Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 02:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_42cb43d284e43f9b5fdd4ff980fb74df_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2026-08-05_42cb43d284e43f9b5fdd4ff980fb74df_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 1.5MB
- Sample260806-csbxyack5s
- SHA256 a88b67e7f910797eb4e2aa87a6e3c15393b632e7eb03bc71d0f5124f496d1134
- MD5 42cb43d284e43f9b5fdd4ff980fb74df
- SHA1 0c9aae1b92a42391df2da1c8d517221a968d4d07
- SHA512 a6a16c270d039287601986b60cf9a8753a697cce41e556afa3bd0c503e75344412cd21020df3e2e52dafd582036738a5aa6239272311e47272d4fdd036422c72
- SSDEEP 24576:srrGS3H5CEW16+WYiZySo+7MjpiRqHmLqfGowKuN:s3GS3YEW1QYiZySOiR9Lqfh3uN
- TLSH T168657D0267F98169F1F37B709EB992645A77BCB56D3AC10E23C1225E09B4A50DA32733
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 5940 elevation_service.exe 296 elevation_service.exe 5280 maintenanceservice.exe 5832 OSE.EXE 4076 PerceptionSimulationService.exe 1924 perfhost.exe 1816 ReFsDedupSvc.exe 5456 SensorDataService.exe 5948 ssh-agent.exe 4808 AgentService.exe 6124 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-08-05_42cb43d284e43f9b5fdd4ff980fb74df_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9f8c12d1763f1d8f.bin elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-05_42cb43d284e43f9b5fdd4ff980fb74df_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-05_42cb43d284e43f9b5fdd4ff980fb74df_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-05_42cb43d284e43f9b5fdd4ff980fb74df_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-05_42cb43d284e43f9b5fdd4ff980fb74df_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_42cb43d284e43f9b5fdd4ff980fb74df_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000042a4f41e4a25dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f40865f4a25dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efff951e4a25dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bf7d25f4a25dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 5940 elevation_service.exe 5940 elevation_service.exe 5940 elevation_service.exe 5940 elevation_service.exe 5940 elevation_service.exe 5940 elevation_service.exe 5940 elevation_service.exe 296 elevation_service.exe 296 elevation_service.exe 296 elevation_service.exe 296 elevation_service.exe 296 elevation_service.exe 296 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 804 Process not Found 804 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1532 2026-08-05_42cb43d284e43f9b5fdd4ff980fb74df_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe Token: SeTakeOwnershipPrivilege 5940 elevation_service.exe Token: SeAssignPrimaryTokenPrivilege 4808 AgentService.exe Token: SeBackupPrivilege 1816 ReFsDedupSvc.exe Token: SeRestorePrivilege 1816 ReFsDedupSvc.exe Token: SeBackupPrivilege 1816 ReFsDedupSvc.exe Token: SeRestorePrivilege 1816 ReFsDedupSvc.exe Token: SeBackupPrivilege 1816 ReFsDedupSvc.exe Token: SeRestorePrivilege 1816 ReFsDedupSvc.exe Token: SeBackupPrivilege 1816 ReFsDedupSvc.exe Token: SeRestorePrivilege 1816 ReFsDedupSvc.exe Token: SeBackupPrivilege 1816 ReFsDedupSvc.exe Token: SeRestorePrivilege 1816 ReFsDedupSvc.exe Token: 33 6124 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 6124 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6124 SearchIndexer.exe Token: SeDebugPrivilege 5940 elevation_service.exe Token: SeDebugPrivilege 296 elevation_service.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1532 2026-08-05_42cb43d284e43f9b5fdd4ff980fb74df_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 6124 wrote to memory of 1076 6124 SearchIndexer.exe 100 PID 6124 wrote to memory of 1412 6124 SearchIndexer.exe 101 PID 6124 wrote to memory of 3700 6124 SearchIndexer.exe 102 PID 6124 wrote to memory of 3504 6124 SearchIndexer.exe 103 PID 6124 wrote to memory of 4968 6124 SearchIndexer.exe 105 PID 6124 wrote to memory of 6068 6124 SearchIndexer.exe 106 PID 6124 wrote to memory of 5024 6124 SearchIndexer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_42cb43d284e43f9b5fdd4ff980fb74df_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_42cb43d284e43f9b5fdd4ff980fb74df_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1532
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5940
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:296
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5280
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5832
