Analysis
- user interaction
yes - max time kernel
155s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 15:00
Behavioral task
behavioral1
Sample
processhacker-2.39-setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
300 seconds
General
- Target processhacker-2.39-setup.exe
- Size 2.2MB
- Sample260925-sdg4ea1t8r
- SHA256 28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
- MD5 54daad58cce5003bee58b28a4f465f49
- SHA1 162b08b0b11827cc024e6b2eed5887ec86339baa
- SHA512 8330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829
- SSDEEP 49152:l9hfV/U5NkLXXzGZjt6kFTCVP6hWE0wvmk/eE+FrAl+NGsOSE6IX8pq:Dh9/ULkjKxtTGP6VZd2rAcvOSE6Nq
- TLSH T14CA53303DF540D3BD5B79B76973FCB154E6A734528346C63B20D5C8E8BA47A288923B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 3448 processhacker-2.39-setup.tmp 4720 ProcessHacker.exe 5900 kprocesshacker.sys - Loads dropped DLL 12 IoCs
pid Process 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 42 IoCs
description ioc Process File opened for modification C:\Program Files\Process Hacker 2\plugins\HardwareDevices.dll processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\Updater.dll processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\WindowExplorer.dll processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\x86\is-DHCTO.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-B7IFK.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-BAI25.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\UserNotes.dll processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-UJB9L.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-SS1TA.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-0A2J5.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\x86\plugins\is-364TH.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-5MH23.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-KA8FT.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-M6TDV.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\x86\ProcessHacker.exe processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\unins000.dat processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-Q1PFI.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-RM653.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-363VO.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-EFQE9.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-M083L.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-SJ66G.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\ExtendedNotifications.dll processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\x86\plugins\DotNetTools.dll processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\ExtendedTools.dll processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-R2ARV.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-HIU4Q.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-6OGAK.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-7Q9F9.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\ProcessHacker.exe processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\ExtendedServices.dll processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\OnlineChecks.dll processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\ToolStatus.dll processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-A484M.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-JICGB.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\DotNetTools.dll processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\peview.exe processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\SbieSupport.dll processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\is-ECDL0.tmp processhacker-2.39-setup.tmp File created C:\Program Files\Process Hacker 2\plugins\is-UTF7D.tmp processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\unins000.dat processhacker-2.39-setup.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\NetworkTools.dll processhacker-2.39-setup.