d2e0bd9bafefea1507954a89406246751bf4
- SSDEEP 12288:QpsfPrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:hOBMvjRA+iqMIjmJ8c+hE
- TLSH T1C655F11AC29802D8D56E6239CB964641F3637C2993E1D3CB62D0F57E1F3A6D05DEAB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
- Size 251KB
- SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
- MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
- SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
- SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
- SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
- TLSH T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 d533a78a024f4da7eb792fd36e8f78eeb3a22df9b3aaf4b688cf8da995ea924b
- MD5 026e95f278c0f406c4777d428146b686
- SHA1 7ec7f7663fdcc5ec6a8263ae47fd952b9838b529
- SHA512 2a91ddc422a1854adaa38e4eeb9320cfca739fceeb656f7d790f82b7a32e9edab177b097620480f8d3cf008425e690728df729bdabcf0488644d02dc599d37a8
- SSDEEP 12288:WvrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:WuBMvjRA+iqMIjmJ8c+hE
- TLSH T1F045233601AC0F46FE723F3859A69372C20AB97DBB11E107B50A72DB563C5E06C59B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 e673cd5d5a1d93cc896f140e61c3bd613f926880a65a4d4efa2fe4c46784a1b6
- MD5 dfcdcdaab2ca1b111574e9cbfb996b2d
- SHA1 17f5704cacc6bbe3e936bcd644a70b1b1ec27fac
- SHA512 7df9b75c1b25178fe43aabf8c9dace170ba8741192b852c51a0dc404f559de18ef4594868c5d442a9c92636fff03009d5feeb564ff1d13a66f1beae7d8388e59
- SSDEEP 49152:qa0h2GEkuAe73q3pp46zwwQfv1PiqMymJ/+hE:qa0hNYG4JwmtPiqk9+
- TLSH T14B85AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853E3F37DE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 dbd11df25deb6ed374ee16ec65e102c5324290aa65f18d2ca5f2784de16225fc
- MD5 5a7e9265bda35c343bed34e76c788cc4
- SHA1 90110a8c922b5daf71c7fb75db54cbf15fb1560d
- SHA512 50b4bae9859e35502c0eb0fbe0c3ca333aece7a350e38093c807ac4358079958211a9bd537c36120065b3f6c2f223a41ef0f62d4a89b54453a6462a0ef31b134
- SSDEEP 12288:qhbHjfXWrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:qhbHjPPBMvjRA+iqMIjmJ8c+hE
- TLSH T10F55023E11AC15D9F572A23C95964646C371BC292721A3DF329292BF4F3BAE41C39F42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 4e3e03ea5edff94fe5bdf1db77ce0090c0b008cbdbb43aef33661008a9ea6c07
- MD5 350d4f120f5b88abcd10b167d04301b0
- SHA1 9d4cc697cdcace21d54457669352cde7dc7589bd
- SHA512 7d849edc768d8a5f660fc6e6dec9ef053f2523359e60fca64f488f6e2cfd7e54c38eb9f025dffebb1ebd5a33741d9546cbdb57d7d1f262dfcafc419fd884d781
- SSDEEP 24576:K3YgnJcRTk4yti+R5dBR/nBMvjRA+iqMIjmJ8c+hE:KIgnaTk46pBR/Sv1PiqMymJ/+hE
- TLSH T1ED45B02EF2B910B9D8A6D236450147B5FB71782D1F209ACB0170C538AF1AEE85E39F5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 fac8a9df048648b0085ee8364cc915822dd532d16b350100531918da6ca34b8f
- MD5 bcff9b1a0f7654b32e933e477abbf4be