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4076
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1924
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1816
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5456
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5948
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1076
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1412
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2860 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:3700
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3504
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4968
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2860 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:6068
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5024
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 dc39b2b8e1eabc8c1ef1ab06f2f8a2b05edae8941835803c82c85a4e2920ed44
- MD5 a371ff57c4bd73d4287f35964146532a
- SHA1 e26c64f6fa0eaf52b64862dfc682d29a369856f7
- SHA512 a40a05c8ed32badb134984fc082463d61aa1d073528b6a88b49056d4d09f72573a574d2813237905d0711982e36d42bbc82b3b4c803dd418109a86113af03c05
- SSDEEP 49152:8b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn2ySOiR9Lqfh3uN:m3q6sjBDFmfVuN
- TLSH T105D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 7b8a760ade745e1d839dd5df5faf3518dc91c2377f1ab41da798e072895e26d4
- MD5 0c452dc3ddbda2f0a959ddd87aa5856d
- SHA1 427c8ad0aef3e3f9b4623c1c327cf6a0a9a6a569
- SHA512 79f586c2abecc22986f34dd3e93db3a20c6335755226a32f7455811f3ce11cabbce6eb84dd27ee360ef8367c56365ea272e168276de42d8f273d3832504a80a9
- SSDEEP 24576:FXYfDtczAbySo+7MjpiRqHmLqfGowKuN:Qtc4ySOiR9Lqfh3uN
- TLSH T17105012977A448F9ED67823CC9A2C511E633BC9507A0E79B03E499790F336D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 b581f342c1b47b2c54b2ea7aa224da7ee72ca877001af4116052a8438abe22df
- MD5 d309bc08a8cb364d5a0c5d2d19bbc3f6
- SHA1 f0bed68e2c3f1547fa3d33f6f5c4dec084428534
- SHA512 46c49a6ee5c5b11d5fc7bab400ce02fd259e688814229851e8730cd986edb738d867067bec58bb7546f78e793d98d50ada867818efcb91c4580ca275e712665b
- SSDEEP 24576:M0Le5ji0hmxxrMeySo+7MjpiRqHmLqfGowKuN:MPji0AjxySOiR9Lqfh3uN
- TLSH T11935AF16F6748771D073C0B9C5D2A69EED3130861B308ACB4286D77C7E67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 77f518e3448081f98fc7c24052fc9145f0169c9569314f4b3a06c6ff8910148c
- MD5 e9338234a3b452e6210bc86bbe277f6a
- SHA1 0616c6c518aab74e5fdb7abaea5de7f3080a65a5
- SHA512 9eb7bc7a0eb89f8a8ea5599fae4e41da3e79aad2d4c56acbd3ac16efc6fcc3d13e44a8ebe2ed3c9b3bc8657c5fb72d490f895079f52ae0dfdf9e17e09d088195
- SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWn6q8wyuoySo+7MjpiRqHmLqfGowKuN:I/ezSC6vUzPveHjyVySOiR9Lqfh3uN
- TLSH T198755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 0328041637d10f552416abab3083ea1738891bd26d5a8efe4ea1060e7a5e72b3
- MD5 a2d618fba4a17450cae72994404bb1a3
- SHA1 76d1ad2e761bb0b805b89fcdd73b38bce194c324
- SHA512 5423a73b3b59b7169356b5afca7a8caf638f17b8c6f7e9a0212d936823949a751a4bf2f37efb5f6dc418c8623255592bbed5c3e8e491c45d9aa02919e665fac5
- SSDEEP 24576:UVbqPb88hv/l+Y3ySo+7MjpiRqHmLqfGowKuN:UVO88hXl+AySOiR9Lqfh3uN
- TLSH T175559E66F574C331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E67AD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 1dd85354c87edecf267aafad820bfede3b75a96ef334ab9f57d2d316b3567242
- MD5 0d59d4736654a79b390e098204e1957a
- SHA1 a257b858019b6266d752b30e2abc0a5e07a325a7
- SHA512 4331aa37b2b8b5ce2473c5af36313956e25395c8bd33ce3d37f938f89f78fcf86b6df2506482dfa6d4b7830d7a1626e45687528fe00d605b081a5660b1ec1ed9
- SSDEEP 12288:ELUEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3dS:EL6ySo+7MjpiRqHmLqfGowKuNS
- TLSH T1F5C42357072CCCC5DB7B2F3053D3C911962AFC882E81E72B4DB979BD84B4862E669907
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 b76769a80c146ec77b0786873bb6eeb1debfe508745a1182c846bbf679abed08
- MD5 7590e75c1474c5b3db28e42fb15047bc
- SHA1 1119289167d0561afbde1b972d9d386a36ac6cab
- SHA512 0351471542911c55820afeeb06f98abf236e3bc601f884d5efe937d1a19ed9807525f3042a1e6edac18ad9d4e45d8a85a77c90fa70a2f9acbbd3f118c26a4678
- SSDEEP 12288:meBNUbTVO86U1Em4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:mJIUfySo+7MjpiRqHmLqfGowKuN
- TLSH T18A05CF3BAE28ECD2C27A9DB85791C600E77278704F52A3CBD175820EDE235E15E7AC15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 133a45f731fef8b0576c09b1695ecd18d21da03af586d06204ce77d14341ca87
- MD5 3169050864bfeb5bb9cba1d4529d0c57
- SHA1 c34153bde2abd0cf78296915cacd07bae7b1e7e4
