Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250619-en -
resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2025, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral2
Sample
2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe
Resource
win11-20250619-en
General
-
Target
2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe
-
Size
17.0MB
-
MD5
427915f92d6dfee464abcbe95899af89
-
SHA1
26d814129899cf6fb1e96145b8e04b84515fc33d
-
SHA256
0dacb1d51560612a2f24f0c64b40aabc49d9b9522a05a930df299b8f540af440
-
SHA512
7a0ce3b689d2cd75424073ea3fe19f4c2c6ccace1ae953c956d1c2506c58886277bfa1dc80cc62ec332bafb4b059e89b0acb9018ff3c36abc93c0eef3a3e5cb6
-
SSDEEP
49152:XYgph7GBfWSkph7GBfWBWcHPH90hOqZEDkYOMwwnMb4PmyVl:XX77GBfWz77GBfWBWC0RpYOXwnS4rVl
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@" 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ComputerDefaults.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\msra.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ROUTE.EXE_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\at.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\dcomcnfg.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\verifiergui.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\explorer.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\userinit.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\logman.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\sdchange.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wowreg32.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\fontdrvhost.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\runas.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\hh.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\hh.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\Fondue.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SecEdit.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\sfc.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\typeperf.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\cmdl32.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\grpconv.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\sdbinst.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\dccw.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\runonce.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\certutil.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\credwiz.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\diskperf.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mmgaserver.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\newdev.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\cmd.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\print.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\bthudtask.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\msfeedssync.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\openfiles.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\poqexec.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SyncHost.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\tasklist.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wlanext.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\elevation_service.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\msedge.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\133.0.3065.69\MicrosoftEdge_X64_133.0.3065.69.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\133.0.3065.69\MicrosoftEdge_X64_133.0.3065.69.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\7-Zip\7zFM.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\pwahelper.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\dotnet\dotnet.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\identity_helper.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\wpr.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.84_none_3e82ed1fe15c67db\r\rstrui.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_4ae21b160a9d5bb2\CameraSettingsUIHost.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseIR.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_aa284d65c7bee591\f\upnpcont.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.19041.1_none_65637d0d99e451f6\DeviceCensus.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.1_none_21244f0b33e2b22d\PerceptionSimulationInput.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\StartMenuExperienceHost.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\r\MusNotifyIcon.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1_none_987b063fd85ba334\memtest.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\Panther\setup.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\r\coredpussvr.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\wmpconfig.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15805.0_none_96edd00e05696409\vbc.