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ProcessHacker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ProcessHacker.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language processhacker-2.39-setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language processhacker-2.39-setup.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/3744-0-0x0000000000400000-0x000000000042B000-memory.dmp innosetup behavioral2/memory/3744-11-0x0000000000400000-0x000000000042B000-memory.dmp innosetup behavioral2/memory/3744-127-0x0000000000400000-0x000000000042B000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessHacker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ProcessHacker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3448 processhacker-2.39-setup.tmp 3448 processhacker-2.39-setup.tmp 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4720 ProcessHacker.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 808 Process not Found - Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 4720 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 4720 ProcessHacker.exe Token: 33 4720 ProcessHacker.exe Token: SeLoadDriverPrivilege 4720 ProcessHacker.exe Token: SeProfSingleProcessPrivilege 4720 ProcessHacker.exe Token: SeRestorePrivilege 4720 ProcessHacker.exe Token: SeShutdownPrivilege 4720 ProcessHacker.exe Token: SeTakeOwnershipPrivilege 4720 ProcessHacker.exe Token: SeDebugPrivilege 1156 taskmgr.exe Token: SeSystemProfilePrivilege 1156 taskmgr.exe Token: SeCreateGlobalPrivilege 1156 taskmgr.exe Token: 33 1156 taskmgr.exe Token: SeIncBasePriorityPrivilege 1156 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3448 processhacker-2.39-setup.tmp 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 4720 ProcessHacker.exe 1156 taskmgr.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 4720 ProcessHacker.exe 1156 taskmgr.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 4720 ProcessHacker.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1156 taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3744 wrote to memory of 3448 3744 processhacker-2.39-setup.exe 88 PID 3448 wrote to memory of 4720 3448 processhacker-2.39-setup.tmp 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\processhacker-2.39-setup.exe"C:\Users\Admin\AppData\Local\Temp\processhacker-2.39-setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\is-LG5E4.tmp\processhacker-2.39-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-LG5E4.tmp\processhacker-2.39-setup.tmp" /SL5="$5028C,1874675,150016,C:\Users\Admin\AppData\Local\Temp\processhacker-2.39-setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Program Files\Process Hacker 2\ProcessHacker.exe"C:\Program Files\Process Hacker 2\ProcessHacker.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4720
-
-
-
C:\Program Files\Process Hacker 2\kprocesshacker.sys"C:\Program Files\Process Hacker 2\kprocesshacker.sys"1⤵
- Executes dropped EXE
PID:5900
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1932
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Process Hacker 2\ProcessHacker.exe
- Size 1.6MB
- SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
- MD5 b365af317ae730a67c936f21432b9c71
- SHA1 a0bdfac3ce1880b32ff9b696458327ce352e3b1d
- SHA512 cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
- SSDEEP 24576:V7eokafnkAwgcU+29fR4PQviXq1pj3EDT5m+m8I:V6efnkdlUF92PGBOT3m8
- TLSH T10D857C5262E44098D2BBDE76C5629A22EAB13C061F34CADF4650F5792F33BE1DA3C711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\ProcessHacker.sig
- Size 64B
- SHA256 519c2c2ca0caf00db5b3eb2b79dfe42e6128161c13aeb4b4d8b86fbffc67e3d4
- MD5 2ccb4420d40893846e1f88a2e82834da
- SHA1 ef29efec7e3e0616948f9fe1fd016e43b6c971de
- SHA512 b2a000b33d4a9b2e886208fc78aeb3a986f7bd379fb6910da9f6577603aa6e8237cb552eabca70445f37b427419beeff0b061090cb952331b8db322ce2e58bc6
- TLSH T149A0220F8220C88B333080000C880880B30C00CA2300B020202BA802B82C0020E03320