- SHA512 709bb4af6993153645156de53e84c598cb8e7e54f111696cef954d3202e6abd2bf451e499ca9ccd045a9274fa2b5f98ca54e73cf65184b15c108b5aa82c0079e
- SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THz:2QvGAdlCEL8c/DRNw5C+FmfVuN
- TLSH T188266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 5660cbed73d759611383e3227fc78121f36e09cf3f58ad7ba24b23f423e58407
- MD5 f204e28a38cfdf10baf42f4343a9b7d1
- SHA1 fe297e6397a058c9e409fbf5471e38a901c293b4
- SHA512 b54c94a03e6dd9473eff88a80092bc5b9d2bfb2379ee0867b42d051cbef0ca8a03b74b109c7d1a7cf045ec6e58f7c02955d9e70e42be15deeddafbdb8bb11556
- SSDEEP 12288:sAwSfxL/2Dc3RDLLmt0LDQewsAjXEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+z2:R0ewsAjhySo+7MjpiRqHmLqfGowKuN
- TLSH T1A115E031FA74D436C7BB0DB21B22C716543DB9600F912AC3E3A89E9E59702D22776E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 aaf5d52de52358a481fdb36480b2ed023c41a73055b885076f9ec124ec21d837
- MD5 7b80f113dd8d26d72cf14a472c81ab48
- SHA1 0000729b11bb78c5ed2eafa1113eb89be5e28571
- SHA512 df09a7662b57ec39141f59fca0afbac0e513817907ce86cbeb643dd16ed0c1bacdfe3cd8b18d5d81e56a751207572a4343abfbb1e8aee6b91a5644ecebbe57cf
- SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH7:JUEtQevvqc2W1cpV2tI32
- TLSH T126474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 467d8ae136719767b59548d847d2d6366910f21f337aff62d18bedf1f5c9688a
- MD5 118e781aebef7e01873474f8c07b1e9f
- SHA1 2a280deb03a9b997eac2d248b155fcdd2457e3d0
- SHA512 f1e25a1038dd61a464c6c819136a669d5788f747578aebee21df8c9d9dce3376694cbb057630fccab49a5fe52a014cd8e1b59d6e30977d5100fb91a93ca425fb
- SSDEEP 49152:3CbRquA/m2yL5zQfFiV+XenmE3/zBySOiR9Lqfh3uN:goqtVjnm6FmfVuN
- TLSH T1E6D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 f474321db6e5ac5dffbc074f4866acd9d0d1416322311ee7cd012a98cd68ee40
- MD5 020ab25549cbff24af7cc133d7e0415a
- SHA1 0cff260fe385565175715cd8a44fc381632c7e7b
- SHA512 a2b9d6a3bf427bed20a7634cd1ea62ddb0e033ea092f19b0c8d3e3eb750f73b8687ce7286cb310694231051e66569e20fb9dd887bd9ecc825396fa6ad5a14c24
- SSDEEP 24576:yAhGL3IFoiwtA5l7S53sySo+7MjpiRqHmLqfGowKuN:yAMUFoiq58ySOiR9Lqfh3uN
- TLSH T1A5359D81E7F945D4F5B3AA7899B68571EA76BCAA1E31C20F2160D11F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 58809c038e9a5284a85c78dc8cad61321a46f5eb5967e3280dbae2ebd74be65a
- MD5 50e23bf1b2cd2f9374019a47b37e95ba
- SHA1 d4a830b7eedc63c0ca395dde3f309af66bf85204
- SHA512 ed927bb556bbca1775ec0f9dda41b5ee5091b6f1a4d15c1f87bae8808329a78a4a62df90909b44f17ee83a700c0de716495527742795f16353db33598af79e9e
- SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+CKEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtuN:twu4OW1ySo+7MjpiRqHmLqfGowKuN
- TLSH T13105F14637A84CF9E96796388693C532F7B2BC052A21D71F0760C66B5F37261BE2DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 80c6b24f3acfec6428daeabecc60eb0c7265c24115f340cbd9572dda995c6a1e
- MD5 deb69b2224796f2efcbfa66a3024bce0
- SHA1 fea2119430769d37e281b99e5c92c9408b4cd365
- SHA512 3daef892f1823dfd58d0deff20ccd7384c9921931e1eea8848eefdeb7197b5821da3a046a1af3004f64eabf217a92d79a9b907cff7b2e1bcffc9d7b1c9203f23
- SSDEEP 12288:veZ1IyHEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:2ZumySo+7MjpiRqHmLqfGowKuN
- TLSH T1F1E4225A23A894F9D2775738C9E28600D332BC96277183CF096456BE1F72DD25E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 fc9a72706b419c06e42a98391de74fafd0fc0db7dad0a8240f37113b040d3fff
- MD5 60182c5af896564c93ebd5cd74076b3a
- SHA1 b8a8b8f3d34a6739d767d36d94efe7f7fef045bf
- SHA512 d1a270da688743fd65588b79692a39608c62d28e2a32e0d92b540ef726532e88dde2f435c58baf1796356f920d30ae18d0c08cb469a65919cd5847d0c48e5d06
- SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U3:5QRQyi36YOcPbLvw2gAf+PN3XFmfVuN
- TLSH T11C666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 02d5a4da0dd0ea32d64fa566a6a4fce820ac50622754c17dbf3dc3e1ede4f92d
- MD5 985ee2893ba4e59da235f57b373e0e7d
- SHA1 d01cfeb301bcf6106bfaf7d8ce875ecfb0c4f6ef
- SHA512 e839a6a718c32704b03990412bc2c95edcf077aa413b0f31d770cb57082fb26a28c4a656f2c33d2c122f7491663c5540660f6869f551aff30872a5ad1c3f5973
- SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U3:rQRQyi36YOcPbLvw2gAf+PN3XFmfVuN
- TLSH T1EA666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 263e41029d1a375a136f1b36e7adaa2542f1213e5f16f693ee925b65a567f4bc
- MD5 e6b0123d94911ffc556da280e281cba7
- SHA1 9db6d28af8facda1fd42c4ef6c9befa523fc0d44
- SHA512 fb9a1712dc603e53a95b58cf65be584268a8b77128ec94290bc9b56bdbcd340b6939f93f5c5bdf5edca7a86fe8051e67e66f86d673fef4e3bb8a8daa7eda53bf