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\coredpussvr.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1_none_fb337fa99fb8bc2f\BioIso.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.19041.1202_none_4f22e21b58d6c2e3\f\BitLockerDeviceEncryption.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.1_none_1fe438473a878c5c\TapiUnattend.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_39eaf2470cfe88f0\f\explorer.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-remoteposworker_31bf3856ad364e35_10.0.19041.1_none_d570c31a162768ba\RemotePosWorker.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.84_none_7c1f17a9e1beaf63\recdisc.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\f\wscadminui.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\djoin.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\r\ThumbnailExtractionHost.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_4.0.15805.0_none_faee98a3c711fae7\AddInProcess32.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\r\hvix64.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1_none_cbabe2205e65787b\runonce.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_686405dc140529cf\r\schtasks.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_9fd3a313935e2396\upnpcont.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.19041.746_none_cc5cbb9556301da3\WMPDMC.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\hvsimgr.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.746_none_38c6194376a6b88c\f\VSSVC.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\wevtutil.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.19041.1_none_112f38db81e24102\csvde.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.1_none_b3f4f49ac9993d28\SensorDataService.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_bf506ecc66a800df\poqexec.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.746_none_46f79836a0dc7206\Dism.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.1_none_95938c4a44e792de\ReAgentc.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_220320d2c4216035\TiWorker.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.19041.1_none_53219a572fef10a2\ctfmon.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_51facbaf4051768b\resmon.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_e40ca34e5de298c9\f\rasdial.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a\wowreg32.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\r\vmwp.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_f15a0c837b51c5fc\gpresult.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\iissetup.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_4621ad58d5f654dd\f\Robocopy.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.19041.1_none_3700bdc08c446a5c\AddInProcess32.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_jsc_b03f5f7f11d50a3a_4.0.15805.0_none_02d98290c2a0aa6b\jsc.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\f\agentactivationruntimestarter.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_c3054a007d804943\r\ChsIME.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.19041.1052_none_648fbf276da33ed4\r\NcsiUwpApp.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.1_none_18b14c7d1478d4cc\sethc.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1_none_36e57bfcb85e0850\SpatialAudioLicenseSrv.exe- 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe_ 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff599b21372dfe42a0f1bce4fa9421d5000000000200000000001066000000010000200000004cdc76ad7de14ec05730e7115b22df1d0b7ace2eb4e8e6fa7a4983117d93bf30000000000e800000000200002000000075e84718a90ce77c1cc94b7b9ee9b13832b2f7b04fe168c1578363b127bb7b4810000000548ef6b0f4a1c9e732c38f49a3526572400000005f449fdef0a4cd49a1a52630c26911741e9b30e0259ca8b672b5b6ce5b777d10ac949c950dc61ce38d3aaeabbfa6ce98842a3938dd2d181a7db1c1451ed07303 IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff599b21372dfe42a0f1bce4fa9421d500000000020000000000106600000001000020000000d3644d84ffa9c76a2f63ca54a37719d44ac725fbd4b4db3953121630c1d7a6a0000000000e800000000200002000000095ddc3410f386218eb9a768d257bc128d3782f8f7a4d06b498bcb7c50c57fa2a50000000a748743fdd08a133a0977e232c079e96a94c657ebefa1da2af1788576d7c6497c7442f64bd51cb89f7c84851a701b9793f10a3c3d4bba6ed0665b359c38a176abaa67fc54e28c4ec68b119df4d8114b4400000002066b86301b003d6b9b6c383182764f4b665cb16be5b340a301285fe83b7af7f35603cdf6c3a4d9cca36e8b9e25f56a8bea988e93e564df4b8cb5b39e81b6014 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\User Preferences IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff599b21372dfe42a0f1bce4fa9421d500000000020000000000106600000001000020000000067a75f0bade7600e5a3bd5ac762d5aebc22bd53977530954f7a906e21e2f41b000000000e800000000200002000000068ce645ef73eb645e40191c10b6df822aad2e72222e10dc23a57f75b65285fe61000000062ff78c3f5b3a24b4914b3b179a39a8640000000e5c44eeda090d3619f2ab56e4bb471caba0e9ee1a376cf269cebf0b6c453866ab9a62a51940d66ffb70f4a13baa170134d6c560e41893793f0f623c52dce8a33 