- SHA1 56a2784a6047827087acd34068dc41fe996955a7
- SHA512 6db1735483b83a1843b0183d7477b4e94b292042de2059f8d84616aa5e4baf3e9ef5f262ed12c97534b21d28f102809951b586feeafe9f1fec3b04fdaed168fb
- SSDEEP 12288:/jrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:/yBMvjRA+iqMIjmJ8c+hE
- TLSH T1D545233A00AD0F86FE323B3C59D75762C244BD3DB722A283751A71DB533D5E52869A06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 8df43b5e3e076ec6eaab4719081f7e1b093b215ec223ae32d8499bbed4135406
- MD5 7474b4617c07a0bb2689e4070d8ed462
- SHA1 8880e3d8674f9501b6cc81a350c8d89a4a8575fd
- SHA512 2454f20db761734ed2a0248abc2c9ff56ba7a7abf724141fa63ce52200adfc5e2fcd95e087c47e611ada744143505fc4f751b46f603b8391c35af3e59d4f06e7
- SSDEEP 12288:5ObIA4LWOsvAYFT4rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:uAL3UThBMvjRA+iqMIjmJ8c+hE
- TLSH T16F750115E6A404F9ED77923CC9A28A13D272B86D1360E7DF13684B661F237E14E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 e8ec2c7e219ec8c6d9740f7ea6695c67762d4f364304390e22910c8aeeff587d
- MD5 2ea22ef7ab49f7afe2cc856cdf9f0c92
- SHA1 c76e0cdf3770b7da9453508ae125d7e57664ec68
- SHA512 7737aed11553b4860b9dca21b7586a6389ad4d98e11037bd8799f259e345cc4db57d9deb80089cbe748ce60107a4617d4839f78d161902145b7a0eb097b3d6e7
- SSDEEP 12288:7pFtvOcrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:lOlBMvjRA+iqMIjmJ8c+hE
- TLSH T1EA55022A32EC10E5E572623C8993434AD371B87A572253DF129081BF5F77AF86C3AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 8934b4d0e7b7d285df441b86ac9136510a3896b335c936236da29887c76f60ad
- MD5 15c894e8bf7f5a6c9b58c7e775811295
- SHA1 0f4e76ab242af9f89bcff0e1101a0c18436b3941
- SHA512 e91d560333c1325f4719a860db00e31a626f77803e26e79eb7c95c9479cbfb35e7d2cc8ea61cee6a086f5321588abd122b22cd7d3fe795126790baa4552ae6f2
- SSDEEP 24576:a7NM9YqZqmWMUkPjZM48Mv6bEhs+BMvjRA+iqMIjmJ8c+hE:a7cBWMpPjN8DbEhqv1PiqMymJ/+hE
- TLSH T15A659E2E6BEC81D5D577D13DC9E28206F2B2B4611B318ACB1162833E6F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 b02007ff322dbbea83d08f521f86201306bacc8318fcc069c324b80b11f6bac7
- MD5 2859f1b7265a11a524a323acadc74cc3
- SHA1 b2d46e46bc23981dbe2860709c3f8dbd31a6c99f
- SHA512 de9a75fb3a4086f4f87cf34aa235b74f61a2a89e7bc443cfb1dcc4ee9770334e246b2b18b98338d754bea25ab8a3c2bf9bd72ee666752bfaa68c9257f19c8346
- SSDEEP 49152:GF2YuHNETovAvNYf8kmFv1PiqMymJ/+hE:H6BCf8kotPiqk9+
- TLSH T1EB858E2927ED80A4E0BBD27D45B7D246FAB2B8551B3056CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 29c272547d3318a17e2afe5b1b6ec562b62e5e81e5c066ba06444862dc7ec8d0
- MD5 b0a78530b6ac143ff37ce6f7464d36ab
- SHA1 102b13db6fc810959702d66a9c9dccbb0c438d21
- SHA512 02fee122f38f59b754e7e360c04f47ff1bda14e6d87a29904ee060739653ac2f8ba4e9b4136d84c455c97d5f4a0d81f16357e08f866e739b277691aedf14a227
- SSDEEP 24576:qAFs06+Omlf8NXEbToJBMvjRA+iqMIjmJ8c+hE:zFs060loXu/v1PiqMymJ/+hE
