Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 03:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe
- Size 1.8MB
- Sample260629-ejapmady4k
- SHA256 3468bc8897363a4e77313e47669aaa3eb4efdbfbe60e883d671d8294efa8b479
- MD5 ad9150654bde34979a9e6a311ff23ef2
- SHA1 074c3cac3beee9809da451ccfa65455564ce7308
- SHA512 b230a2c937b41cd72b5ded001830e3ae8482e4cff93e3fefbfa8cf42a6b548302b36181e83916b8cce024effbbe7f9762b6654abc61a5d3255eae01195c0fb7b
- SSDEEP 49152:kQRHjW9IGyhPTppGpgwnRsUsLNiXicJFFRGNzj3:kQ49IGyhPTppGpgwnRw7wRGpj3
- TLSH T1AC85F10075D2C87ED57604F198F4D634AA79FC25B929096B63C83B6E1F703CE9A36923
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 3944 elevation_service.exe 572 elevation_service.exe 696 maintenanceservice.exe 2636 OSE.EXE 928 PerceptionSimulationService.exe 6076 perfhost.exe 2472 ReFsDedupSvc.exe 4648 SensorDataService.exe 3508 ssh-agent.exe 2236 AgentService.exe 4276 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5d4957a9a6e14f9.bin elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102406\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102406\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 1208 5872 WerFault.exe 88 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d13b3797b07dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032e084797b07dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba3197797b07dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000793acb797b07dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3944 elevation_service.exe 3944 elevation_service.exe 3944 elevation_service.exe 3944 elevation_service.exe 3944 elevation_service.exe 3944 elevation_service.exe 3944 elevation_service.exe 572 elevation_service.exe 572 elevation_service.exe 572 elevation_service.exe 572 elevation_service.exe 572 elevation_service.exe 572 elevation_service.exe 572 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5872 2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe Token: SeTakeOwnershipPrivilege 3944 elevation_service.exe Token: SeAssignPrimaryTokenPrivilege 2236 AgentService.exe Token: SeBackupPrivilege 2472 ReFsDedupSvc.exe Token: SeRestorePrivilege 2472 ReFsDedupSvc.exe Token: SeBackupPrivilege 2472 ReFsDedupSvc.exe Token: SeRestorePrivilege 2472 ReFsDedupSvc.exe Token: SeBackupPrivilege 2472 ReFsDedupSvc.exe Token: SeRestorePrivilege 2472 ReFsDedupSvc.exe Token: SeBackupPrivilege 2472 ReFsDedupSvc.exe Token: SeRestorePrivilege 2472 ReFsDedupSvc.exe Token: SeBackupPrivilege 2472 ReFsDedupSvc.exe Token: SeRestorePrivilege 2472 ReFsDedupSvc.exe Token: 33 4276 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4276 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4276 SearchIndexer.exe Token: SeDebugPrivilege 3944 elevation_service.exe Token: SeDebugPrivilege 572 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4276 wrote to memory of 1316 4276 SearchIndexer.exe 103 PID 4276 wrote to memory of 4676 4276 SearchIndexer.exe 104 PID 4276 wrote to memory of 1452 4276 SearchIndexer.exe 105 PID 4276 wrote to memory of 1648 4276 SearchIndexer.exe 106 PID 4276 wrote to memory of 2972 4276 SearchIndexer.exe 108 PID 4276 wrote to memory of 5616 4276 SearchIndexer.exe 109 PID 4276 wrote to memory of 2872 4276 SearchIndexer.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 4762⤵
- Program crash
PID:1208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5872 -ip 58721⤵PID:2676
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:572
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:696
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2636
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:928
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6076
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4648
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3508
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1316
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2894455325-857903158-4263030270-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2894455325-857903158-4263030270-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4676