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Process Hacker 2\kprocesshacker.sys
- Size 44KB
- SHA256 70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4
- MD5 1b5c3c458e31bede55145d0644e88d75
- SHA1 a21c84c6bf2e21d69fa06daaf19b4cc34b589347
- SHA512 0d7abcc792127c37d6af58ec5b900c1754d02913794fcf37d92c400d3a9eb8981f6aa5515e48fa8fc11ac0eb51c1da260d7defc0e60b21de70a4e58413c296fb
- SSDEEP 768:ZkCOeX2Yg5KY6VgQqdzfVJdf/aEB2zBdZp0IfKg589z1hEn:nzn68BaIfRn
- TLSH T1C5134A42C7551CC6EEBBCE3965E89627FF30B8468730C2EB1215C0159F62BE2A978356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\plugins\DotNetTools.dll
- Size 132KB
- SHA256 b4cc0280e2caa0335361172cb7d673f745defc78299ded808426ffbc2458e4d9
- MD5 b16ce8ba8e7f0ee83ec1d49f2d0af0a7
- SHA1 cdf17a7beb537853fae6214d028754ce98e2e860
- SHA512 32de59c95d1690f4221b236376e282c8be1bb7f5d567592b935dcd798b36b80e86da81741c5845fa280386f75f6eafc9bbd41035362984150b134d24aede61eb
- SSDEEP 3072:OkF+ncOyiGt9KQ130WlLJydacG3EkLLFjSeB:Oi+WH130U/
- TLSH T1E1D34B47B3E810ABE577CA7885A35A19DB713C661B71CB9F0354814A2F23BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\plugins\ExtendedNotifications.dll
- Size 140KB
- SHA256 61e8cd8de80a5c0d7ced280fe04ad8387a846a7bf2ee51bcbba96b971c7c1795
- MD5 be4dc4d2d1d05001ab0bb2bb8659bfad
- SHA1 c0ed9e375b447b61c07c0b00c93bb81c87bcfc2e
- SHA512 31389e268fe3bf1175fa3c251ca026f77dc59361b8425c9826f31d18c5174e6de68c6092aef187f2bd2c92d89b3093a660b2fe6189af369293c1117c856b5cdf
- SSDEEP 3072:ucUs2pkSTVRC6//SZDTWeEd1D6gyqAnr6rw8N9TZof:ua2zRC6ncXWl4
- TLSH T12AE36C5B73E4046BE5B78639D8634A06DB7378250A70DB9F039482961F23791BE3AF31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\plugins\ExtendedServices.dll
- Size 136KB
- SHA256 5ae7c0972fd4e4c4ae14c0103602ca854377fefcbccd86fa68cfc5a6d1f99f60
- MD5 4858bdb7731bf0b46b247a1f01f4a282
- SHA1 de2f9cbcec1e1fa891d9693fb3cadfdd4cfe1f60
- SHA512 41b39560e15d620733ca29dc37f55a939a653f99686ac86643ccc67fbb807ad95d1996b867319d98506f3b8a30772fff3c3317bbcc205987f48031923f674d9a
- SSDEEP 1536:cjYKbIeoRGwasSxZVqHa0fdZ5OiRJjHlcUhzD55DBdisWpZ9dl3K+OL/VfRc2:diLhZCdZ5bHHlcUz5PaNKxjVpc2
- TLSH T11FD3385763E905ABE5B24738C8734A15DB727C110B35CB9F0264C25E2F63B929E39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\plugins\ExtendedTools.dll
- Size 196KB
- SHA256 f2805e0f81513641a440f1a21057a664961c22192cb33fca3870362c8f872d87
- MD5 bc61e6fb02fbbfe16fb43cc9f4e949f1
- SHA1 307543fcef62c6f8c037e197703446fcb543424a
- SHA512 0bbfe53e1dd933a3080d9775ad890fcbd73f9820885efa6b69e9664261249f34eaae3870f74de8511734fc9a0114f36e1bfc529a032d303a8e3e583e37a506c6
- SSDEEP 3072:kahH9o/M+4BoraGA7sYt/zVcfg8Snh/3RFjxabZ67DG3p+DbR17LhY:P0MGraz/zRNh/3RU+72
- TLSH T116143A46A3E40056E977C678C9B34642F67338111B20DBDF066482BE5F37BD1BA39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\plugins\HardwareDevices.dll
- Size 180KB
- SHA256 acd49f2aa36d4efb9c4949e2d3cc2bd7aee384c2ced7aa9e66063da4150fcb00
- MD5 a46c8bb886e0b9290e5dbc6ca524d61f
- SHA1 cfc1b93dc894b27477fc760dfcfb944cb849cb48
- SHA512 5a4d2e0fa7a1a14bc4c94a0c144bfbfcef1ecabe4dc15f668605d27f37f531934778f53e7377bab0ff83531732dc15e9fc40b16f2d1f7e925429681bd5bdca73
- SSDEEP 3072:MTvTGn6NTm+vpcUVBrM9mG56i5O6wKPudbCWT08hQPpoM:M/G69bvucA56iA6EM
- TLSH T1C504095763E8006AF5BBCAB88A724506EB777C625B30DA5F0610912D5F33B82FD39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\plugins\NetworkTools.dll
- Size 134KB
- SHA256 476aa6af14dd0b268786e32543b9a6917a298d4d90e1015dac6fb2b522cf5d2e
- MD5 d6bed1d6fdbed480e32fdd2dd4c13352
- SHA1 544567d030a19e779629eed65d2334827dcda141
- SHA512 89362a7b675651f44649f0ea231f039e0b91aba9f84c91545f15e187c6cbd07bbf3648a4e232dfe5122cf5636e67c458f4f7dab49ed4de3f3a303aa396c41d1c
- SSDEEP 1536:mhhDibqaA8T+B++QWWEVGyEYfGup5oGjxNj8DsDdvsWch9dl/6RHyA8E0SHBZmA:ghGbA82+t6GLYfnoGjxp8e+ZB6RSALfr
- TLSH T1C0D36B17B3E4007BE5B68675D8A35A12D77378120B708B9F079486562F337A1AD3AF22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\plugins\OnlineChecks.dll