- TLSH T12B65AF3F62AC00D5D07ED17D8997C91AF6B1746707216ACB0260867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 88b92df8fe03e5054d87c9418185a84dff86eea8a75e3af3894c316e91f02a69
- MD5 9f8cfff853dab281dae31bce35c88238
- SHA1 bedbd605dd47e1f5f9505d134d3407d1531ecc85
- SHA512 675c56535877df1301934e69719fe70ca042f942ecfbaade08e36609a4c7347dec0c540e6a565889ec64e02bc641ca4c996842128a121a1ceb8ca7f66ae2fa29
- SSDEEP 12288:yCJnJ5D3VkrDzxfrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:zJnJ5D3WXwBMvjRA+iqMIjmJ8c+hE
- TLSH T19675D03DD2A810E8E4B7D274819A1756FF72383D2B226AC72874D5353F12EE0A979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 88fe9b35a877f916537a2b557b475bd1af7037fa46dbe86e73eacdc5df91bad3
- MD5 6fae522b611b096d39842e8581b69ff9
- SHA1 cfb76f47a6a1ede623fc3fdc253e3619a753511e
- SHA512 2533265892914db4aa0f8c1e56e5d5a6fe29037120a7281f7a3ec8c6697db3d901a897a2eab0f77118ca16b9435cfe0fc30db9b90b903e753c8394adb5cf6c97
- SSDEEP 49152:Tg06DIKdwc+eQnSt65aVRv1PiqMymJ/+hE:sbtPiqk9+
- TLSH T1EC956C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 15a9325f780895d0022900d78459ea97510a8abd4340197488f0a4797c6ea9b8
- MD5 55a88d806f6eefd90a981b36c2d9f1dd
- SHA1 3a3224464858f01847b16178b7136e61098ac4e4
- SHA512 25d38e297a87d519735aea4231c7a312563e494686040f43b71b8b19ec7c6a77ea2aa4aed47a37db36fcf7bc09ee90da08ee0bb965400fac5e4875bbdadae7f9
- SSDEEP 12288:iEP3RntrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:hn0BMvjRA+iqMIjmJ8c+hE
- TLSH T16F55122E22AC20E5E532A13C95928645C3B2F075775263DF2691D27F4F3BAE52D3DB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 9b6f0d80a47ccb900582e0b2bc6ebc99bffd012e75fe43160487646b6352a912
- MD5 819ff90e13044bdf0da4604549c1d946
- SHA1 b22d34c2676334e860318dbd9cea6e1dbe08a0c4
- SHA512 c8640691410e1cea4f34e3800fc521c00a70d1d76b76dad7c6193e26fd32944f8fa1f4869ca88ed0a83932f6b49bf6948fd3f0ff66187e7105b92a1600ee65d6
- SSDEEP 12288:yjkyGrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:yIy/BMvjRA+iqMIjmJ8c+hE
- TLSH T1EA55121912981585EA721B3C99A382A1C775FC34AB2193DF7190F63F6F3A7E06C35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 3c88d77c0b5ffceebd9738ba309c7a1b0cae9fe09768db54f88ca5166762ccc5
- MD5 9d5d50b49d81194c1be60bc3665e2d15
- SHA1 98bcfa972b1ccfc30c25542d423d7c8c309ac7de
- SHA512 cecedf1d21c6ceb8d91d92646944eeef9390134f29a0636a7c7b4b853f6929b347a98a620519f856729b00934620a6cf4a38d73a8b6010d3fe6900e609f11e70
- SSDEEP 12288:4yMrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:1VBMvjRA+iqMIjmJ8c+hE
- TLSH T1FC45233D00A90A99FF322B3C59A75792C240B83DB721719B7496F2FB873D5D1287AE05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 5dc278ba89e7534fc5b678a589ba93b3530592a9d3d847e1f0af819bc0e6f10d
- MD5 49bd0ce0a5ed9b4ce959c48c3575c010
- SHA1 6d878bab038fd84438004bd6b18e4fb731f5b2c6