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E4A2AADF-58CF-11F0-9B6E-5ED5395D997F} = "0" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 04e1a46c61e1db01 IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31190236" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31190236" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3110522722" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "458396011" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = 04e1a46c61e1db01 IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff599b21372dfe42a0f1bce4fa9421d500000000020000000000106600000001000020000000a92ebaefda676c3cf1f88b3f03cf4cfd50374ce163bcd74264df8f5eb3abfdf7000000000e8000000002000020000000f5cf0470a654ebb77198dca200e79cb0059f899522a6582889b4f6507c77f64620000000b1d2dee799cf063bc2efe1dd2bca8e42cede970198565944e065c2c8d2bbc644400000008a13a62bf9506fa8e3f31571745fb699b722715675df43d2e9d357d082423cee6c10a73c7d87db1c4466c7fab00e144dab280aeab8788b1f87d8eaef483fd798 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0770cbedcecdb01 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3111772701" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1039f2bddcecdb01 IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff599b21372dfe42a0f1bce4fa9421d5000000000200000000001066000000010000200000002147bd6711c293e91a3240266def873b3e3f177687b0a3767fff8fa8bd9a73d1000000000e800000000200002000000012b454777a0fd43af460831f603c2f1e0a99370245d4b54e8dcbe55136a24cf62000000025fda31e71e4fd8da126ff800a0fd79bd26618de86d4b806ade683151b9b09054000000045cfbe898ae8e4e2dcfc6d3eed5523b29f474860c48a17bfea156219260e49280066ae7e125249eb683b6ddecbffe4fd4a2be54c6d8c12c6bde28bd8f384b674 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff599b21372dfe42a0f1bce4fa9421d5000000000200000000001066000000010000200000006a694a5b253abb4e1de7c441b2c7c38f483183c2cb14c143a65e1f3d00250fd6000000000e8000000002000020000000825d7021e8aa1e1f5e86195818c8dc8d6b357b37642efa13482ee4916991bff450000000d8e6a370fea996bd8870e31badc31fc9516c40aaa558003bcddb6b9fe4ba37639258551175f089fd8e88427f22ea2f62ce9c353e904fcfc8a2daeee7ef46ba1a4ebe8dbf729c253045c925358a5e77b74000000043ae198978f1228bd77a305ce9d541ce6553b6d0c37a2779dca0789806868f37860c8fccfa8bc43a6a3a399ce2afb5bdb976834722dedcf39f6d0e91ae65cdec IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4097847965-469305640-2969917343-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4292 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4292 IEXPLORE.exe 4292 IEXPLORE.exe 3952 IEXPLORE.EXE 3952 IEXPLORE.EXE 3952 IEXPLORE.EXE 3952 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3964 wrote to memory of 4292 3964 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe 85 PID 3964 wrote to memory of 4292 3964 2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe 85 PID 4292 wrote to memory of 3952 4292 IEXPLORE.exe 86 PID 4292 wrote to memory of 3952 4292 IEXPLORE.exe 86 PID 4292 wrote to memory of 3952 4292 IEXPLORE.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2025-07-04_427915f92d6dfee464abcbe95899af89_amadey_blackenergy_elex_smoke-loader_stop.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4292 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ÔN@1⤵PID:372
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.5MB
MD5ccdca87540e56b27f2b104bb036662ff
SHA136d79e579770a2e4f619b4c09e635c5d48ff56d5
SHA256630f929545e8277fe3a65970a8ed8c6b8271e2c6446e23334e117fdcecf2c51d
SHA512636e01d3633c5f1abb0736acaab01e3a7a8f7dfe6c919750fab5cfffb85419432829464963af1a4c2f35458a7ab32d2913efdc8beacfdfd2f605cbf82fcf1a37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9F6005AF34C7906F717D420F892FD6D0
Filesize471B
MD5db3f2e41632254f91f7e5e41942d8ff0
SHA17da106440ca2f41c46abf0c425b49bbce80a1cfb
SHA256601e2bdca83d313ce5087a94b902e3a8237c1255e1221deeb40b3ae5c3a9d9d3
SHA5120cb09d9c84a09722a83150f24caf27cd72f873f77e765b45ac00b177c895f095d9126aafbba60aa3c54b2d3acbee104aa5d0ad1942aca4038586a2242528fbfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9F6005AF34C7906F717D420F892FD6D0
Filesize400B
MD5db4fc9104dd3122525ff2f8b01e8f98f
SHA1969b7c21da7425aea7c5f1eed16996c4f3feb59b
SHA256e9f8e3fb52d7f5dd91a39b9afb315f054eede800e273820d408822475bb43538
SHA5125b69cc0da387950f4ec6130bfc040511dd2564566d70561849a44c2f60aaaa4d826bb304d3788a773ebb250f9533cd37bb5325012202bd3e2cabd2436ed7d10f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
88KB
MD5002d5646771d31d1e7c57990cc020150
SHA1a28ec731f9106c252f313cca349a68ef94ee3de9
SHA2561e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
SHA512689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6