- Size 222KB
- SHA256 7336d66588bbcfea63351a2eb7c8d83bbd49b5d959ba56a94b1fe2e905a5b5de
- MD5 12c25fb356e51c3fd81d2d422a66be89
- SHA1 7cc763f8dc889a4ec463aaba38f6e6f65dbdbb8c
- SHA512 927d785d03c1ee44b5e784b35a09168978b652f37fb73a1a2eeecd3583c28595fb030e8c1f87ab9a20beac4622775777820d1a2ad7219ba8b9ae8b6fbc4568a0
- SSDEEP 3072:VDy7cjwTlCAlW0InMxf08ZyIjSNVnKJ3HzuoX7o+ThTPD0r7NF4jM9Td2xOdj+C9:Vu71TtInMxf08gI2HnKJDuG73JtxE
- TLSH T1B7246B54B2E50C78ED77C63AC9634542D6727C120764DB9F03A0425ADF2B7E1AA3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\plugins\SbieSupport.dll
- Size 95KB
- SHA256 57c56f7b312dc1f759e6ad039aac3f36ce5130d259eb9faad77239083398308b
- MD5 37cbfa73883e7e361d3fa67c16d0f003
- SHA1 ffa24756cdc37dfd24dc97ba7a42d0399e59960a
- SHA512 6e0bfab9ff44f580f302cabd06fc537a9e24432effd94b50ab696b35f57a61772072b7f9045a9e99fa4bf3bc316f43ea25ab6c87517242e7957eb86575203bed
- SSDEEP 1536:Im0GxwvasFsbgkc+kvtRSmgDzxdXsWZr9dlnVrUv0ukc:Im0hasFs8H+kvtRovrTxVrUv0vc
- TLSH T1ACA35B69A3E500AAF5728A74C8635E15E776F8121721CFAF0294428D2F637D19E3EF31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\plugins\ToolStatus.dll
- Size 243KB
- SHA256 5713d40dec146dbc819230daefe1b886fa6d6f6dbd619301bb8899562195cbab
- MD5 3788efff135f8b17a179d02334d505e6
- SHA1 d6c965ba09b626d7d157372756ea1ec52a43f6b7
- SHA512 215d6c3665323901d41ae5151908c4e084a04a1558617016f0788194304e066410b92943bd6c119339727037ee02cfda893b9baf5603b2870d9fc5ae0c77ca7e
- SSDEEP 3072:tOHhxKcNnCYBFNFAKIkpgVIgHAuopbQfhVV2aOQE6o0bp94wZOeb299zBw8:UHhrtaV3AuopMMeb21w8
- TLSH T133346C97B3A1089AD5668E75D4738A1287377C911E348B8F0698F52E3F773819C3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\plugins\Updater.dll
- Size 110KB
- SHA256 0c11cdc3765ffb53ba9707b6f99ec17ae4f7334578a935ba7bcbbc9c7bdeed2e
- MD5 6976b57c6391f54dbd2828a45ca81100
- SHA1 a8c312a56ede6f4852c34c316c01080762aa5498
- SHA512 54d8b39457f516d921bb907615ff60a46b6031e1444a443c9657e06d78c9fb0f637ae4756bb7b884e4dca2f55902372ad4ddba1d020abe02e0a381702ae270cc
- SSDEEP 3072:yy8QoSuThifQ0gUmL1lV51hdJFxZ9l1JtB9plRN51hdJFtVpRR5hJt0rsBLsGbOd:ZiYQ5UmBNerF
- TLSH T129B34A5763E4006BE5778A75C8631E05DB76B8621A31CB9F0254818E2F63BD19E3AF32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\plugins\UserNotes.dll
- Size 114KB
- SHA256 fc9d0d0482c63ab7f238bc157c3c0fed97951ccf2d2e45be45c06c426c72cb52
- MD5 e48c789c425f966f5e5ee3187934174f
- SHA1 96f85a86a56cbf55ebd547039eb1f8b0db9d9d8d
- SHA512 efdb42e4a1993ee6aa5c0c525bd58316d6c92fbc5cebbc3a66a26e2cf0c69fe68d19bc9313656ad1d38c4aef33131924684e226f88ef920e0e2cd607054a857c
- SSDEEP 1536:0fiz3P6ZDIigvpiwyXtHaGFKNQCf5FlvULnQDCdxNsW99dlhSkkOZ8DCuB8ViFw:3P6Z0iGNyd6Gi7f5/eQExdL1kY8DCurw
- TLSH T1BDB35A57A2A5007BE5B7D674C4A30E05EB7278611B309B9F036482892F637D1AD3EF71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Process Hacker 2\plugins\WindowExplorer.dll
- Size 133KB
- SHA256 282696487ea5dc781788d5d8477b977f72b7c70f201c2af0cfe7e1a9fd8d749a
- MD5 0e8d04159c075f0048b89270d22d2dbb
- SHA1 d0fa2367d329909b6c9efcb3cc2c2902d8cf9b22
- SHA512 56440f3feddc124574debfe3789e14d908982d4d8e9516f42fab7db7bcecdd3badd2f75e005016a7b9d87a00d5646b8df722bae8fba3932198babbe5335cf197
- SSDEEP 3072:FrcYzsiPpE70C5FwyJBId/GkWXaVJ32kZ8:Frc0s502FFnS8
- TLSH T1DDD34963A2E4007BE4728A75C9A34E09D7B2BC511761CB5F0754825E2F637D2AE39F32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-LG5E4.tmp\processhacker-2.39-setup.tmp
- Size 785KB
- SHA256 b10cf8cdf541ca0dd6df79e66fb4b0854dcac717aba034ba0c4961bff92fd021
- MD5 1c96ed29e0136825e06f037bf10b2419
- SHA1 b74a55279474253639bebf9c92f10f947145ff30
- SHA512 0e74854d9de4e3944b2cff9b5de7eb19fdec1fee6c9576cae6cd81741adf84eac421cb743b1df30183f645ffe849357b6a85b5be8d7f6e2efe289bbe4573e177
- SSDEEP 24576:rQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafMyx9CD:102rPD37zzH2A6SBIfNaf1s
- TLSH T136058D32F2A08837D1731F789D1B82D55936BE103E39A59736E91F0C4F796817A2B2D2
- MD5 SHA1 SHA512 SSDEEP TLSH