340b53e69e59a8299afa9e6be0d6f3200724fd5230c9680897fb6176b33f5851

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe
Size 1.8MB
Sample260629-wfja2aa18t
SHA256 340b53e69e59a8299afa9e6be0d6f3200724fd5230c9680897fb6176b33f5851
MD5 1a5e088a8ebc3c1765520c946ea1caf8
SHA1 3e0639f474b2902c39b03cc8248b895521de6ae2
SHA512 f775eb58a1cb1f539d4e352cdbd883a4bce8cc28c766ba03f3933348fdfd3088cf5f4525f2ea055b2a8b75b5eb7ad7e79d7446612730f91d5ef0044c0566a799
SSDEEP 24576:IxIwHh9ZBXfSsRjhm0Ijr/eax8JXO02q3A:IOwHhpaEjhMjSax84
TLSH
T10885CF1173F58035F6F36B71AD7582714A7BBC619C38C20E23902A2D9EB0A91DA79737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2820	elevation_service.exe
4960	elevation_service.exe
4588	maintenanceservice.exe
5932	OSE.EXE
6076	PerceptionSimulationService.exe
3216	perfhost.exe
3256	ReFsDedupSvc.exe
4932	SensorDataService.exe
4912	ssh-agent.exe
2040	AgentService.exe
4708	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d1bd2529a22d4d5d.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\MoveUnblock.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91390\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3334ef9ef07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b5f243ff007dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b675e8f9ef07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ea4da1f9ef07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f84042f9ef07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000932adff9ef07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024fdcaf9ef07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e562c3ff007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c1966f9ef07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0b752f9ef07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2672	2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	2820	elevation_service.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3256	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2040	AgentService.exe
Token: 33	4708	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4708	SearchIndexer.exe
Token: SeDebugPrivilege	2820	elevation_service.exe
Token: SeDebugPrivilege	4960	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2672	2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe
2672	2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe
2672	2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4996	4708	SearchIndexer.exe	98
PID 4708 wrote to memory of 1532	4708	SearchIndexer.exe	99
PID 4708 wrote to memory of 6088	4708	SearchIndexer.exe	100
PID 4708 wrote to memory of 2944	4708	SearchIndexer.exe	101
PID 4708 wrote to memory of 5588	4708	SearchIndexer.exe	104
PID 4708 wrote to memory of 2628	4708	SearchIndexer.exe	105
PID 4708 wrote to memory of 6020	4708	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_1a5e088a8ebc3c1765520c946ea1caf8_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4588