- SSDEEP 49152:j68Qg55nhceWu7PNU3/xySOiR9Lqfh3uN:dthLRc/VFmfVuN
- TLSH T149B55933B2F600A9C44DE1769F46873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 106af1ab99917f6454f1220bd7fae1488c15994cfd3a7c8d77000fb9d146acb8
- MD5 b2c435145f4b6651dd85ebf12356cabf
- SHA1 2a68b90afd8e07d281ac3d62c0fbf8f38edb6ca6
- SHA512 f0abc21659e13a3c3d0410f2b381bd8799afdeafdd8f5b57cc10ce9d807b62761a11b7e781d4ea0bb4fbe921ada22b43918c3be9b0f9f55e7d23d10c209ce37c
- SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99V:yy5112gYy5azzVvt69nLKnhZYFmfVuN
- TLSH T148167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 92165ed19905db885b7e2c839f334ef148b9b4250693ac72950280f64e25602e
- MD5 e57a09e1f44e6e6ad1a6f8730de0c0c4
- SHA1 3190be39143d54309663cbd441f379545d49f69e
- SHA512 c2770ceb85af9d7b4d1d7679c7c4de076731a29a9115cb2d73ef7d8146b5655d4ad8e77efc0faee7f7cfe366d3e2bedd7ce9a12223e1820223a7c7786f654e28
- SSDEEP 49152:dB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glQySOiR9Lqfh3uN:Du6Jmdxd2dWFmfVuN
- TLSH T19BD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 e030b46e497d3c12797f9795df1d85ef6d0c9f9c28e08e1e56e02d4f9d230f74
- MD5 3f8ad8a547933ca7c66d33cca30c7681
- SHA1 b637e5db6c2c5f7c6449962733467fbcaaccc638
- SHA512 6d523162fcfc215a80bf2b9a1fad4c8a8171e5ab19d32c048bb82a327c78dbabc206e02a663d8329457286c0ce2fa833a9f395139a7c602b5ce1ef91b5595522
- SSDEEP 49152:71hpsNoJpF1A63U44CwH7R4x/ySOiR9Lqfh3uN:7mifPWR6FmfVuN
- TLSH T165B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 a5224ddbd068a05656344b8d01b27e7fb0761d198b5cf5cdab155b4c4a3de3b8
- MD5 ed6fd28572b031c28c6a938331439f3a
- SHA1 54db253f8d952497edddba711614e7ba11a5db27
- SHA512 532c66705d72873a65c725e3f4db0607274c980b707061136f03cc2f5825f667b023062c6a7b8e9a062c9419bea02c3a199a5bc89a2a8f7739c52a070d206564
- SSDEEP 49152:qSuZQIY0Be2KcRVtOnks6NMHqmySOiR9Lqfh3uN:05dKii61cFmfVuN
- TLSH T1CDC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 e9e9d0b35dcf57d7bc6111efd3411695bffeac8775e6fe8b99a9c6388f4c165b
- MD5 702efda24b20ae22fa9c840825db946c
- SHA1 5885d0cd3eb6cb28b975a1a7d2d7981d1a52635e
- SHA512 aaa463191b3036e86856afbe7440367cb719092a008ebdfb1630b08efe3f31de8c200853fd899ae69da9bc5ad3e8f8595698976b4e1d937080f370025e4d3b90
- SSDEEP 49152:lhtSn8EApI0fig3giDn0AP5wbySOiR9Lqfh3uN:UX2imph2FmfVuN
- TLSH T11895BE13F2D900E8D05ED178C7468632EA62BC160B35B6EF0A90B7561E7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 80272a84c24ef91e367a5cc0485d393e67e5fb32396225f444762a594e785205
- MD5 f26e4643d2b8b84936bd9e81bc2e29c2
- SHA1 cf9ac7e0594061e44a24676687f7939a44e3aea7
- SHA512 1db670229502eebde4e0c27f9a65ecf9c9cdd92aa1e0c8e8001ff4f6d16188e2eed16ac5a15cd0e1ea788c9f13cd01a7cb6661c754a807adc7e03a6ede219086
- SSDEEP 12288:e8Em4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:eCySo+7MjpiRqHmLqfGowKuN
- TLSH T113C42316162DCDCAD62B2F308393C510D629FCCE3F82A32B5DAD757E85B4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 542bcba4519c501decdc3e8c619716382ccaac76ab21a7d0d2b6c8c2549f8e7b
- MD5 597212cfcb7cc820d1a95ffc93b29002
- SHA1 883c478858fbdcd1ca3a7426dc4c80b6bf5af75c
- SHA512 b73400cb7f3748bed29f5906727f4162f6e9ce0eae181170951852d4ef19cf973e7b294f4802572ca009a2510b40d13b2e870540022b7e48c48c7f9bac363e3f
- SSDEEP 12288:PjEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:PNySo+7MjpiRqHmLqfGowKuN
- TLSH T125C42326162DCDCAD62B2F308393C550D629FCCE3F81A32B5DAD747E85B4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 b87b913d85c21aec8a2f57d013a37de9d29cd91046b8f5ea6bb78124a19d8f91
- MD5 991831555c308da18632889b67d5e754
- SHA1 8339fc2d99a1155c478257c04be67c3609be66bd
- SHA512 dcb0585f6f5e47bd6faf49851b9f15a6bc75888a39519f3b339560cb30d71a07c2dfb96a14dee24adaa6bbbadf7753b7b3ce7af98aaa0c2eaf85d346da2c051c
- SSDEEP 12288:adEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:aHySo+7MjpiRqHmLqfGowKuN
- TLSH T1BEC42326162DCDCAD62B2F308393C650D629FCCE3F81A32F5DAD747D85A4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 803dcc36a0eb54de8c4fd57e9e0ca1c16d34841b954993a98d8a2b5033e8eefb
- MD5 dc1c826bc68b8959f080060a261809e1
- SHA1 3153c590896ee5d969dd9bd90b6b477694d35f90
- SHA512 ec2a12a9534bc58d82a40c55c6534b8b56c3fe57c2055c5ce15ed30e59c7f86d2465898af716ee68e53e9768ddb24e95a978279b1f34f9f6d567758cf5a80e44
- SSDEEP 12288:ZVeEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:AySo+7MjpiRqHmLqfGowKuN
- TLSH T1E3D42316172DC9C5D977AB34C2A3C510D33AFCC92F52E3AF4E54296E4DB0AA16A38F05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 cba42e9ea7830489237d5e1b711528ae5341da4ec4b3d703759f87703ecb18b3