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2836 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1452
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2908 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:1648
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:2972
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2908 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5616
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2836 2828 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2872
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 c86e31828b92bb729cf49aa49a097c0ee4c5c404833e8bcdbf9884772fde140a
- MD5 2dbd208abcef2057d98cc3ef7eb64197
- SHA1 a4235914e98fa133f9794dfb9ea8749eee49c414
- SHA512 edf1c863e142eb11c8294d2a63fb7dd745f2acecaf9bd36f833243b210ba13ac40e75c42edc3584407adb795a6ba2a5a1e25fa175dcbf53c304b1e6655adce73
- SSDEEP 49152:7b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnKLNiXicJFFRGNzj3:J3q6mjBx7wRGpj3
- TLSH T185D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 b4da5f6d453f87a4b1fd4dc013dd2e899255f8aee4879ef51d22d14da37bcfef
- MD5 c10a86913ed452cd40a0880875d7f637
- SHA1 bc80aa5cc0e62a0c2f27e9155c6e60fa21f8cab8
- SHA512 c0d15f5fb72ef1eb13f303b9bac865087f4e1f6931056c7f1cea091c69bb6b9f530602c48f33f341a7d5de7335c18ba4073fb0f62619634c7896ca7208f384ee
- SSDEEP 24576:NXYfDtczAt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YtcoLNiXicJFFRGNzj3
- TLSH T1E585012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 41ec86862eb465d2e0591c3845dd45518023b333c466914c9755b5d0a4012aea
- MD5 2d5f48865f6dba98821aa022728ae3e6
- SHA1 fb3986a5bb8d65c99971a506d0e8c3f331b311a5
- SHA512 f76e1e8da83dd4f597e4c2919b2914a52d96506b5ebbb005cb0602a69956713d6d85f184c415d21c5c9f997f01934add3dbd7dc37c51559eae9c6c48c2d27240
- SSDEEP 24576:x0Le5ji0hmxkrMp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xPji0AmwLNiXicJFFRGNzj3
- TLSH T15DA5AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 f2c55e25f43e8d12a7177f77e50115b8e170713b3cc3dd6772401cb1d435bf8c
- MD5 6df46a3fea3a59a471ca1bbc74cb7e65
- SHA1 70aa0e7822d504d0fba142eb939c042db48e30cf
- SHA512 651e6f277ae19e41aca10ca963e5036bafaffc90bfea12a6f9388ef4ef68101980d005e63f8cb7925eaf31721b0b3fe238baeea4972726b566e947bacd6df763
- SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWj6q8wyuf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:d/ezSC6vUzPv+HjycLNiXicJFFRGNzj3
- TLSH T153756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 1b39d052dfabc8926a5e30bff1e07085a346e52a6dc8d0821efdba926f819f97
- MD5 7731ea0afe73ace0e62401acbff08e57
- SHA1 5f2d1933a50f9ca4cf6531c3aeda39cf9088ba72
- SHA512 268752fd31925e21632287ea94aa3c497c4c68ec8aa7ec757e8a56e8f1981183745bcd00cf568468ca21396be627bf251c00c1f15b17c10b9adb263ae03b6dd9
- SSDEEP 24576:bVbqPb88hv/l+BC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bVO88hXl+QLNiXicJFFRGNzj3
- TLSH T11F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.5MB
- SHA256 91139adb299c04b63f9193d246ec27f90257b2fcb08eefd2dbb08769d8127658
- MD5 4f1c8ee75219f541607d3a95053dc5b8
- SHA1 eb509b3572eff5a76e899f5a1fafd7d5b227c96f
- SHA512 f241e1796ca31b88b7245d942a4718fa0a7837283ddb9104845581751b8134f9f32032821795ddc378c1a43c617528cd8b4a8362a55b91922daf5526bcc3c72a
- SSDEEP 24576:pkN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MLNiXicJFFRGNzj3
- TLSH T1DA7523D3468855B1FBFD0039867A5828B6845E2C8A595DE3D2543E5EA13CFEBCF38123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.7MB
- SHA256 a84c8757105b1fcc6f7a588f586cd8c0cf3bbf8a4e21f1cbb9b14bd027190a9d
- MD5 e3d8a7d6fd8642089a85078b3fdac603
- SHA1 c608d3a41e00aaeab433571093bd84348534265e
- SHA512 9e5dc32ea9d553f93e9e5d30017d80580d1405a92b4385fed4496cd27511cac28f97c20039f435b0bee2d5ec8525af931f572cb220ed77061c23a36a4eea3ebd
- SSDEEP 24576:HJIUq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HJIUqLNiXicJFFRGNzj3
- TLSH T16B85CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 77d25c9f99343396290177ffdcc2569259a1063acc19419dbf57a2beda4981df
- MD5 2d7b9e68a04723ecb40d1a89feb39a09
- SHA1 d2edc445c2d9d9f9707ec786aa1b9a51f2126499