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6076

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3216

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4932

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3865087520-2734723108-1233268525-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3865087520-2734723108-1233268525-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a160ade518dc5e70e589cffcfdeb7eae8964192f79a65a41cda7c5fad6c3e566
MD5 270203823c6e2a898f52e34d6a64a751
SHA1 e46a5f4b7cc4dc26d133e9dd2655aec28d0356df
SHA512 95f1278ecdf66ba181b155c31ccb90ef7b33a06c0e6f6107fb0a7cc34b2dad2f635f48a3422a8e703c9bef63d7ce2c7a3489cccb815574b3400c14119646e39c
SSDEEP 49152:Gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnlEjhMjSax84:43q6HjBeQWdO
TLSH
T121D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 34ab5ebf5829c55a4de1f502fbf7ff15c1467d83bfdd845bc7d9bac3a5750290
MD5 0192a64e56f68295cf49f0df92508f06
SHA1 784b8fb30395d162a878de4cf6597dff33dd0f80
SHA512 1bb457880d6fde3bef2166b84e3a61050ce8c1004b04533ced2a9a108916b0abc01326a2a3570c9338600ad4918f7d7039f19e8aa71de59a25d3983cf1b08de6
SSDEEP 24576:5XYfDtczAKsRjhm0Ijr/eax8JXO02q3A:8tcnEjhMjSax84
TLSH
T19585022863E409F9ED6781BCCCA28501E673BC554760F7DB03A4A92A1F372D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 d55f1e830274aec14a03da86b13898def81959f763874d85e7f000a53d605135
MD5 3e4da5b97f547cb697a30e700584f782
SHA1 0f6d3d452a98729fab750261fc92bc85b3646fc2
SHA512 2fd3708519e01069faf9b578c029d608c1e67fe3f789966fbe8285a9be4f39ede6810a83072185e7d9fa1819fae9e3c3fa3b13ce243e9c2610a34ac1313f5487
SSDEEP 24576:60Le5ji0hmxirMdsRjhm0Ijr/eax8JXO02q3A:6Pji0AcQEjhMjSax84
TLSH
T15F95AE15F6748335D073C0B9C5D2A68EED7230865B308ACB4296D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d5e316a95662c4d5cc29e6b229388f6fe2e629b0b1534c337643aab7ed874e7f
MD5 a8abaf094e9fa368fbfe2ee15717d931
SHA1 1879af27555bc293fe1249e570094014ae55582b
SHA512 b03bebdda5cd861c57eda13b506f198ca37f59f30058a3ac2adce33b4b67d7837941bacf6afac62b81c8613a668a222fe2f178a337c7d05261091e7cb67ede6a
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWE6q8wyu3sRjhm0Ijr/eax8JXO02q3A://ezSC6vUzPvxHjycEjhMjSax84
TLSH
T1E0756C25F5788323D0B2D0BAC5D6BA99FE7230464B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0f2bc4110a3c40a9298f136125dda6237b011615ef62a55a6f3fe03e81a96e58
MD5 d4c4cca64859858c9e3c3d8051ce7db4
SHA1 128f45e27208a9ad1bde43f7a645c5fa511f4fa7
SHA512 873d6d76b7863013997a621017453945120367a1e1e6663821652dc2da38c297a0a8d0bdde33d15dac632f572d329751d943e8c9a2ed8d87c3ec98fc54e31477
SSDEEP 24576:ZVbqPb88hv/l+6usRjhm0Ijr/eax8JXO02q3A:ZVO88hXl+pEjhMjSax84
TLSH
T18C559E65F5748331D073C0BAC5D3AA9AEE3234424B318ACB1246D76C3E676E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 deb4588fe689676c35a7b9144d0222a22406713d821faf182f42da545f05a98f
MD5 825e2953a79bdffa0ae92fe983af7bdf
SHA1 1373d1f68517864b95027d329d19e78678513063
SHA512 b29f05879b88fb51051324fc248b03bccd845bf115cb275468087ae22feedb09115011c13141ec34658ebf43853af338d97c7924df4fe91df0c0c8b88a7eb97a
SSDEEP 12288:6RMwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+0:6RxsRjhm0Ijr/eax8JXO02q3A
TLSH
T11765235583A42282FF07CCF09D9B1808D45AEE590810BD776632BD6E2CBC4EF965F987
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 30772daf4770845ab9e78388b9b1a0658cdf6293002f3faad61fda0c67a7401d
MD5 d00d74234597b6bf0c7e88e1fee465c4
SHA1 63f65a05bca12dae944d18a7d373896c9925f0aa
SHA512 0a50ea4ecfc44d64962fbda15ce5d972afcb809b8bb1ca5f4cb3d1fd742b423e589bbfc4600ad8e08c447cf61ab0130399a1b02bcdf6e52946d4d3eaf2876669
SSDEEP 12288:6eBNUbTVO86UbwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+U:6JIUmsRjhm0Ijr/eax8JXO02q3A
TLSH
T15C85CF3BEE28FCD2C67A8DB85A918600D77278304F51A3CBD175820EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c2d25981df04582d9257345cf6974cb8b5b7420c33c14dd9f4b0dbf38730c3a6
MD5 556f1e38f59e552df1d5620d58dd6f17
SHA1 798dca86296ec32a6b06a9f57deebbf8040b0f66
SHA512 29523c114d8af2abee7d2140a948ae0ed1cc20041c3baa00ef11cd0eee21bec78c95b6863db0af45bd61e934dc7c845116c6bb8784283e1597858f1f53fdb66c
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THe:XQvGAdlCEL8c/yRNw5CHQWdO
TLSH
T19E267D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 209d1fe7659a39526c7ebf59a23b15a3c17106b5ac7f2cf9619b9f14c85c53f2
MD5 7770e7226469dcb93d9d36c4184ff92f
SHA1 9721a4b0240fe2a0b9ce6b157e19330d380fa337
SHA512 bee003dbb37f3c18c9f28e4c1a0f8fe6b6f0c6a3e3e76cd19b6a846137f51e0394f5ba4d58149c7e52c3f0bc0039d80896818c785317b220182f8bd3ed2a0f3f
SSDEEP 12288:3AwSfxL/2Dc34DLLmt0LDQewsAjRwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZn:QdewsAjgsRjhm0Ijr/eax8JXO02q3A
TLSH