- MD5 ef1ddf2a2f618c2a41cec811be4c39aa
- SHA1 4555ee491419ecf2fe9b87e4daf10d1eaa2ae35e
- SHA512 7e57b83cb71e2e6579050a79e42b653c0764026b605258f8c8a05f8f85a082583487e8beb2b48da61f87ac44bfd77e8392e7c9e9b4a97072ac632f11f214be6b
- SSDEEP 12288:TWEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:TEySo+7MjpiRqHmLqfGowKuN
- TLSH T1ECC42326162DCDCAD62B2F308393C650D629FCCE3F81A32F5DAD747D85A4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 f54012313a56c0d0f4649aa82175c120f7be0835b55bbdb9b501a05e847f987d
- MD5 caf39dae10f0c1da97f333965dce9583
- SHA1 9d47313d34f24f69366f993bd8a11f3217972553
- SHA512 0091e2e393f22f28d20ecd60ae7442610fe1c5634d51c6553ee9731bc6ea422f94ac3d5ba11fa01e1ec6c4b00c402de67e8dd3b34f616ab4b846bab4e0ef9433
- SSDEEP 12288:p/Em4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:pJySo+7MjpiRqHmLqfGowKuN
- TLSH T10CC42326162DCDCAD62B2B308393C550D629FCCE3F82A32F1DAD747D85B4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 8a74f5980501c10bc0fbf757e259ac31651e454aae65008601643c9bc1d1755b
- MD5 6657133939cb47cef654012d8856815b
- SHA1 c132e6d7ebe1d7b13139e1374fa7c3e9fa21c1ef
- SHA512 4a4992385f2ba0b81f4eca6396e2d7486f75cc6b18e698f528273554d9637f9eef43379b76944d7667baabb188f4cbb259f83a7970c833e16646c43f342caf72
- SSDEEP 12288:X7Em4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:XFySo+7MjpiRqHmLqfGowKuN
- TLSH T14DC423261A2DCDCAD62B2B308393C510D629FCCE3F81A32F5DAD757D85B4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 c631483c141c2e658cd315d5ae099bf8a87a3783fba95556bbd21c8f3d590475
- MD5 b5eeb081699ce1d38c1584f351dec653
- SHA1 ed4052f083da18a37646c82d627a9a4d80ab410f
- SHA512 42ab0104183b949ba2ce324c68d1540d52bebc178723d3578b4252df3534f862b8d56fe3eb9d88296c3babc1e1f6eeaaf18039834448a508bf643df7c3a90611
- SSDEEP 24576:NZMRzFVSOtySo+7MjpiRqHmLqfGowKuN:NZMRzf5ySOiR9Lqfh3uN
- TLSH T1190501A573604CF8EC67823EC9528905D2B2BC5A0B60C61F07B8366A5F737A11D3EF56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 c003462952cd2e21f92cc79a25afe1b68fd6ae89d9594386a44c6797cda6e55f
- MD5 e3989467c13bd14bc941fb4a5e0f02c1
- SHA1 76b3cca4153f5a6c927b09b392537d55a65a7fa5
- SHA512 06b8a53b87f3b8123b0e0665c1c4e305d84e49eff36380a3442d616dd9773ecff59c365055db42c9e16e790477c840a255f10debf935a7371c1159ec4b11e228
- SSDEEP 12288:QgEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:QWySo+7MjpiRqHmLqfGowKuN
- TLSH T157C42316162DCDCAD62B2F308393C610D629FCCE3F82A32B5DAD757D85B4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 339d6008ddefc813fb7287020f6ea8880e237369c3679d5002ee6f1481dd2d27
- MD5 1f66e24ff009adfeb1466e4c24e87e14
- SHA1 360ec1ef6176b37c4e9d78e5b7786f0eae2b0cee
- SHA512 5d7cfb727831f3561027b7e092dfc3a872fa55fca7acab69258314fa5826ec489e421135461a30b6fb675b188c4d8db299bacf2071b3c15885fa02dcbfffb11f
- SSDEEP 12288:yEEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:yqySo+7MjpiRqHmLqfGowKuN
- TLSH T1EAC42326162DCDCAD62B2B308393C510D62DFCCE3F82A32B5DAD757D85B4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 9be105d743cc95f3b6e6b43dfbd093243cbb4c4c98d52ac1b10768d036e4b641
- MD5 13aba7c5877fc39c8bfa442e6eced831
- SHA1 da214d6a62a6fe31e687066fd75a82d96dfaf9f3
- SHA512 eecc75db7d9ceb66841965afbb029727f85f7a894c9d7c9f0a440e88868bcb6690a5f6bc3db99d22a76ae869f9b0973fbcfe71bfdf1e4536b4ac2fdfda0d8d0c
- SSDEEP 12288:tyPz5L8HEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:EzyRySo+7MjpiRqHmLqfGowKuN
- TLSH T115F41217336560F9D1379238C9A24A01F336BC761B609BAF17A4177A1E636E19E3EF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 37de6c81f81dbd76183fc72fead19503b1405b12c9b4285a3a158383aea86ab2
- MD5 b92672cfb25c85acaae3b5a0f79e9d33
- SHA1 08578e2af7e889f60c9d107baabbcc7bf613e8c9
- SHA512 1e3e30d44b12c67bacac34d718577c963a3a86695b39bd916cba3cdf0b067faae986a1bc95a8f5775f314bb6c44ca92342bbf6ee4f0f8c4ea63be6615e9b8132
- SSDEEP 12288:6gEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:6WySo+7MjpiRqHmLqfGowKuN
- TLSH T181C42326162DCDCAD62B2F308393C650D529FCCE3F82A32B5DAD757D85B4C62262DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 208ec7bebff7d48282e1065865c6928e7f60a92f850cda8b5803fe962200f4c9
- MD5 1e6b8df119fd754933bf6031a45aef5b
- SHA1 7966344baa5a6f7240c85602444faaa98429f633
- SHA512 ea1d2abcebee3153f43c138d52112fb244d279c0c9aed07a127a8f62329873be8c2d866c3b0fcd42e220d878d960c8b7f5853a2064e8b560f135f3b632a0b266
- SSDEEP 12288:1gEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:1WySo+7MjpiRqHmLqfGowKuN