- SHA512 6fa4671b76cabea8292d267e6711a97eb69a929256420e1a51a2554b7f70518d9537c75d208aa204e8bdf6f8a513d4c9ed2e1eb58637e327dc5cdd0dc3214637
- SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THE:UQvGAdlCEL8c/WRNw5Cv7wRGpj3
- TLSH T195266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 5f92420fb3df1ef1881463d922c23b3c61093d5a155965ba5eb4e41b06f49ffb
- MD5 1169e96e4cfc9d02dd052d6ad059d0e7
- SHA1 e5cb5ce754f96e9e883faa28a1a89fad55dd0a57
- SHA512 5568db7a7587d658524616d58fd81fb497eb92d76f7ca117e7982525b9dab29c37118e475300cc1020ed1a18482c0f40c4656ef2b41a1cb57e57380fa732351a
- SSDEEP 24576:dAewsAjA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WljALNiXicJFFRGNzj3
- TLSH T16A95E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 6c71aeef7904ddfc3e7b72e7e30da623dd874743d66153dd138d8304b6679bfa
- MD5 343f1289b39cde4348e841ec2e72218e
- SHA1 99b9c04c58cff3a88c84493621b385c79718da57
- SHA512 ac0d8dca55b836e29f423b874182536d8fc6533c5794f6d6acdaa1fc22aaa49129ae412711856af93748234bbba61d191eeda0709f40815fd2e8be6bf5e7ac2b
- SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHEF9:YUEtQevvqc2W1cpV20I32Y9
- TLSH T17B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 90932e01ff2633b7fd5ac61bf7e2cad7477f9e862ae4436dfbfc449c01aa646a
- MD5 ef694817f5c357b3d712b6e6888e96ff
- SHA1 e4b3c5485ca8927567b1ec179d526a48c5077299
- SHA512 846191a2b7a605c98fdca16716022d2ae0002ef21033654544bd31c0feb9730665e983d4ddae17a398f2cd238ce564ec2f0c3feb776282488dd25cb329f6b841
- SSDEEP 49152:sCbRquA/m2yL5zLfFiV+XenmE3/zgLNiXicJFFRGNzj3:Foq2Vjnmr7wRGpj3
- TLSH T1DFD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 d5e98524d25d533305fa6325beb34c84a2d41abcee2ded69594e83a238612cd5
- MD5 fe96460ccf29355fb407573ee2392794
- SHA1 52df7c83fe4f65f494446d6b9e6c9509c0dc7037
- SHA512 b12b45f8647337b80c8d22832f7639a9c9ccc3802a25a2d77922fec301e5d43703f8b81ff650d78133c890a7a0f9c0e51768a6041b175151f5882c2bf5533eed
- SSDEEP 24576:WAhGL6IFoiwtA5l7S53L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WAM5Foiq57LNiXicJFFRGNzj3
- TLSH T16D359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 f4d2d2c60918488e05157cb3fbcfc8d41fd4af1ca3a0d032ab5bfc9f529b4ce6
- MD5 42d88663d2578f0942fbc66f7e2b96e4
- SHA1 7af229523a2fddd6e60251f926c2abfdc35eff01
- SHA512 0c76fd5ae4235eb7b448ab73341c08e3c5924b1ea8d36577e0e9b17dd7ecef1997102d99d16c4452863da6c1154747acd8d5da5d150673b9eb9e22b4cfa7bb7a
- SSDEEP 24576:4wu4OW8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4wLOnLNiXicJFFRGNzj3
- TLSH T1F185F08632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.6MB
- SHA256 af8f255d73a2bbb21c628b85cfe368d2fecdb026f3721363d0dbcecdc57fed2b
- MD5 0443668c885e2e20807ed1a0d8bfffa0
- SHA1 8e0b17b248bd14edca828cde0f576f52240e19c7
- SHA512 66bd88f7f74a42b10cd8729faf5889ae0ca21cd80156f9fe8180231b13a94ca9e215061ba5c62b3c5812f24a40e2dc9bdab426dbd1b935303afd64351dd871ba
- SSDEEP 24576:LZux/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MLNiXicJFFRGNzj3
- TLSH T18A75129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 63e85cb0f19d62eebe0154a18047679d426de5f0d0e16a8e442da984327fef6a
- MD5 ca4643cf5f1080f721063519caa6f7aa
- SHA1 0416ff8a96d89107beba812ca2da3710fd67a129
- SHA512 0590663181aea19827408c7f5c9ef2ee7043fb90826f7c189010dbd8e7eb2aa421de804f82f31d7d56fa7eac2fcfbb53dd836cf645b28cd410883effe07caad7
- SSDEEP 98304:1QRQyi36YOcPDLvw2gAf+PN3W7wRGpj3:MQyiKanX+PNqF9
- TLSH T1E3667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 fcb147c81afd46bad111e464cb7d33687a649dac49d1a684780693a84db19048
- MD5 58d3cdd8e39917bedd16a0cde717794b
- SHA1 68e7cd96f69d4e2320ec4153476e746306a73fc3
- SHA512 66e3ae7d4653b584cd131ebe19dd0435378ff6e7b3e1048c87cf11112752c39d6a5a21f373ab26d6d101aeffa5a454fa545fa309c16335c15a220eba17955720
- SSDEEP 98304:UQRQyi36YOcPDLvw2gAf+PN3W7wRGpj3:7QyiKanX+PNqF9
- TLSH T187667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 04d9a244b339cae6e99e941b38eadca446b6fea8dcdba885bf8d98619d5cd091
- MD5 371b8d946a841714311eb9f854aa4fc9
- SHA1 6ba873b720ecc195b4c145a8107bb57241e9d3e1
- SHA512 d188fae1b003b40530f936d17ae46f16101c4b27d341655093944a42984032e1ba524e2b90fc6e23c3baab9243278ea4fae74b75f39a531f2bdf7ae05ea36a82