T1D285E031FA74E032D77B0DB21B26C706547DBA204F512AC3E3A89E9E59741D2237AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a6cd308d7ac6392a1e496a56334d1d1a95fdc6ec480d681fe32f048a2a752844
MD5 5f9dae5205a750c879e1d5255ff4f0d1
SHA1 65574c44bb0526841a7f4781082318c22588a0e6
SHA512 81daa38ab8f49ac4f738dda395d98f464e98b0ca886e2b5ef4b5f3cd563597d0941ac5d07873fb109b12ce356af8855bf792ebde54874a9f3dd177da24e18eb4
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHoQW:lUEtQevvqc2W1cpV2EI32f
TLSH
T1C8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 98195a3d1dfa104fcd13a6a9b2d611c3a30864e429cb3805b5feed6bd1b82b1d
MD5 cf962e8356eb818ec461634a1a28c0c1
SHA1 3e337ef09494f39b5ee6e9ade3c7cff142913534
SHA512 6292eff4cee40bb02aef2295bda53de94429785d47b6b188bdd960c4b8bb0cefbb41f8593b22d2adc6ac01189b0544b9a49b8a5db7f268cc6e3c2aaa93ff9080
SSDEEP 49152:5CbRquA/m2yL5zTfFiV+XenmE3/zAEjhMjSax84:WoquVjnmDQWdO
TLSH
T1CBD58E0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a4b8aae7181227d0037b2fd7efb6c324b1e312069aa1ab0fa0ab7a651b26af30
MD5 765c4494de01d18914e2d2745c09b092
SHA1 0ec5bf28b82dc5d8beb21b20c9c167d4ede4765f
SHA512 9e71a880308ff53bd144eb1c40231e71a21ad25fa6abbaf34d697a33b3d25f197682dfe2c122c4d21f5ec6b8bfee172ea7b8ee475b7c39753695d798a1d57966
SSDEEP 24576:1AhGLJIFoiwtA5l7S53jsRjhm0Ijr/eax8JXO02q3A:1AMyFoiq5TEjhMjSax84
TLSH
T1AA35AE80E7F955D4F5B3AAB899B68170EA76BCA65E30D20F2150D11F1E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 fc69a65717062b54000b169f9f857bfe664303238552ec0564a447ce1a2accbb
MD5 ee1206ce097dc986a89f38c3f09b73e7
SHA1 716458a429210b3aabfbf31ea67a9d1232cb3684
SHA512 e88da5cfd25049fe8359df519b08b950a3f600e02ea176868e933753b262450ad888394316504966e48561dee22e4291ff6e561de6cbcb57ac3eb1f3634259dd
SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+CewYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+w:qwuoOW8sRjhm0Ijr/eax8JXO02q3A
TLSH
T17B85F14573E41CF9EA67857889978135F7F2BC022A21DB1F1360CA5B6F372616D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 9476abcbd9344a198466b18ae85027ae0a7d224632e2e8f23cfaf06310ddee13
MD5 f244ee084b61de544ad88b0585959fc6
SHA1 e6d52ae6cd4227fcefd1e239cb0cd9599d13314b
SHA512 35548f6bd1907d292a63727b0f46b6834736d77a7b29eaba05bf931ac158638bea851949148e74415dea2c24f2328393ed8d372d35c362fc7f95de8db78c72eb
SSDEEP 12288:cBZ1IyBwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+s:qZu1sRjhm0Ijr/eax8JXO02q3A
TLSH
T11075125923E431F6F65385F8CCE60504D372BC66073157CF1221AA6A2F76AD61E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6f0081e994cd184cd56be21ed8bcd558aadd930ea4e4ccd9eff5e15cb10222e3
MD5 5a5ff061303a96b34ebfe021a367c4d4
SHA1 9fbcad3ea7ac0c0c5ee35aee8b6608c81bd4eef8
SHA512 2a08c4596e167576396759b337fee56c92f88d68a25d3b3b6ed68b9d91a6def48e99423e767af4bd2d977a4c7f0d8b273ceb61dc039e9b0030a75a613ba1fb3d
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:WQRQyi36YOcPQLvw2gAf+PN3iQWdO
TLSH
T193667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0874bab433d5668f07ce7f9f5af5e87778c833ece435b0e2884a4d47eb26a661
MD5 43abac6f94dada5eafc5cd229e24b85c
SHA1 ac60b3b8c9826baf6656557dcc838f77288201fb
SHA512 632737644e8f3316cb15e851f3f4c29d4f9f4644b91ef8d18f68df1786df45d9941eecac59046a51dd43b789c9e93a75a5412f558eb17b8d5c4ea6cd941570a7
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:9QRQyi36YOcPQLvw2gAf+PN3iQWdO
TLSH
T15D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8678ac7dd5bbe3fc31988922067c06ce62c10764d16e4729c8c214f5b857981a
MD5 e0eb642d31aeabc6f532a3aafea07dee
SHA1 40216c15bc756538472065772a005bc5d0075876
SHA512 a04d6069ab75ef10b70083acca731eb7efd6c5c62123e666d70852cbf258a293e669d6c724951b2be96c1691f84d214fa07da600dfe49b4b6d4fdf7f8d88605c
SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0lsRjhm0Ijr/eaxH:868Qg55nhheWu7PNU3/QEjhMjSax84
TLSH
T15EB55933B2F20099D44DE1769F4A872196D27C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e0f7aa3c43838bbd21bfedc6203b211a925f40a6e9cfd3969231d7584cee6860
MD5 f42b9876e8fdb3411feeedd3cd78182b
SHA1 e25b17b741da44d6cf011c4b197cf1b3fb8b394b
SHA512 7e9eeefd0c217ca53e49707c2bbc23b2b7e85b03b3995b1445b87b1e6a2508e0844475df1f9de0538ace0bfe9e5f481a4565ddb6c712e427a0d8b21baa195407
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99s:Ty5112gYy5azzVvL69nLKnhZxQWdO
TLSH
T1B5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5cdc19ae759ff3d9c9b3ac5e8dc75cc8eeb62a26a98480f5690a3e19b6201681
MD5 f4c9ded2e13e5a264c33faad77d4076c
SHA1 c11061786fd0000f29a3740fc4ccdc4fb2f94982
SHA512 01c50579052209b9c36d2758c892347dfbbe02b0d5e6839d70214b6216db093325a023caf436045e3fec0885b43526910134eecdb8ca01a45e8461b9ce90eefc
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glnEjhMjSax84:Bu6JmVxd2dnQWdO
TLSH