- TLSH T148C42326162DCDCAD62B2F308383C650D52DFCCE3F82A32B5DAD757D84A4C62262DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 72e8384760c66939cab366143be0002ae6a58dbfe951546b5d5817c84e96ae9c
- MD5 8b83a0106171e7e62e6a6764e5b854dc
- SHA1 e8ba8f5667bcae14a7444f52fd62c05ff45f8573
- SHA512 4452741e7244d2fe56985e75cd010cf99bfc1fc6785e76742411d123139230e53215cb13bd8340476c64b0d0a7945ea17f2252c31a885f7c4de77ba2797c6a96
- SSDEEP 12288:WyPz5L8HEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:rzyRySo+7MjpiRqHmLqfGowKuN
- TLSH T12EF41217336560F9D1379238C9A24A01F336BC761B609BAF17A4177A1E636E19E3EF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 a8057426ef8f068db551a780ffadaa9850b9a7225cb807c40d6bc5fa3f9a6b6c
- MD5 a10000ac08b7b257bb6ecdeb776eed39
- SHA1 7686a8a2ce08b43efc7ccf47b0e524860d89e5a3
- SHA512 9bc5d121d0bb2064832e51192b4db8ddc16482e0f2fcc5bfb299f2ab73c5791a3c2f271289e3dc9b62a14a407b69f150476ef48d8956b418d4314fa768c9a1e2
- SSDEEP 24576:PTDaLl3z0zDXySo+7MjpiRqHmLqfGowKuN:PTuLljoySOiR9Lqfh3uN
- TLSH T1C40501A573604CF8DC67863EC9528906D2B2BC5A0B60C71F07A8366A5F733A11D3EF56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 3a8fca2969f69791a90bd1e61551b942170fe033dbb1264e676709272f87828c
- MD5 ca4486390bf0105417de6545553e37bc
- SHA1 9515d0de9e594411e65fbd14f12337019a158adb
- SHA512 2efe44f7ec5416ec8da6fec934f542b3fdc08e230ecd2a34a010b483da8dbbb7fe277de1e3d0f12b78b713d7168fe375407c624b6f4c35049d39348fc6ebf09e
- SSDEEP 24576:r3vd9CHKy7GZDySo+7MjpiRqHmLqfGowKuN:Lvd9CHKya5ySOiR9Lqfh3uN
- TLSH T14125CF90F3E414E8F0B79A35C9728511DA767C991B71DE8F03A8265A1F33AD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 4e31df65b460e93a98efb6ff58e32e40a6332e25ffe1103e694bc200fbf1f0b2
- MD5 ba038077735f4b7ca68ca6762b2a927b
- SHA1 9e4dbeb7b23dbfe436288abf7617116725f5f876
- SHA512 5a97799ae0ff49dd8d2c69a92d5ee52c92057f02370c56e7a4455f3ee612d07d054538c4e8d3c25be22bdbb0849b074d31e237249bf2bfc36ecdaaf9961ad4f6
- SSDEEP 12288:s9Em4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:snySo+7MjpiRqHmLqfGowKuN
- TLSH T189C42326162DCDCAD62B2F308393C650D629FCCE3F81A32F5DAD747D85A4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 31000101390de97eb2bb658363e49a9b025013e8c4bf6aa8b8f51bcc58eba125
- MD5 44838d5613f2e212090f6ce2e6d707c2
- SHA1 7ee45f5bb4a7713854fe7ffaf1d748023eb963b7
- SHA512 2d34e2bf9af1e4f5281f813a66592218836c6bc64ce7143f3d1ff40b49ec51184017294a3b62922c198333b3cb96666531610c207def5bb8923200f24ad68d4b
- SSDEEP 12288:UnEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:UxySo+7MjpiRqHmLqfGowKuN
- TLSH T162C42326162DCDDAD62B2B3043D3C610D629FCCD3F82A32B5DAD747E85B4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 3e9dc0fc79c4b2c80513c6818e50a79103084e2de7533acd90a10c442e57c9bb
- MD5 c30e1469e66444c1663e3896b4119548
- SHA1 9f6291a4139c34e7aa7f754f5c9d61bf1649606f
- SHA512 d8c9e75fbe2facdaca8e03cd1d8e18dfbe8764967145c38b3b5e9b105b2e0673d42657b6361cab9644d5021ff7cd1f7f5901da664eae3368a8554923ac1b1839
- SSDEEP 12288:MiEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:MgySo+7MjpiRqHmLqfGowKuN
- TLSH T195C42326162DCDCAD62B2F308393C650D529FCCE3F82A32F5DAD757D85A4C62262DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 f544f27564f74be5efb35949983ead850aea969b5370c120b8f183253eac88b1
- MD5 f2cc9f74032f81da6ac8791991f36cf5
- SHA1 cb2a6f3e2b7d65ad61ad41f2f5bb30fb713976da
- SHA512 a90b0f5250bc66d28e549237c5a1503074ea842d8d69c988cbad7e6ada80bb09189a5db75acbc738f88d9655626a707820af74b2ae713fd7475cbb07c0bd699b
- SSDEEP 12288:BgEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:BWySo+7MjpiRqHmLqfGowKuN
- TLSH T17BC42326162DCDCAD62B2F304393C650D629FCCE3F82A32B5DAD757D84B4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 3422101585bd7884b0d31b36e85f518ff6412d19bb4a3d28a291d2f30bef94f0
- MD5 7b39b5a5286a3c7a52c47a7f13279c68
- SHA1 ae8c97d283c1648e8108a6ca01c62957979e2d6d
- SHA512 c7b54487444585d4aa23bb950228f5092a7d4a29217a871b2f1a6e74e7443b425103c78fe416f18a544ae5bf078e64de55dc074e428a61e418ef4b83b2437c49
- SSDEEP 12288:39Em4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:3nySo+7MjpiRqHmLqfGowKuN
- TLSH T11CC42326162DCDCAD62B2F308393C650D529FCCE3F82A32F5DAD747D85A4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 386ded36c68a25a6c35dd8d00cdb995681db01c3d4bdf5cd9f266ddc5ae8ea75
- MD5 ce0ad66fe2b831d577ee5cd0166efa6a
- SHA1 afafa46011a209eda585b9ed2867da81d2e2ad8a
- SHA512 ff7448f319b301221bc686b1d61ae9b7299990be11d03a8c377b50a690ef1cf378d2a64f907d7666ce240cbb7e6d8008a9c30b7299b0af7568708a5ed3f364b8