- SSDEEP 49152:Z68Qg55nhkeWu7PNU3/wLNiXicJFFRGNzj3:nthTRc/w7wRGpj3
- TLSH T106B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 a85b69901c29f8116e95cd49c1fe442eec7e1aa8df2506a03c1f77dabfe2b9b6
- MD5 12b72ab03604f5ac84c2c3ca0762e51d
- SHA1 c2e21b314a6cae2fdf6272be0a308cc9abfa3970
- SHA512 b2aef70787a2462ba8d811c5e79a74b3f0984708bc0b29c5983b5c8364f39e75879cac589757efa9673a6e9a09a6ff515bec7fc9c136bfda90fc7bf4f6c28df2
- SSDEEP 98304:ny5112gYy5azzVvU69nLKnhZN7wRGpj3:6LIHRWh3F9
- TLSH T13B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 fabb3045f1916140b30eaa7fa79531e4af9790800a53d927d4bc665c63f49742
- MD5 bfe1768fd574b4bb9c979b5fa454dd38
- SHA1 bab132b4a8a482b7f2470d8986349683df7a66fb
- SHA512 e31700074e1247139c78a2f2cd84e40dcfa4f360fb818c6a172fe5ebe3e4c3a693347a0683b23cc7a1c8156d8e6b1f812cf11e435f71621e7501767870a6d242
- SSDEEP 49152:tB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl9LNiXicJFFRGNzj3:zu6JmIxd2d97wRGpj3
- TLSH T16ED59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 e1784643939359620067eb45971c8b3b296e1b2c9e5b6c35e9653da02715a508
- MD5 278df7858f806cf3d54504420622557c
- SHA1 97e446514e2c04a0cbd53dbfaa5db0558b636f51
- SHA512 7be2ad53d42de4011f6e5d701411ae548399caa3953c11b17c0caebba0cc67f55e96dedb894594ce73e99ebe21fa8c20e7e4d388266d9057fa03ae1f86ce43d8
- SSDEEP 49152:31hpsNoJpF1A67U44CwH7R4xKLNiXicJFFRGNzj3:3mifPqRr7wRGpj3
- TLSH T1DDB5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 3119998ae2c62aadfa1fcda3388fc9b40d6209851f983f53b9c52f56d049767f
- MD5 d2f867768ddeb341a31580927bf61bad
- SHA1 e47c3e6dadef821743623896dd1f9508d5c608a0
- SHA512 b6766e44831efd9a11f7d1c6198bb2237dc72df970681ccd1abd43624c9efbd0f9820538ca2c89b6de944470ca8b8cf1a6f5ba3d499125cea9c462e12aad6e19
- SSDEEP 49152:eSuZQIY0Be2KkRVtOnks6NMHqxLNiXicJFFRGNzj3:w5dKqi61x7wRGpj3
- TLSH T1D1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 cf682cf2310f8751ecda3f6fa63b2d4afed2680a4d0d35ecfe75ffb8475af0dd
- MD5 f4504f62ec696b0bd1a67a42305e104c
- SHA1 d8daf646ce63abd42a1b2d7dd4f80ecd0df9bb39
- SHA512 8fa7bf5b7213ab7b653f8ac098ff211afb00b970c95bd8cc7a5a27276d18a737790bb2bbafbae66e1433c1967ebe54f226e19b82f01d18d9ab3e2f6e73c61f19
- SSDEEP 49152:bhtSn8EApI0figjgiDn0AP5wOLNiXicJFFRGNzj3:6X2iWphH7wRGpj3
- TLSH T15695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.5MB
- SHA256 9198a922dca872a1b01a273f32dcd6daaea9097b80c362c4e2045b66e18e9a30
- MD5 845140699facf68d4c8ee2b536ee31fc
- SHA1 f014bb7492587aba9caf1b4d7f0713260ec3cfa5
- SHA512 041c6074853881c17b18f9f1fcad8b5dded7da98264cd0cc4d3cdeab66abb41d4f7d86fcd3d96bced7fbcdfec321722d3ce35fcce7ede427be50a807bb5243c3
- SSDEEP 12288:XpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T14E7523D3558955B1FAFC0039C6754428F5882E2DDB5618E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.5MB
- SHA256 6128a8a6afbb73677876a75429c6c71a136f18414c7a2df9142ff95beaf9696c
- MD5 ce2188e872bec406ba755109bae6cdb1
- SHA1 978c92bf3bf91463274bc661904ac02929d8b3b5
- SHA512 b536b27a1abb5608bc751f0e27669d47a9ccb0de1b5dfcdac9d3b52b5445293f35e10bc3ee6d234d6c2c6856dafbd9fb905e385504722c755878b9fb1c7a3589
- SSDEEP 12288:QSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1BB7523D3548955B1FAFC003986754428F5882E2DEB5658E3E3483D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.5MB
- SHA256 a2c08eb852d2fc068e8af98b203fe4a3eb8252435156c1a076327445ac734598
- MD5 c31d2e29ff41112c0dbc1c4be33aaaca
- SHA1 f2a9a114950d58ebd56b05c3b3ecb535ce63ccd8
- SHA512 71a481dd328a9d3727b16d3fb83d982d9480759aab6ea5bcaee310d9ccd217993135ac2a2ed1020fd30c40a7cd83c1acc6d0abd6b6da11163f92fb82dcc02fa6
- SSDEEP 12288:AgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ay/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1227523D3548955B1FAFC003986764428F5881E2DEB5658E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 70d82ebf75af66ac7455bc468cb3bd393aecf9876da2c44445d61ccce02fabec
- MD5 64f710318f0d7f6742bb020e224a5105
- SHA1 8162849722f277c3680c11f8eb5d4fb722fda207
- SHA512 61d43a26ef69f1131e56bc003a18c8e086ca8b85e419cdc1f978eafef2544f2d2958c0f6f17c21d5c6b58e9b77e748cd49d3ee6cd3868ea8a780631e731cdac2