T1CBD59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5c3a4ed6c175a2573220a13df1ee2434a5130b8ad7a14660aa415684a69d26f2
MD5 4e3510025c30275b6524cfa349af8b9f
SHA1 eb43da6e775d0ca63f2f7fc1876404f7957b04bb
SHA512 82052d5b66156467f60c749fb6adb23e703ffc9f66209cc9710a2c8d1247a198bcbfaf271e1982a418f8001d5c6551e4805b3803ac4c5c3fcf2666044da651a2
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xGEjhMjSax84:QmifPbRDQWdO
TLSH
T174B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 eaed7f972296a8ac75cb4286f27a4b4f0e0f93029196d924b32c0eba31737912
MD5 716713f20b0d1f464258e9d9b8d90fdf
SHA1 81bb2156596bb28b4f3100d4ff46877c0856b004
SHA512 2feb946903212d1b88b9863a0ff959900c22de95248e9c972c9801005bd4f64d2d5adb6fa1caa0265432563a8836d392556f829006a6cdf09d2c56f82bfeff73
SSDEEP 49152:+SuZQIY0Be2KRRVtOnks6NMHq1EjhMjSax84:Q5dKTi611QWdO
TLSH
T1DBC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8845de262b983be58b695aebe731e145f299fe521e8c42e9552a89330d1738a3
MD5 348b42ce59366cce0621a735df2ba056
SHA1 b50df25e8ae4fff9afc459925dfe974f4ceb9800
SHA512 8cb64c37870f3c0f8afdd7fab3dc703d423be5dbae4ac08ddf9fe081cf611bdd2c164ea69a5eaf2f710c16ed0e16ddcf16349d5e249b262d229dd958ce33aa66
SSDEEP 49152:dhtSn8EApI0figngiDn0AP5wKEjhMjSax84:MX2iyphPQWdO
TLSH
T17C95BE13F2D901E8D05ED1B8C7468632E962BC160B34BAEF0A50B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 75936ea0d4c4bc10c591ce67cfc525607f40f0efe68fcfadd9399690205fafcc
MD5 2a49013604eca8181ee5f1bd7e20ba25
SHA1 8f0a9d3f4de10feeb845190b097976961f8ff4e0
SHA512 9f420530e5f7f8e61fec31319a87820cd8d2c0f34deaf3256393d0200e1bcef46a17376cbb2912e777e5797ad965587c5012c0562ae54f85a496973fcb1f7e8e
SSDEEP 12288:NEwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+Q:NpsRjhm0Ijr/eax8JXO02q3A
TLSH
T17765235482E52286FB07C9F08D9B1408D499EE9E491079B77722BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 86a4f9f2d58fdbf318fd2865af0d7a0868363eb7567fe41fb75b33c08be7200f
MD5 cf529eae5a6a3bedf60e14c9286d9279
SHA1 2cf44f2b590420e1ce596b9478bbf19f342a59e5
SHA512 f98830c06f5593ab1104597e0684b12661d6986e1e22e2565d73b2877c8750864236edd0be5f2578e1861367c77507debc2a0a103d19d07bfd3f297a96650d48
SSDEEP 12288:DlwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+Q:DEsRjhm0Ijr/eax8JXO02q3A
TLSH
T1D965235482E52286FB07C9F08D9B1408D459EEAF491079B77722BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 b72be26fece1f328f465045d2b2eee0382539fccef9dbee002cb145822920ffe
MD5 f11f3652ae6dda2becbd82b6470c4ed7
SHA1 4129fe1451e968dab5079215cfe31f8ff62b080e
SHA512 d4533955f844ee69493d33c7187042aaf7a77dafa17bef6e0bc7ea71b493e8bb4a4dedfa99739808377337edf7e16b4f69361f1c0e8c0807df87171128484808
SSDEEP 12288:TTwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+W:TesRjhm0Ijr/eax8JXO02q3A
TLSH
T11A65235482E52286FB07C9F08D8B1408D499EE9E491079B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 e29f19130fe614508a25b1c63cf9efc319c5e76aa90e318f4d848035b431d9e6
MD5 499afcf34802520dbbcc3d8d93a79f89
SHA1 bff044211077e935d5b9091bc442c5556739ac3a
SHA512 26583261486fbb5d99f259a351ce133a6992dd3d7659f1888b0484d202033c09b14fabea8654a4f96d3e6f3f9eb96482bebfe158f968bca6e57193b3703ca1cb
SSDEEP 12288:YVKwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+7:OsRjhm0Ijr/eax8JXO02q3A
TLSH
T12265231553E812C2FE03D9F0CD970404D0B9FD9A4A216AEF67127C1E1DB82EE1A3EE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 9dcabc218b4465612260d6608475c4ba579c6d354fd2313d0cc073f9e47d6fa7
MD5 223646b1f547a00e5195f5f2520ffdf0
SHA1 d067b41e1e226b31f133d71619dc4d92fbe77922
SHA512 3f2784b878017e5afcf033beaa469d809c6b4162860aaa231be00f3ec7f5628bdcfc720dba8b9d75c5a8f38677843387c8ec23734001de6e37113be7ae5f0ede
SSDEEP 12288:zSwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+F:zLsRjhm0Ijr/eax8JXO02q3A
TLSH
T16065235482E52286FB07C9F08D8B1408D499EE9E491079B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 185782f7c6b6fe791273b489fe6cc1dd9c73a1af5fa40a37679a645daf459274
MD5 8c9bbab8113edbff88a81102d0696845
SHA1 f6014ba29e7f5b04193ba144bb43711450745bb2
SHA512 3d182656db501d01cb707f90e3d978a4dc3915b313faa57637992e02f6f136774d6de5318d3fcc046a334ecb7e5cdd91cd5da183158ee3418400a7160e1278a0
SSDEEP 12288:IJwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+B:I4sRjhm0Ijr/eax8JXO02q3A
TLSH
T16965235482E52286FB07C9F08D9B1408D459EEAE491079B77722BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 4458617b706562cc774a5dcdf3b45061726fb3fb53866fad44b9983de28619a9
MD5 fb4f8e489378ceb40465ae760f1ad728
SHA1 25e38c2ce5b1ab8877caaba284a400a9b3fb98c8
SHA512 5351ffef472a76d9ba6f79099c8633c8d21e25c9ac88cda44df7ec7e53d6c65f3379dcd4389389237c774c94c3fb75ac9894baee6eeeaa40546797f1a3fdbb7c
SSDEEP 12288:cNwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+B:cssRjhm0Ijr/eax8JXO02q3A
TLSH