- SSDEEP 12288:t4Em4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:tuySo+7MjpiRqHmLqfGowKuN
- TLSH T1A2C423261A29CDCAD62B2F3083D3C610D52DFCCD3F82A32B5DAD757D85B4862662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 581KB
- SHA256 81393079cdc6f8035a0a751a3b5215843343d56e79d349bb3df93a3a43faeceb
- MD5 1569f874e78c7d4891a6467e055f86fe
- SHA1 6d7cb20a5b5c543eead2c59ede95d7788e637c6c
- SHA512 0ed994e188b37ffa5211e0a2eefd9447c4bff2f6965579c2f9cd7a908bff625e6e9de84851259daff12da6480403e55f5b571c8dbc0bcc2b93be40858f6b7010
- SSDEEP 12288:jWEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:jEySo+7MjpiRqHmLqfGowKuN
- TLSH T139C42326162DCDCAD62B2F308393C650D529FCCE3F81A32F5DAD747D85A4C62662DD06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 48a94f487d3c30b8c7eac910dad4c174fd5729de769803484e2715e1ac5b110f
- MD5 936bdcc386f95621881c3278d8f7ea8f
- SHA1 2afb495f41eff2d8ef1ee69f91efcd6b907757e6
- SHA512 49e1877ade256a06f7537402b31438e49e2154468f241781bfc2cf34307bf47ead1ff5e86fb2a74ce8ef03274b9f2fd10095b7570f599df4ca4f409e71e76e19
- SSDEEP 24576:lfwvUk9RX6wkyAIaySo+7MjpiRqHmLqfGowKuN:XMnYIaySOiR9Lqfh3uN
- TLSH T17335D029EBDC48E5E177923C89B3860AF6B178591B31C2CF029A53AD0E37ED45E39710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 09b66ccaae8721a0e23998f2a7762fdd4b221341ae644a373b4f1130a2248ed9
- MD5 b3d300f51ef6c5eae00ad3be4ea2e8e8
- SHA1 3f104bb802121309956b1734a6de37c2a991ff90
- SHA512 a0253de7a104f1919735b562c0f4abe1c64b67bafcb9acfeb5ce8cfa84f76c0301b67b70fc25c2823fbbee40848c24e870795d95adc358f9975fb64b6f9dbdd1
- SSDEEP 49152:eYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07ySOiR9Lqfh3m:tySzP3FmfVuN
- TLSH T1B2067C96A16841D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 b1fcca5cee5cb897bbcd62ef78421791ef1ae1f7dd316449bf531da047dbe3e6
- MD5 5cf3ba8c8a82bdb8ce7caefb7146f8a3
- SHA1 1b48d3fc12ee4a2d20e4c6630700b41367877a9a
- SHA512 9c07b417417c2f8ef0f7e7b54bfcadf5fc41c98c136b6515c84e851fb874108158ccc27a72ae3f7c86de6daefd881442094ab7948aa246f634f507d28ad3f91d
- SSDEEP 24576:Z47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYdySo+7MjpiRqHmLqfGowKuN:Z47JUQjTirIhCnDHUPfF/rySOiR9LqfE
- TLSH T1EE65AE1EA3EC01E5E1BA927885158A1AEA71782E1F31CACF1270437D6F63ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 624eb8e5136ca82c5a34e6a66e7d007d9c492fac48120f92a1decff1b655c624
- MD5 b847c79db3c9523b5e7258bac3eda6fc
- SHA1 acd3c65b25fa7b75ace43a12c83b120cfe23ff87
- SHA512 e0d70082fd532c3229e9f6b34ae7cd02236667337b340bbc01906bb99b006616f98a034aa8b7072dcdb2a95861842c23b7b6d0586df43f5abf81f6a519cd88e4
- SSDEEP 12288:lbsfwEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:AmySo+7MjpiRqHmLqfGowKuN
- TLSH T138E4F11AD26842D8C06E6235C7928A40F337BC6957E1D3CB56D0F57E0F75A909EEAB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 db1c13ebaf633d6438b3ba4129bc703768f9d8b140bfbd4326c97cd437a5c9e7
- MD5 953da744d62ab373d31e25809fcd1ff9
- SHA1 c09d62fd6c4d60392db583087ce53bc9acdf53c1
- SHA512 921f0533a5f858760580313f90d5611ae2ece2ab81c47c21b0621f86d6b66ac1f4dbf92364f534e2a2e09846f363b9bcee08959c560c5edf2048cab11828af65
- SSDEEP 12288:iSVVR0U3fxpCe+A7JbXkrsebAdBDgNosHL/r5BHOQ:PPGUPPCezXWiBDgNosbr5E
- TLSH T1B6352940766AC75FC6A980321E32D1CC97707D05EE45AF0773C8873FD576A69BAE2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.3MB
- SHA256 ebd96008250088299c308441cfcb4bd2903a3d33f861c0e7f42776c719a0f5c0
- MD5 2c7c251abf58c2cbec2ce32a79c2ba55
- SHA1 e174b1e23aaea9771ad8be31f442b183d4526a16
- SHA512 030854cdc6c2d9e241c0ac9601760d814ae1814a9f4bcbb38a9b562a7b3174fbf2af2af8a291368c14df1b701f759a99c9bb1ead72a88643f7a2bed157e6f80d
- SSDEEP 12288:LgVo8qqAB7ihBO+MH8SvmfRWWu6zxJhLy9Uw:Ea8gVOxJhu9Uw
- TLSH T1DE55F9419537E38FD1F66032072A5B4CA764EC07B7496F26B3C8453AD86AB65B0F93C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
- Size 187KB
- SHA256 b59b7a5a31da3f2e126f9ea8f19d2f9d86fc94cc697e245c15b342ec58170cf3
- MD5 f0b5ffe0aa473d80b22801b88d147c65
- SHA1 6e19b45b7f058011c739d8f3b6b9ba440cddf723
- SHA512 023876817c6da9f202e01b654b03c6a375c441043616ab962ef40507eba6ae93c05c25eaede9769fad49f40387d255956af9267254c120c4feebc0eb8f1bdd4f
- SSDEEP 3072:hT4DJswCXkQqSmSgojgTaDuK1+4xKtaU/Q+QPqGXXY7FfPFTM2ropXY:SyYjX
- TLSH T18414D34263FC1209F6F77B41EEB852A44B77BDA1AE3EC14D1685015E48F0A90DA72B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 a3206d2ccf0caf7af4945dadcbccdd4a7bb45ae2253c807c317445ebb31e3c84
- MD5 64761379138063f770991b1f3ded071c
- SHA1 93e3eab6763d1ae327045c8582bd210598fbe0b9