- SSDEEP 12288:vVfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T159752392168900F1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A74FDA9F38A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.5MB
- SHA256 7c8001f165600af9459e6198025254f01a87871a9bf6bfd5fdbb83443b19e48a
- MD5 49b1d32be27aaef698f7dd0b548f008a
- SHA1 c80c9e2e0e1224196697d39c8ed349532b535a42
- SHA512 83e1e3f413b173459af532254654f8c327d333629b2d3bb42c0deed0aad692abda9ec96346a70c4fbaf2dee152ce15497d0c5766f789fc66bcc0e6e3fd3d5fa6
- SSDEEP 12288:xXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T19F7523D3548955B1FAFC003986764428F5881E2DDB5618E3E3483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.5MB
- SHA256 ca9aff489308297f08aad7c835787ddd624717ebb5f73821dfd8da1560fbbd7c
- MD5 adbfcc65249e1b2dab5551623d5c65f8
- SHA1 aae4fd93b8e6f945ec07d7e690929dcf6e9dd450
- SHA512 6e18e05ffb97427ea321a39daa806c29b1f08b29ac2164d723a3372f358863887dce1285df3888a555e8775a49a08318b7f36e539b8cedad545b9a49e6b402cc
- SSDEEP 12288:3eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1387523D3548945B1FABC003986754428F5882E2DEB5618E3E3483D1EE278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.5MB
- SHA256 a4c5836ea61bdbaff3ac0cf964553bce14d693babd0e608023f186b6ae940c79
- MD5 4bd18130aec60cb4bfa0cc82f9f98d35
- SHA1 f89ebfbc18803c243c7a0a5fe1dbc4670e84bcf2
- SHA512 e0db0a3eeb67205148bcb16caf2e901bf2bafb2e2a9b6ea41c5199274a45c1b651dfb62d1172043bcde5c1c6d7117e4d6777486d63e198803b734bb2b0bb4f6e
- SSDEEP 12288:QqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1A07523D3548955B1FAFC003986754428F5882E2DDB5659E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.7MB
- SHA256 81e33a2d917ad96534c1b5e060e10d77279ccbfad05a4c90a06e0172561fb226
- MD5 0326bab2f50e47536658960f2cc01929
- SHA1 22f69de135fb683ecad9b6e1c6dd1ca80d9e9c74
- SHA512 656f4efe8a1ec9743fb7cde8b07effc38e91079febf685cbbeacab54a96c6667056953c75a14bb59ea5d0cefefc23a33c4c69bedbc5ad96a886de8a80f3ea1b6
- SSDEEP 24576:mZM0zFVSOU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mZM0zf4LNiXicJFFRGNzj3
- TLSH T16B850295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.5MB
- SHA256 b2afb2517bda0cedb805833871f7bb5d9d6cc7e29cd91c803c19703ad838bc82
- MD5 5ee7407d576e82dcf0314547eb51a353
- SHA1 ea19f4238eb4b88a05fc792717c627ae9223b3d6
- SHA512 8f20ed34b02678ca36b43368e067d9317323a930bdfe202d258b84af66698eab557d402f0b052282507377fc53eccc883135f606b3be29f1f57e0a61996457fd
- SSDEEP 12288:LdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1417523D3548955B1FAFC003D86754428F5882E2DEB5659E3E3483D1EA238FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.5MB
- SHA256 70be73d2f8e6aec7877098adca438d0ff4f268dd2671912397f58f47e1648042
- MD5 5545e1fddf0edee2b9a15610c057a28c
- SHA1 3e53070bff8af3132fe90cbc8955064e116fcdf7
- SHA512 5d41b4efe46e69a4182f9b2d259ccb2afaf2bb0b081e69b15d596035ef0bbbddf424786490c9db23535b458b0823a12223b3b04103f853e23088416dd2c5ab22
- SSDEEP 12288:nRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T10C7523D3548955B1FABC003986754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 4613ba788cba50c733e787c0f04960b4f7225393a578a34a8e7331f5fb51e2a7
- MD5 9d234c73f90a18aeeddf691be7d57fa5
- SHA1 de5c23231fc4aec630dda811680487e55f4fb6d8
- SHA512 c0e59a9823bad1c808fc63f3ebc82458abcbb3752e8d94aae00145ffaf6746532db66ed9f64c8faec9b676f9c98f61c25adffea2c69e6a173e0c41272bfcb61a
- SSDEEP 24576:czyQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cHLNiXicJFFRGNzj3
- TLSH T1EA750247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.5MB
- SHA256 4a95f83b3cddddea1a3e7548c5fed1aba6c29144b92e2cfa9aa04b4e9ffdda67
- MD5 13f037e5d4a978eba69007f4287f87ea
- SHA1 96f5c21185317a71cd3786d13de0f2af38a498cb
- SHA512 092471a21aafba571e08117786d1355fadafda8d5ca78a585c11afb956ed6d1e3e6785ec73ed593afe9382f74b34de32f6a29bf227c8f6d3102f0a08207d6f4d
- SSDEEP 12288:wdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1137523D3548955B1FAFC003986754428F5882E2DEB5619E3E3483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.5MB
- SHA256 0c808f98aca7a95a1a98b5062a360bb43eb681b87a987b143d9884fa4516f004