T1BE652314C2E52286FB07C9F08D8B1408D459EEAE481079B77726BC2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 c6359519a56af1f9b625af165942da1511feda816cc3b17f4cdf48e04bdbad84
MD5 348d0f884344ab27567d29a67e8b025e
SHA1 d8919d904eb6cc5139b0d0c634e23ecd0c8c94b5
SHA512 7a90df07c979972751e0f0cfb52f1385f15b23a9200d37caa59b931f0a90111bde12f9b0d5592074853bb2a2c45650fd4f67dbeb74052bad03b8a062c55e5293
SSDEEP 24576:JZMSzFVSOksRjhm0Ijr/eax8JXO02q3A:JZMSzfIEjhMjSax84
TLSH
T1B5850194B3A018F4ED67817ECD564905D2B2BC5A0B60CA1F13B43A2B1F773A11D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e540a9877eb17ab9b99ced2afc20578913b086fba5c8803a608ce86fdd7672dd
MD5 dfc6e75644ed547081e08d196de5faba
SHA1 0575db58b1039ba5782fa59b46a3bafd7b78a2a1
SHA512 0c92405f02f11b710587af3728df4ae1588a2d9f6327e247a2ab82d6b5c383b47d03d04b85193e7c4bb4635e542e73c21589e762bddca81499ee33e99358e439
SSDEEP 12288:RQwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+V:RFsRjhm0Ijr/eax8JXO02q3A
TLSH
T1DC65235482E52286FB07C9F08D8B0408D499EE9E491079B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 6b4afd6b8cb558e10980d4c97c64c6436e481f2b62afd0ed51f868ea81a7fbbb
MD5 3d5c354d43a1b51bff4968a29d56d54a
SHA1 91283d430d7679dfaf7a8c4848c912d8c9648a09
SHA512 93b03e8bd90cd9627ed0d9c2522921af0ee70d9d0fe49dd5262ac032fde59c9edf892157be9062a63f8b1724b32c50c57ff9527a7ea10016258d3f9fdc8e4f81
SSDEEP 12288:v8wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+K:vBsRjhm0Ijr/eax8JXO02q3A
TLSH
T14C65235482E52286FB07C9F08D8B1408D45DEEAE481079B77726BC2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 f1e46090ed12a7c7175b1ba08b6cc2d955c291a663aa7f78be6a15f043e27fd4
MD5 a0ac212666a3669cad2a4668cd404a8a
SHA1 0f6d12dd70865a881b53da79dbefe9e13fcef857
SHA512 75f0e5ff1c862b7093e4d4f15ae4beeb0b0de7dc0499d24d85bf22df41c496afe21820ee6106158d03ced18e7c8a38ecd7fea6d5e6b43e9abd1eb5cd4199df66
SSDEEP 12288:KyPz5L8BwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+t:XzywsRjhm0Ijr/eax8JXO02q3A
TLSH
T15B75020763A131F9E52782B4C8931905F376BC3607209EAF13605A7A2E376E55E3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 cfd1594fe0f275deafa6ec96638a081de32e0dc1535149f5cdc4972623565539
MD5 a1d9b4aa08dfb093039a871a7b327b1e
SHA1 eb1cd188a76e1d5e2f82340e71e928d5dbc50428
SHA512 7a180b0be1a28d630f7ed71e267ba6c07f3c30fa7ee5422b0fb6e5b66eb6749cb7c4e5233a1e0fe892aeba4d712f44fc875e05499246f4f0606a51b1cb5189b0
SSDEEP 12288:7QwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+7:7FsRjhm0Ijr/eax8JXO02q3A
TLSH
T11965235482E52286FB07C9F08D8B1408D49DEE9E491079B76727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 3876d0d11e3dacbdbb08a151cceb44df15f72c4a2e23f1efaca046339c90f3f2
MD5 6183348cd5aec76052e46301eeb6d53a
SHA1 601e91a494aada99452c5a112522f08111f1fbc3
SHA512 2cf0557b1f6fa5f8931e0cb74f5349c7f81532c9c5ba3d385fb7cc23679ccf7bc947a3b06d15a4b3d7704fe61460aa148e92e57bd303a79f59ce2b4f39e28ad0
SSDEEP 12288:PQwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+/:PFsRjhm0Ijr/eax8JXO02q3A
TLSH
T1C965235482E52286FB07C9F08D8B1508D499EE9E481079B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 5fdd235fdd64c30cbd1457e329c79f890cb1f1e8166d78f7ee5721d52051b1c1
MD5 ca684bf1ccf1e3840c75e9db8bf4a78f
SHA1 994fe66835121d019ea0202a0cfb750811bcec30
SHA512 a1987ab24a7f4ad9e5dfef03a7d78212c1c3c3a0fd58f6d33b948db58565bfed319149f076a6e406f7d1f0e419167c801d6bc4b47250a54f81faa4358120f86c
SSDEEP 12288:ryPz5L8BwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+5:GzywsRjhm0Ijr/eax8JXO02q3A
TLSH
T19D75020763A131F9E527C2B4C8921905F376BC3607209EAF13605A7A2E776E55E3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 f94aebc6b411b90e036fb93c4f42c1e1946eef1c2fa492a751e103b8afdb36cd
MD5 a47b7057a3a4b41dfa16f60a7dd3c2ea
SHA1 5bbaaa6f3552591e34b4f791e138dbb2faa05b3c
SHA512 66988858ff377412bc188ba4bf393b410cb658f616433a0e795189dd9ae98106af61a67b47a88d36648bd150d367c59441b401d290ab7e6ecf6d26670c8b267e
SSDEEP 24576:fTHaLl3z0zDOsRjhm0Ijr/eax8JXO02q3A:fT6Llj3EjhMjSax84
TLSH
T1EB850194B3A018F8ED67817ECD564905D2B2BC5A0760CA5F13B4362B1F373A11D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e00bef14c99e603ebc1b130837310d5e0c9f4e01d9d13d678c46a4741f37cfee
MD5 ba9e96a3e805ba53ab264849aef3cb2a
SHA1 7ab4bf2569595a3bc3e6eec4b1e7034333975d06
SHA512 995d4bcde15b47fb0ade3f693cf98b560c28b5065f639e6643fcca5b8d9093a9df9701fc9c245480c1e3a897bec5c89ea85c4458d71e4dcd01f058682460153b
SSDEEP 24576:T37d9CHKy7GZCsRjhm0Ijr/eax8JXO02q3A:z7d9CHKyaIEjhMjSax84
TLSH
T19C95CE90F3E410E8F1B7DA758D764511DAB67C9A1B21DE8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 0c135b816206a22013b84ddbeaa02e32b82e995af1b77adfa93999b5e889b2a5
MD5 a10547a98568fbc128e0821ba20acbc7
SHA1 926a9aea6b1f7a65c935282944fbaebc0c67e30c