- SHA512 59f2b6aec73b010d3d55ca4a5d7c673775902a69f8f51cae33161acea264da722b09edaa27b2b03385255879a9e0b5aac5091c456ab929426adf0fcb5136462e
- SSDEEP 24576:vQ9MxZKdcz9dw3mBMvjRA+iqMIjmJ8c+hE:vVKZdv1PiqMymJ/+hE
- TLSH T1A3558D2DABE9059AE173D23995A250C3A673B4311B31D6CF2448D03D4D7BEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 1c3640593d10521e3701e6d54a7356ba55abfb923d4fd99ed88796a0021187f9
- MD5 716f669680ff818540aa440eb4812e9f
- SHA1 cacab2ca0a67e4a5ed01403c7b219b312da077c4
- SHA512 e9996bcf0313978546af6f29833befff6a4a251b19a50cad0cda9ccc05479b515e258c27b16a271b1d2ba1aad6f880747103cdc1d31667905cd7396987f3bee5
- SSDEEP 12288:QyoKo2JRple9p6rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:QyocDApjBMvjRA+iqMIjmJ8c+hE
- TLSH T17665E01F776D40A2E172923C89858745E773B0346B6263CB6591C33E8F27AE9BD38B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 16c656507cd035ee9b7a47f62e81c936762d4c9417c2cea56ec324f46d5d0d0e
- MD5 2fa1a2c9b809834de0a6b36ad0248e29
- SHA1 043c45e5b8592a6155391e4bc8caf2e47cf9dd1c
- SHA512 98b8a3c70f273955f7f61ff7f8c988db7cf7326f564ceb477a9538cb4f758fb81ce807e07a1dd803fa91269242e290160ce09192beddb20b77b97bec870080c3
- SSDEEP 49152:0WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK+v1PiqMymJ/+hE:e0zuNIktPiqk9+
- TLSH T15AA57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 51b0d2fa2a13e0bf264a6290ce28654eb23521c2d9271cfd1050309aa76dfbf9
- MD5 0426f94fb21fa87d0e276a2f02c31630
- SHA1 3e0170fb16f9067ea4c16ff86d3ba78f93e9b4f3
- SHA512 def8e1041093d0129988f1700766a7af104fe862b80b1bbffc3a0822137bd7be242874c0ffe83857b82c79456d172d5c1d68f9469dba8a71e988d8d22b3907f3
- SSDEEP 24576:41QT7EcpfxR+N5AWAz3ooiYzjMqb0BMvjRA+iqMIjmJ8c+hE:FTDxR+N5YzTBjMIv1PiqMymJ/+hE
- TLSH T15655B02E67F805E9D17E86799A23C512FA727821133193CB42A0C17E1F7B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 fcd4a99ef9f3b71744bd88105b8b76ddb0b614bc30f83efe417a09d7ec1fa27a
- MD5 9986ff589c06dfb5f22928eeda66f7dd
- SHA1 5e032950426072bc2a7ffd991c3e8ec919b90ca1
- SHA512 e1006c6e3f5d0902bfbfcad3478d936a9270592123102b2c2c4d3eae5a79b8b8dd361f1aa4f2e8a56c7206a7c50726f3c139948ea54d1142914ef3e957a42196
- SSDEEP 24576:kTMdOz0FFS+UmSLYBMvjRA+iqMIjmJ8c+hE:M0K+UmSL3v1PiqMymJ/+hE
- TLSH T1F275F13E636D04E5E57BD27CDA438A06E67274750321A6DB0690C1BA2F6BEE4393DF40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 4fde03eff35ab1603758d6133260f845c7595442f2a3ec4e7f58942e3df29c31
- MD5 2328a4c0ec6976f30f67d7fbde62a589
- SHA1 f6e1298bc5642c88703de717488b323dc6c0a8b2
- SHA512 f27fb9147903cb46801a2d076a203bd1aab1ab4d3efbf0db8e5d5722b81fe5510ec9b8a0028df5dd82b9d62bfd3b899e7044476b4df249a584ba1f00922f972b
- SSDEEP 12288:Y4K4rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:uhBMvjRA+iqMIjmJ8c+hE
- TLSH T17855122D12EC25D4F93267389A664352C260FC3A732162EF35D5D6BF4F3A6D49839B02
- MD5 SHA1 SHA512 SSDEEP TLSH