- MD5 3736b7b6936c0de979a8762d10101448
- SHA1 06cca271bf78fdd69a3b946a61dcd2bd1e000dfc
- SHA512 ae2153af9282b969d821971df2a1c63d74ba0b4012f98085cde00f01cb6a765e8fad71af544bf89e9253199d20f696633801e048047b869ccff0b3b67bf01023
- SSDEEP 12288:jdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1567523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.6MB
- SHA256 e7f0a718f2c93362c40fc556a6384c3d37a0d020354dd11fe1abda5a1a4e947e
- MD5 0746d11630177cc0be67d3a2dfe62b44
- SHA1 98326c4e8346322a6cc5b7eee1fdbe74ae7380b9
- SHA512 d703fa2e0e27b5975bef652d153fdb7566c1df93b2e7fd78255ed263881158501a175bee6a7c956d17b49ab140fe3089796f74b55ef27480ac962fb332b7e43f
- SSDEEP 24576:ZzyQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZHLNiXicJFFRGNzj3
- TLSH T18C750247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.7MB
- SHA256 08270d2612d7e7a768dc9d41b48633c71f25e6621a6149881e966f0d1b7fc4cd
- MD5 770da8e38bd116b1fbde6a3e2e19945f
- SHA1 01904cc3452e219428f7d7f55218f7503847c3f4
- SHA512 1eda53ef8eb876133c4fa9ae6207097231a4df398806615563b34666bae24499de6802b4dbe7b52ee66d8fe619e8c62c7067b55dc116f3a90d73bc8c717ab02b
- SSDEEP 24576:3TBaLl3z0zDi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3TcLljfLNiXicJFFRGNzj3
- TLSH T15C8502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.9MB
- SHA256 f2adc221346f0f942af069ae0a011d267447fa3d18568a983d1c260fc1f03fc0
- MD5 e2eee6ba870a9212d2028dc31e1b6816
- SHA1 dbd52e508bfc3749392edf4d36c85597864cbb5c
- SHA512 099c2a01d866567d3c85c4be012acc3fa3b914079e5270fa3857fe889d5503a02bb56a30b35d94786d93d060c2a7790e6a87a7672a4c6e1f722e775d6a0d2f03
- SSDEEP 24576:53Rd9CHKy7GZ2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JRd9CHKya4LNiXicJFFRGNzj3
- TLSH T1CD95CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.5MB
- SHA256 62531e9231b46a368bf0173e019d510690c18e1cfc5d7570437e41a502fec264
- MD5 0800d28c59d71e24c9ef936d37601d33
- SHA1 253b195f661404285fb5a53ce0279fc40b168f3c
- SHA512 fa0e1efaba427426c59105f567ac4e126322241bd25d5b6380886a16f10f0d3ee072c9c30d68f6e49198ddefce9fe8cfd1c196effee1dd20ef80402d22672e1f
- SSDEEP 12288:1AiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1857523D3548955B1FAFC0039C6764428F5882E2DDB5658E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.5MB
- SHA256 30825ea4d67885033760e27492c35406f1bdc6faa18fb83e590c86b19feb169c
- MD5 98390ac55172857ffaa68613f67435b9
- SHA1 a4c2a3eec93c4b05b5a6f9192036094f55f61454
- SHA512 ead1cfdac8ee60c9b64478ddda994b0cd2959cb067330e732e900deeef40b85829049cf4504512cf692c44c0f3c244d23c96be2ea8a1b5cf720fb46dc7356eb4
- SSDEEP 12288:4GiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4w/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1037523D2558945B1FAFC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.5MB
- SHA256 d8cb40f841da2a4ade1ec47b8945ca9c7b212bce3c6b15feb6755abb01a1a9ed
- MD5 378d7c0b7b97beddc47ab24bd3ac48dd
- SHA1 fad353da2a03d0e4a3f419e1da3af3832b6c6ef7
- SHA512 c76236a85d2149db52d416a28eb9f9a9cd222d9ea429d51e4e99334d9293c7ffefd74884236d7d06cd8604dc3420309626ac183be0a6e83459e29a54a848a8e2
- SSDEEP 12288:IjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1D17523D3548955B1FAFC003986754428F5882E2DEB5658E3E2483D1EA27CFEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.5MB
- SHA256 f245a6b7c506bc2fcfbf30091e78eef25fc49122b4280bbdafa0947f35ccf53e
- MD5 2062d22d88bb97e8c243c5f43eef21e8
- SHA1 3d61c89a7caffe7e4c2eb7b53cf0a89779c37fac
- SHA512 0be1a79414de59dd9773aeadda03470c6a8119c5d584997dc5be556f24f1d26ab32fc750743c286800bb3ff12e62ad3aa388c31a7e095ce71c15a19c3d72087d
- SSDEEP 12288:WdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1D77523D3548955B1FAFC003D86754428F5882E2DEB5659E3E2483D1EE238FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.5MB
- SHA256 c4488973c3554b4dd824e6f98f65b2b6876e518172e1b4ec64da451b45d96fe8
- MD5 1ecd852c7e42737f5e7cc0232adfd1dc
- SHA1 dd4508bdedc6705986611c89c07c27141342363f
- SHA512 dd697d9125822f0f5dd4c5ed4a74f036b19fe2af5f9a0955ebf88ce46e30c3e1e74be00f486eda4098f805f55f60945b74f9e4e3ed9b2e0900da0444948b8a35