SHA512 9fa1e2774f01968b97cae605de51293dc4e5281cd317c955609ffaaccced020cbf648292d2c32a9a7518549867074c50c8610e7723615afcd7c9b3d5aaeb00cd
SSDEEP 12288:4zwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+a:4+sRjhm0Ijr/eax8JXO02q3A
TLSH
T18B65235482E92286FB07C9F08D8B1408D459EE9E491079B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 2b89ee6d44d17e3fd866dd3a255a194f2b9cd54affe9d329057103fb7789d47f
MD5 e1b2565dd77e569ed72f3cf02d85b5ed
SHA1 25a573d05742d36b5f22cf64b99afe430d43fa41
SHA512 5d703e104adf9577e7731d2a7353d9840acb7dd0e6c3255e0c6eea93ab5d1a5ab89ed0f451c0e5c1a23b3616ce87530b3b05977c54e4aed22644709e00dface8
SSDEEP 12288:fhwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+i:fQsRjhm0Ijr/eax8JXO02q3A
TLSH
T13B65235482E42286FB07C9F08D9B0508D459EEAE481169B77722BC2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 6041fccc4044d8d928376d954928c735a78f215a369e9ae4ec773541fdc104cf
MD5 a828011b306e6321ac123674ff48405d
SHA1 b1c3ae530035ec3923d87684b0b279dddeee77a9
SHA512 89815f138c9c254d9852d007e4f6419470991020b30be35e06e163110345277f450a0639c59a6899615ab58560ba0b81b2860be9e390846c08e4e411644e6ce7
SSDEEP 12288:BmwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj++:BfsRjhm0Ijr/eax8JXO02q3A
TLSH
T1C065235482E52286FB07C9F08D8B1408D499EE9E491079B77723BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 2549b3a33062eade946fe80449fdd401ac187a2378e60bf8d3771c4f17fee2f8
MD5 14cf891effef25bf2765f1feadbd34bb
SHA1 8e2cedf88afccf54027e527e0dabf43d6b1aca33
SHA512 13d4daccbf57f351029af065f2445f863442406a0e5885127b3e4e8b6e3b7f64f425c18de45735c8ace6eab8408152c0625cba3317b42493956156741246da1e
SSDEEP 12288:QQwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+d:QFsRjhm0Ijr/eax8JXO02q3A
TLSH
T16D65235482E52286FB07C9F08D8B1508D499EE9E491079B77727BC2A2CBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 8f7185a96884a2fcc22a35891e47a551a0bed2fd23da952a29d65d0357fb2c97
MD5 c8790f68c8385ac97f2f7f4ebfe29f0e
SHA1 f3ee116e22289c8b9879f058cd9147078d754cac
SHA512 0cf02432b8ffcec4be7f0c5b70e5603482bbb39bb9075b5a49f6fa0ed4c8acee60ae688248c14df740d481c1e448278b9da77aa9d2e1d9872a5a8b448ef9334e
SSDEEP 12288:/zwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+t:/+sRjhm0Ijr/eax8JXO02q3A
TLSH
T13365235482E52286FB07C9F08D8B1408D499EE9E491079B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 076445358608e767b49531c47f5dcfe6301954801dc7ff70deee4a2297538851
MD5 dd5ba510a89350b52a2eabb54d39ff1e
SHA1 a86480e2959d8a28a5261091dfa51e0e28eb5300
SHA512 622402a37025d9f79850ff3ceba19fd0b8ba994d454b9c86dc6f774a669e6d7df2f028cb1e34920c2885774a0e3b4c9eddc3e23dcca45357718716d148ea42bd
SSDEEP 12288:MYwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+h:MNsRjhm0Ijr/eax8JXO02q3A
TLSH
T18B65235482E52286FB07C9F08D8B0408C49DEE9A481179B76723BD2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 2ad6d4861d0d2b40a4317320cc1381a213daa480838b4ff95c859110314aa997
MD5 c59c7aa437023958c475751efdd90ad6
SHA1 946234a7ef5608cfda381a172a8e6d8dd4336e20
SHA512 585417fc8e35c79e98ede6cbca1412cb45fd9f4586f1437959175b24a003f537b547e80b738a2bc8d121bbf89000a2ccbf01b4f8a9724ea12a3236bd5a1b9b34
SSDEEP 12288:0SwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+0:0LsRjhm0Ijr/eax8JXO02q3A
TLSH
T1B965235482E52286FB07C9F08D8B1408D499EE9E491079B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 06a0fd49cf43ad356bfbd2629a31226a61f1d021c0bd932fd7aa87283baebd86
MD5 02f78f83d88dcc284496de77c8f31cdc
SHA1 b0a98d2719cddf8f095091a494f184c612ba8808
SHA512 931ab0f7e0e2c0c0bb07c06f3adb3c9014339ae4e3c96bd5fabb8ff255f4e304c84706b4116c2cb2a72a306115dee95dd28d1777501f2afff48e372c76126589
SSDEEP 24576:Ufwvok9RX6wkyAIRsRjhm0Ijr/eax8JXO02q3A:0MnYIREjhMjSax84
TLSH
T1F095DF29EBDC04E5E177917C89B7460AF2B1B8690B31C6CF125A536E0E37ED45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d2caee2200bdc92487f6f2cd22ad6dc10cc1dd464a345cb973ef3166a98a5173
MD5 cb6927408c6b38c917fa8ee351d0beb5
SHA1 26c98525a9a635715d74ee25dd5120a2e4a3dc15
SHA512 8c90346ac9aa6448d2aaffa2afa74d9bac7932a665282a1db7c748876e731af537a246257f87c1999a884ba81e71c29498b0c67a52596e53a1cba84d7515665f
SSDEEP 49152:BYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qEjhMjSax84:pySzPCQWdO
TLSH
T19B066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5226706099750209009ab2f7d748f6a506800fcd95cd48622cf8c8a396b05d1e
MD5 e45db8ba550f5baa4496edd0a4415247
SHA1 78d4a55c52af581009508afcd366a5642a4297d0
SHA512 bcb5b5d29ea4516c42b8d5b14b4bb7dbd578886d3fb30bce903cda448f78398c9b9e114843f4420290fef1cfbf6920184f0d971f4ff4f6c0bed0ec461d26232d
SSDEEP 24576:j47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY0sRjhm0Ijr/eax8JXO02q3A:j47JUQj1irIhCnDHUPfF/6EjhMjSax84
TLSH