- SHA512 dba6ee29a31305ac807d25e3dafa97aa31502589942f69037084be12b17658cbe687cb7edc2799b6bd70d4889be975767bb9fe02c9d7fa43a246fdd884265bea
- SSDEEP 12288:UM7IEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:V+ySo+7MjpiRqHmLqfGowKuN
- TLSH T174D42322472DCDC6E97B2F304293C520A62EFC982F81D3EB9C5875AD94B4CD15E39E06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 bc63a2dc71ba2acd24a1504ab3937b05dcfb71b6c2845c471fc84c184b36c5e8
- MD5 34669dfecbe55f83d4ac6a2cba24552c
- SHA1 b0737981de5d11983330a285f298fbd8120693c3
- SHA512 034b74a1498df7916db3bb19f95c69568e3eb3e352d8f2720cdc64c73e0397c48fcb6f8a4253a5e4f7af0224ec27906a589578b68fb4f501557a34740b1895ac
- SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYoySo+7MjpiRqHmLqfGowKuN:Bgb4mBIBhGFdySOiR9Lqfh3uN
- TLSH T17D65AE1E22EC02F5E0FAE2B88DA64417D6B278161731D2DF1151427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 dcc3217ccdb09372f891856f4dff0efc26e37edfc8cabbdbf9dd7994e2e119f9
- MD5 cf1a940dbff9e1bf3042f0dd79811a39
- SHA1 afba3045a9a1cbd25b9a998fd3ac629c6b7a76f6
- SHA512 874132831a60f75093aba695622028a722a48421a56b48e25041c69de58a1a75940c5d8cf43fe8a6987637f5cf01707b774cc14862b29fb09413084275e38820
- SSDEEP 24576:zG88u8FpJqH1bzria7/mtySo+7MjpiRqHmLqfGowKuN:C7ZFPqVea7/AySOiR9Lqfh3uN
- TLSH T13335F16577E501F0D47BD1388A828663F672B8251360EBDF0AAC8B551F23AE54B3EF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 f4672c6fa005121e01a3841bc82200294dcba43a7bb0abf914dca3a57aab8479
- MD5 1049c8892dae72611cbd58901d336ab7
- SHA1 06c9dd40d78d039284f5b94c526a6d58760d8418
- SHA512 b42b70989faceeb2065b450777fa6abed56cc8e05c3b77d8f4429774e759fa9e1bda3b3bcf24a0ff4ccdab3a13d977254b5de2e5e7091281955ab79130b6b4c2
- SSDEEP 12288:4HvUrBFrEjwaQvEm4j+ySo+p1MfrUIl5AZRqHmSr2pBqfLK+zwSZtu3d:4PUr+NQ5ySo+7MjpiRqHmLqfGowKuN
- TLSH T11805E12F22AC1CE5E676A17C85828719F771B8661712D2CF02E0817E4E67DE8BD3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 eeb3aaf2e4cb927b57b1fb626b31a5559f8b03be587fd753cf7cd4fb9da44a02
- MD5 db0854796806e15b60aa3df4ab9a5a10
- SHA1 d66f2aebd8f508e30aa68c81e61773f35272130f
- SHA512 f93bb1d3f5810c4c86f5467a1f96d4f4c22f3664426a2abad7ee007d44fbbb31cdabe6bcbc7675baddd100d3e7243611e31b8368fb4aaefcb0cd02aea7c5e36a
- SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJySOiR9Lqfh3uN:lG05lO43bwFmfVuN
- TLSH T1BFD5C06E62EC01F9D1BBD17CDAC6860BEBB23815032556CF02A486A91F27FF4557E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 097b4e96fb31d0643b64e1c51a66fc6d16b2fca0822aad289970b1a5e4277420
- MD5 13dcd43dc77993396a2f115369746574
- SHA1 9c52c72d59c90aa2e363f64fd64f86224e955e06
- SHA512 da9877c7d00b7b0982c630115b96d5b7e4c3b33e4cf414075d8a508c1ba8682d502c58fd401924eedaf297da353563572823ced9e6dc902e9c5a1825201f6c5b
- SSDEEP 24576:Dfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn7ySo+7MjpiRqHmLqfGowKuN:7a5POZ3BJt2pasx2+mxySOiR9Lqfh3uN
- TLSH T10165AF5EA6FC01D5D5B9D17DC583861AE5B1342613329BCF022182BE3F27EE89E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 d700ac7ad5ea517b05ee4787acea2db323ec4c555dd8a16915c3cafc1a666324
- MD5 b78934532c6bf6a7e506e3caa5b8fe30
- SHA1 bcb52d9fe83d4bc0bbc5857eba90e51207ac7bd3
- SHA512 5cb13e6758655d44080846fb1c08acd25e7edc495f5b64c764225f8270bf8e9f6d24f3795cf6f2cd1621a6901ca13142dc7ecf038e2a2b54e92ccc4b96dd1071
- SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkVySo+7MjpiRqHmLqfGowKuN:tNc/zEOVHFgySOiR9Lqfh3uN
- TLSH T11C858B2623E901E4E5BBE1BE89779546FA717869173086CF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 efeaec613adf3d920cc5b244201471f0385396620f9a22f06ca07e4d9dad25e6
- MD5 c9447815df72a96b84f8db424d5f9831
- SHA1 05123342061a8b9b71374591c7991a8a826dc25b
- SHA512 396bcd5df8524d3fcc4ec7afcc4b7cae7c5f08906cc0640ef66fd23930e5cae7f28f1daf92f92492dad371d1472d7aa1d2012001427ca06d93406d422d0e9500
- SSDEEP 24576:iTkNvNnaFeYhJNtmZBmMySo+7MjpiRqHmLqfGowKuN:iTMwBtOmMySOiR9Lqfh3uN
- TLSH T1C255AF2EB6B846E4D1FEC674CE238512E6727861173293CB5290C13F4E679D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 040a71e506e0585e4611699a9ca6b973ae7703bedc056191ac8b54ab7bcc71a4
- MD5 f341342da794cf03e1716dbf84c75fa4
- SHA1 45ca86f81992369304478dc058309d3627c425aa
- SHA512 508dba3e4a406afcd577020c2db8089db7ae8fbbdc54fa1b3e97e870cea1363bd4635c57dfcac07fb7dbe7590ed3dfe9baa9ee41d76cd36c0566cf4ace732092
- SSDEEP 24576:wD3FHshBIYQgAiySo+7MjpiRqHmLqfGowKuN:wDVHeBIAAiySOiR9Lqfh3uN
- TLSH T1ED25E13EE65C04E4D57BD27CC6638A06E77138A9032266DB06D481BA5F6BEE46D39F00
- MD5 SHA1 SHA512 SSDEEP TLSH