- SSDEEP 12288:GAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1877523D3548955B1FAFC003986764428F5882E2DDB5658E3E3483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.5MB
- SHA256 429a6eb554c8740caa90ec71ab2fcdfa6e147cba159c68629b1c29ead1ca5fc7
- MD5 59b47e9c3234ef41759ecb1f3ce51c63
- SHA1 f153b57a6f5ee28b4ca961c8e6c163e8e31e08bb
- SHA512 0bb6ac3fc23b66b17b67d017127eab968cfa9bc1cbd95ed710b3cc4d0553fcbd98c7560d7ac7ba53c9c504f1cb98aab9c48e8284c60bbb0595fd9e853d75c9ae
- SSDEEP 12288:i1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1157523D3548945B1FAFC0039C6764428F5882E2DE75659E3E3083D1EA278FEB8F38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.5MB
- SHA256 3ee961411985b9edc7bdd495cb9f67ce0a4e6caeeb4ecf74b1c7134ff894b262
- MD5 1ca23a4798503dd6c1d2cfd2b83447ee
- SHA1 9563669d064eaf5930b952131b2213199dc29a15
- SHA512 fd695ea45a821c485992689a0f45181ae63da104355d56644bc592a05db8f2372813db81c15a9b6e631123613a49b0b45b3d2fcd9fd9bf359673637ec16fbad2
- SSDEEP 12288:DXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1357523D3548955B1FAFC0039C6764428F5882E2DDB5658E3E3483D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.9MB
- SHA256 247de04ff1b02c1e31bf1c32675c949c0ce1da085db7145718669b14b5870efd
- MD5 0de9ee26582bb11742c01993b3b64324
- SHA1 311ddf1178b7a67c54b11f7e5f3743e1ab4c0e32
- SHA512 e65c7797c5d75094ed9052e3fda55b9332ffe1cfd23bd7693fa0686dfb416f28d4b9b153dd1027cd36455293295af305d213200df7e4b9bbf2bb9ffdc83b2bbf
- SSDEEP 24576:2fwvak9RX6wkyAIt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oMnYItLNiXicJFFRGNzj3
- TLSH T18695DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 a5c6e48801c3e3e1d34066a3cdd7dda44909070de4724d29d58a681ab3e13063
- MD5 a62fa2152b1c0b8a9caae10f537c7747
- SHA1 440db50f2e5ae74fd821ba65daf13f64fab5e3d9
- SHA512 25d90c5c8386c2eb5c7d2c0738037ca699f8ad51b6dae545c0650a9f4fba1a3421d8921ff961e34b586fb45e2631efb0cc0b0c51fe2b6452266ed3d6e81d7507
- SSDEEP 49152:GYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uLNiXicJFFRGN:JySzP27wRGpj3
- TLSH T110066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 e65fc73ac94994ad3585cb2f9b284a9b7f77cb5c4fc60d949252ff898169227a
- MD5 ceb2120d98b1095760af675716010e23
- SHA1 8f2045593367f8a9d9e66126a85f1988c950d225
- SHA512 52bc926e400e02610776b0c64c70e97086fb27868cef97681d07ffde790c76b1d846f7e7522283e8767eb2e41b9895c3c244340d114c974cfb6e864568c993c1
- SSDEEP 24576:m47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m47JUQjqirIhCnDHUPfF/+LNiXicJFFS
- TLSH T1E565AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 7e8c3e06bdcf63e98a8fdb841e41a39ed167b7b1d0dcd17b88ba54b5c4fea60e
- MD5 752c9fa5e745dd3f091b4b019cc25e0b
- SHA1 494986668a406e8a023f003c27619b4cabb3881c
- SHA512 8046f90b246fcaa450586d929f4716ec1a8d9339abf1429000104239ce14199d2998d760325cd17ff91d97498297f71da49da5d80128828433838c63bcc9c6be
- SSDEEP 12288:disftiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T19375F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 dd755c80c01118547291682352149e5233c6b41efcec7488bf5ac63bb79f39ea
- MD5 4b6e367cc9ea0f62c3b673b7a906002e
- SHA1 ac5199f4a645fba749600500fbbb7f943e2c22a4
- SHA512 c1804775b2cc69fdede2aea43853ed7867b35ccb5d4a9e27a5c945a997bd1d78f3d366803ea52bf4ed2eae89733bc55de78613b66ea78e342ba63512e296c763
- SSDEEP 12288:aE+3QRxoU3f/M3LVE60Uio6Xe6MgOLHFPqQ5wuwXBjfpUd:aE+3QgUPE3YGggHFPTm1XBjfud
- TLSH T14B4517007626D78FC6A940725E32D6CCAB707C41EE489F0373C9873FD476659BAE6282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.3MB
- SHA256 768db1f0b96354d017e8abb767dab4dddf5098c31c1aeaf8fdc919a3036bf5f7
- MD5 9bef6c099f639f72a22a0805b3798499
- SHA1 ec535d12b15bb400353be7efe8bd5c3fefb1adcc
- SHA512 71f54e12e2412c25b6a003892d537f17532896809d4d812f2d52c0e3a8c52542d6e62a1bd562b7a1d10c2d0feaf9a13a90da87b35bb4a2da1c93d270605d3060
- SSDEEP 24576:P9eRXsUFE2zwQkwah42WZ5sixANjHlXcyjoi:c5sUFE2zwQkwB5sixAhFXH
- TLSH T1D8552A00A5B7E35FCD7A50774632C68DBB786C06B7852F017344893C9863A5EB6EA3D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.5MB
- SHA256 301a078716a1e2313e45c1b04abadfb6e0f90b71886bc3b8de59477ac3f8b108
- MD5 bdb613f4144e39d6495ea16d25850b0f
- SHA1 77561bd1fba614b3baf135a8cf8c4c684c6b68cf