T1A365AD1DA3EC01E5E1BAD27885154A1AEA71782E1B31DACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 f77e6918f70bde6a51c157454a0e87103a2f820a184cf4bf89c0b49f512bb8b8
MD5 ea1687419ca682a05b68ecbf7ef953ed
SHA1 e5d9ca56349b075b8d8c6db16c41ac291c6ac8ad
SHA512 f51c5695e7bec3b8357e26c41a6df2fbec4a31609c93f40060bccad4f5763f953ea840394a8e778adeef470ab61af54ea90333f18a72f6f6c0f23de1eac9ae5f
SSDEEP 12288:bNsfgwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+6:Y1sRjhm0Ijr/eax8JXO02q3A
TLSH
T15075F119D29812D8D11EA1B4CB460A00F327BC6587E1E3CB63D0F93E1F796D55EEAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 739fb83c0dc7f826eccb5cf3a60eabd7b5a5d6b114481ddb2f79b313149045e7
MD5 c60ead4c8a649ae86d4ed3dac3623b36
SHA1 e22c302af8da24c677a3c537d24baa8ef8c4a327
SHA512 49c43a696154cd9270f005866bd17ac7665ff9d1a4a2c6da2231e35f8fdde8ecb8e8e1cc2d8b290cb1c6d9a8e89f2e8c1bb36e6031fb06b30590babaa64a2ef3
SSDEEP 12288:FT4XU3fmgjQGe0j3f36MI4EBQp8rjcWGaLDaX:FTiUPvlj3LI4Sm8rjcaLD
TLSH
T188350810B666C74FC65D44325E33C6CCAB707D51EE04AE0773C88B3F9576A58BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 370KB
SHA256 d914844a11546dc80af97e8fa8a1fce1109f4326ec01bee658b19de1fe564d2f
MD5 3d4d1a50de275e511315ed3482c10700
SHA1 ca477e9b7b79e6dbee28778e5732d57f8b91b047
SHA512 11bafdbe88a7764a5b860c194b8c786f2ad689bbb3d8213c3e970f1c85da5297fdb3b5c05baea92e148b775c2c7157d6e7c37e60fc41644171db455bc5a8d631
SSDEEP 768:V/TiMlToOlTPBlTz2+EQMRJ/TKgMlToOlTPBlTz2+EQMb+Od4fDQ4L2bxOhyx4xZ:GGmbT8wM0GD+H6x65hQ9QDNGgNly2EV
TLSH
T11E84B301B760B71AC4F641720972D69FAB39FC03AF53430737C40A5ADCA63967A7AA91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 366def5890151760b2e0c03e5d88eae60d02f1e732e590a612d5c1da5a2765af
MD5 2c40f3c2192d1b26767bcbf4da38949d
SHA1 d1a7356894b071fd8530bcbdabdf35135ee556f4
SHA512 e7a65fa53c1ba28276e4e875faa16fd750eea1b7c4479c0d427ee3ff173bc3289fe56fbb4263d8f02cbc3550b80e6ae10b4b9c745c054f32a1a7b99847b85b74
SSDEEP 12288:L07owYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+U:g9sRjhm0Ijr/eax8JXO02q3A
TLSH
T11365231183E82646FE27D9F0489F0414D01EFE694F10A8E7B612B95A2C7C8EE5E7FD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f78c82b07e4dfd0a9cd15035ee254ec523bec3800dfbcfb6e73ca6739c9494c6
MD5 0e1cd8e47b1112d465d7ca2d62eefec4
SHA1 2f0d63ea79984a0a8e0e0347ee02913a47bc9c05
SHA512 77069452c61f363d9455a8ba6686a7038a17c09fddf75f54d38cb1677154c632e1a7597d3d6eb84b3654ff07395a001025a09ddf7dcdbe7cb56ed5cc88b76ef2
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bY3sRjhm0Ijr/eax8JXO02q3A:wgb4mBIBhGF0EjhMjSax84
TLSH
T10A659E1E22EC02F5E1F6D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 091fcc4169ab11af6db1c9839d14b7342eff434c8d1e94ea49f58aac828bf715
MD5 7626b17e62fbbd13a7efd924006b5e0e
SHA1 e99df3d8cc1549755dec0e8f951126c84b80cbb0
SHA512 2251d7ec4306583f4e74862ad428785bd094d8496d7ce35310d8386aec37c7e7b98ee393337e511424703d4db73933bc6b9d006aa7cab6952579fb0017a3c084
SSDEEP 24576:OG88u8FpJqH1bzria7/mksRjhm0Ijr/eax8JXO02q3A:F7ZFPqVea7//EjhMjSax84
TLSH
T13095F16567E101F1E47BD13889864663F6B2B8250360EFDF07A88A551F23AE50B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 a7e1323ccf755430197322625fc3065cee38e96d316c84ed9a1618e7984c34b6
MD5 ce54f5b0da6ebcc97e32ff01bbb5eb5c
SHA1 2c48950206c05aa3e3b6667427202367a50af9ad
SHA512 26b7228c48595fc43cf203f520f58243452b76764391ba25924b463d0d981532143757074ef3ab01587b0dedbb8c2d51678760fe845c046f491a9c93c9bd7f6b
SSDEEP 12288:GHvUrBFrEjwaQ5wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+T:GPUr+NQIsRjhm0Ijr/eax8JXO02q3A
TLSH
T19C85F12F62EC18E5F676E17C89824609F771B8620711E2DF02A1917E1E67DE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 04d7edf8ed7b036fddd1692aedd9b4b257893cd0e296939b4df3c2df2bba6190
MD5 05fe5b374c4e5353c22ddff1aac26bcc
SHA1 939c8e7419899258150a94882cccf506f6882520
SHA512 167fa18dbcdce2ebef86b877f5c50308523a4db0ebe315363b45d70fc51dc4a49fa2298429c1f79b6229a9e61c75ea347e06f6695e872f18648161defdd2a912
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4EjhMjSax84:zG05lO43b5QWdO
TLSH
T1B0D5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 afedeb9f5809c90ed139d729af0d983cd7b2751e11b6484070c140358342fdb3
MD5 25e810d3d1611e63b034a768501fde37
SHA1 7129866d15a3d5a43b824e3fd9d80556e76dd21a
SHA512 65b972045d339b617983a7d19b868282b0b82fcab205ef667ebb46e8c859b83b45f1f76308cdec3714d57db444763805dfcd5d8cbaaabd38a8fbe3e9a17d0ac4
SSDEEP 24576:Yfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnqsRjhm0Ijr/eax8JXO02q3A:ga5POZ3+Jt2pasx2+mQEjhMjSax84
TLSH
T17565AF5EA3FC01D5E579D17CC583461AE5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5a6bdec8c8747c3c58b0fc89cb5dd11b1424d5be69f0c614b8c7d8a7ddc721be
MD5 7b8a3e836a61ea57d7f0c7f91f69bc65
SHA1 b59c8dc928e12ca6535a6af774ee8386b71f3689
SHA512 cb95b13b04fe691f25b0d9c7bd76793bec60aea06a5f653ca63b826ec3c469685c04b4f3e111704cf49722f5c002bae7cdab2dbe059958ba6510b740251548d3
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkcsRjhm0Ijr/eax8JXO02q3A:fNc/zEOVHFfEjhMjSax84
TLSH
T181857B1623E901E4F5BBE1BE89679546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2658519cb528956dd29bfdde6630382599e9dc87bc6b26ad83380704151348c2
MD5 7259a6fffea3c16afde0d5b7b519f80a
SHA1 268ad0c68c500c8cbf0757b37198e9b38cc2b265
SHA512 59011c91e0e80e087b8336402abb2d4bc469e824fbe63566b1250d40a49c2a40a18f5b860a1c4f4d97881d7ac0a3cf40877233a554897df459b118ea38ac7510
SSDEEP 24576:l8kNvNnaFeYhJNtmZBmzsRjhm0Ijr/eax8JXO02q3A:l8MwBtOmzEjhMjSax84
TLSH
T14555AF6EA6F806E4E1FAC6B4CD238512E6727861073253CB5390C13F1E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 bb1e4e3a5716e01360ae59c9eb989a20c31b181d460c3df3b3f2ab95219f2156
MD5 05fdcc45f6e4e724b8f13891ddb72471
SHA1 b38e253323c77e628cad23d19ba43a575e4b498e
SHA512 4a6ec3528efeb3f195070578761caf03463a155e0ea88a7b83b5087fae69191acaced558f62776a3a72da0e282cdc91b6e2e247e8533dd5419d3d8e8e342a794
SSDEEP 24576:wD3FHshBIYQgAJsRjhm0Ijr/eax8JXO02q3A:wDVHeBIAAJEjhMjSax84
TLSH
T1CC95E13DE79C04E4E57BC1BCCA634A06E67178A9032165DB1294D1BA1F6BEE42D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2040-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2040-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2040-127-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2040-131-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2672-6-0x0000000000ED0000-0x0000000000F37000-memory.dmp

Download

memory/2672-7-0x0000000000ED0000-0x0000000000F37000-memory.dmp

Download

memory/2672-2-0x0000000000ED0000-0x0000000000F37000-memory.dmp

Download

memory/2672-0-0x0000000000400000-0x00000000006AC000-memory.dmp

Download

memory/2672-25-0x0000000000400000-0x00000000006AC000-memory.dmp

Download

memory/2820-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2820-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2820-22-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2820-16-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2820-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2944-327-0x0000021E5EE90000-0x0000021E5F11B000-memory.dmp

Download

memory/2944-407-0x0000021E5EE90000-0x0000021E5F11B000-memory.dmp

Download

memory/3216-303-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/3216-79-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/3256-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3256-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3256-340-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3256-82-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3256-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3256-89-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4588-47-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/4588-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4588-41-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4588-54-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/4588-52-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4708-138-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4708-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4708-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4708-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4912-314-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/4912-108-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/4912-115-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4912-109-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4932-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4932-94-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4932-101-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4932-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4932-323-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4932-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4960-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4960-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4960-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4960-30-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5932-301-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/5932-64-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/5932-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5932-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/6076-75-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6076-69-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6076-67-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/6076-302-0x0000000140000000-0x000000014028A000-memory.dmp

Download