- SHA512 b1e8996fb7707ea4e5b83d931449a927ca78216c420904ec7a44ef4b6a8c5594ef290d57c23877d1920824509c865ad1edd61533cf594ec24af259b3af839e13
- SSDEEP 12288:W77FiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1D4752393468C59B1FAFD1039857A8434B5497E2C9F1598E3E2043A5EA238FDBCF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 327048ada6fab49ba9c9617d992dbb5b4240f0143e46a516ec93db6bbbb54e27
- MD5 776f491679ad177fffd73eed12eae4ca
- SHA1 a8eb029c1374c750dbffe6361e3cb901b0348e47
- SHA512 c6528c2822d73ed4b867b94e8feefceaf726ce9dae65a2c99e3f27062e8708264c0590b6fb645176d402fe74edbd891a0c554592b7baf3d8c7f8aa08631ad005
- SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Hgb4mBIBhGFkLNiXicJFFRGNzj3
- TLSH T14E65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 7cdd0f2870d5e4f94a0617caa60946789a8fa6f41b5cd44b12a374d60dd780dd
- MD5 0236fff9bfccb9c94ecf3e6f032ef184
- SHA1 2bb1551a1a2ba924fa32c2930d20f56e2aeccf28
- SHA512 3eeba316ace0a0d704d193a5789393ac2edd733496fc351fe3848272bd18c0dabb38f3ce4f7621737431e84d4660dc175ca41fe9ecfa19443332c758536c1e5a
- SSDEEP 24576:XG88u8FpJqH1Kzria7/mU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:W7ZFPqVVa7/3LNiXicJFFRGNzj3
- TLSH T1A3A5F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 d7067448495ea4fc7e216eba90cb517be2b9b4e9ec173886c9a74bfc150c8224
- MD5 aa6039987afc6d5e87408c6487aae82e
- SHA1 ea695b3dea2c6723d6293022e54e41783b2cdbdd
- SHA512 6b3c7a01af858aaa6b273533e040214bf6aec0d529e9fdd1779fa5a55658ba100e275211ab43d4d41af7a9a08acbe2cf8046a3ec118d22d88beac2d78f5ac965
- SSDEEP 24576:8PUr+NQ4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8JQ4LNiXicJFFRGNzj3
- TLSH T15285F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 cea6a24c6c27fe6332eaf7ee4c6a2f8c05501004e972bff13f656c3d40fd8d62
- MD5 9491df2673fcca5f07ede6b774066e40
- SHA1 754828f51677ef463188bc8353ac00cf67fb9ddc
- SHA512 28f48d1453f4b683012f250ff96478e62af59510719e383ec2e9864800643dc72aa6eb7a12f25bd72251f84d8290b8795d0ca4e67791cefbfd2911da715b4190
- SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjoLNiXicJFFRGNzj3:PG05lO43bF7wRGpj3
- TLSH T18DD5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 a17e23079ccd781e8f09e4dd4d860b6723db18c50d9840b1bc8720263da5f3f1
- MD5 6736429b773a16cf6ec18d03a586c57a
- SHA1 a753d66734bd6f063812eb06c684f0e3767303f7
- SHA512 f1bc6091b16e9054e5d0fdcc28efd23bccc748f5834116f1f9b9b97de015b040590300b06ed3624c7d06cbb9a489b514aa34a380db59a4689c890fb58832c779
- SSDEEP 24576:Xfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnu/TwSfVcYG3K/cJHlnFR+IGNe8jg:va5POZ3lJt2pasx2+mwLNiXicJFFRGNf
- TLSH T17065BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 8d25af429f8fe9c00fa092fcdb68ccac986e5a5c049a10a51dfde662880817ac
- MD5 3090bd6888b09c8f89b92b3cb33f6893
- SHA1 630b594c0d51d691c7e9faeed1dd0261a7e887c7
- SHA512 17a46aa5b77325d57f1f464740a5720bc3144584e451b13fa571b38a780b67336e6f9aca05a7bfc50e75a06a143faef969eefe879a11b336a19be93c471d98cf
- SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7Fkc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aNc/zEOVHFXLNiXicJFFRGNzj3
- TLSH T1C5858B1622E901E4F1BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 1225ae4109e54ec97fd6cc4abeb0e7fd82f8fb439aa5a9d3b4ac91c230f862c5
- MD5 67ecad85f7e52d596610c5229f32461c
- SHA1 d39f0c65c80f2a93d7f38c307ef824d1383ad06b
- SHA512 6892eae6a2712b5a7ac37c73060d43703aa4aa226fbf03bd03d6c326dd761f1788ced6671d9fdfc0fe82d32c217055ec84553b42e95a3613ed71a74354e90e91
- SSDEEP 24576:FzkNvNnaFeYhJNtmZBm5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FzMwBtOm5LNiXicJFFRGNzj3
- TLSH T18855AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.9MB
- SHA256 7bb63c996d137c08ffa1dec9a65ed236b281ae4f9928cb8d6592b6468c29c626
- MD5 5ce77536a956b5e7f5a27df465155767
- SHA1 675100126f60998e7169d8717cdc7737a7c60980
- SHA512 f2db47397367f614687ca986f0fb75d5a52a2e5ed3deafc76d4de0953ed7ad49b8e22e3851df085fa7aced8ad04679a1f40c6968a4cc0d6f57012c3e97e4bca4
- SSDEEP 24576:qD3FHshBIYQgAV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qDVHeBIAAVLNiXicJFFRGNzj3
- TLSH T1D395E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH