8b4139f3efe61e30c55743187201d9ea0a741777b316671d95e699525f41e752

Analysis

max time kernel
88s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
Sample260702-ar9fpsav2s
SHA256 8b4139f3efe61e30c55743187201d9ea0a741777b316671d95e699525f41e752
MD5 0bd19f404ddadcd0ea8c52e9b1326393
SHA1 e05a12ddde2c64e237e4333cf502131e16be93fa
SHA512 3c4f43eb29bc90bf99abdc80841ea041c47dea427ad097cd5576ac35c840305dade99e3a557a768550e48bcca8c6bcbb9af7220ee4c596fac4046ab01a1211f3
SSDEEP 24576:V3qgcetbQz43+wSatr0zAiX90z/F0jsFB3SQkj:xbNUB/aB0zj0yjoB2
TLSH
T16E75BE0137E89131F1F73A7679B692254E3A7C61BE31D68FA240AD1D2E726C1C934B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 10 IoCs

pid	Process
1208	elevation_service.exe
2188	maintenanceservice.exe
4760	OSE.EXE
3388	PerceptionSimulationService.exe
2104	perfhost.exe
5592	ReFsDedupSvc.exe
3428	SensorDataService.exe
572	ssh-agent.exe
1052	AgentService.exe
1060	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d07976a959cd5fa8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113859\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113859\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003cf0daadb909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b0011abb909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089ae5cabb909dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{7DB49DFB-A726-4E33-8A31-8685A82CFBF2}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{7CD80844-7F99-45AF-94D1-FA63AF380C63}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1208	elevation_service.exe
1208	elevation_service.exe
1208	elevation_service.exe
1208	elevation_service.exe
1208	elevation_service.exe
1208	elevation_service.exe
1208	elevation_service.exe
2600	explorer.exe
2600	explorer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2588	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	1208	elevation_service.exe
Token: SeBackupPrivilege	5592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5592	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5592	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5592	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5592	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5592	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1052	AgentService.exe
Token: 33	1060	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1060	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1060	SearchIndexer.exe
Token: SeDebugPrivilege	1208	elevation_service.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe
Token: SeShutdownPrivilege	2600	explorer.exe
Token: SeCreatePagefilePrivilege	2600	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1184	sihost.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe
2600	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1212	StartMenuExperienceHost.exe
2844	SearchHost.exe
2600	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 2720	1060	SearchIndexer.exe	99
PID 1060 wrote to memory of 3212	1060	SearchIndexer.exe	100
PID 1060 wrote to memory of 3128	1060	SearchIndexer.exe	101
PID 1060 wrote to memory of 764	1060	SearchIndexer.exe	102
PID 1184 wrote to memory of 2600	1184	sihost.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2188

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3388

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2104

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5592

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3428

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:572

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2852 2836 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2868 2876 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2852 2836 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2868 2876 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1376

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2600

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2844

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ad7b833d34ff97d41fdbf330cd5f3a8dd00e945d8d4080b10c0331315a36d6f8
MD5 8fe99401b6ee4672a64c8db6462c03e7
SHA1 9695a6bce25ae1805b2fe8405296a51875a87cc5
SHA512 2af56d9f9a231405940ac48d84c07d7ec63a1310c01d9243e9fed3066f21d805b3bac64185038e56b815306aa6f75d9bc78caae4f30ad2b23a8ead27d6e77faf
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnCaB0zj0yjoB2:63q6HjBiB2Yyjl
TLSH
T175D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e17ab7d2bd039f41db3c0611af80b8e4cbcb98d95b6c74e6e37f086287b8fbd7
MD5 9b14c48fcda6a230d7cfeff95f265bbe
SHA1 c921041664f4260ea63d571aecb491c52700b4ff
SHA512 97c94bd826b9c57a56c36c778d49faf65a85b9c3d1235ff510ef3ccca36f61c15585cd06eeac2304e67de1373f1046bd0d5a7bf3f8a4da115a0e084796add6c0
SSDEEP 24576:UXYfDtczAvatr0zAiX90z/F0jsFB3SQkg:Ttc8aB0zj0yjoB2
TLSH
T1AE65022977D504F9DC67823DC9A18506EA73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 10f3e305f6d68f97de6430946cac6a5ffd807588dd1e2d94ab69347f83a93a30
MD5 b213b5ebd128559e10893c4000aad9ad
SHA1 15c47bcf4901b9850d770007a2d8957369c26be2
SHA512 e9a44e5fdc89d0986c8559447fb21a79817f42a398e7c5bf8392f5a5b2903b1d0d14d255323f267d36c1c013802677c56f626c7c5ab2cd127ac764f89087852d
SSDEEP 24576:t0Le5ji0hmxirMSatr0zAiX90z/F0jsFB3SQkt:tPji0AcNaB0zj0yjoB2
TLSH
T1C4859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7373d94fd1b12b774580b30bee5e5f13ee4a9fc2e2b30074c03da6095ac0ca17
MD5 6ea4147ab6939e687e47589ea937f598
SHA1 d1a30c284e5e575ab7084a53b5cb3fc5cfc84c58
SHA512 255de8b854b019d77fbc6930292fa53d8286e5ab5f2cddf070a445462f48c72d89a8d0e0d2625706afb5e8bce107d1501dce2fbd58e10e820b601dffa36dc9f1
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWE6q8wyuMatr0zAiX90z/F0jsFB3SQk6:i/ezSC6vUzPvxHjyRaB0zj0yjoB2
TLSH
T14D755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5595550a0c22b7107d96c2efea7bf5c4f00ae0e806abd6923b1f4ab4e80314c3
MD5 c54bb9ac155507400acd15159ed324e1
SHA1 05a5229b3985008ba8b2b06c5df92405a0113e0f
SHA512 5dfa21bf654aa5a23576b40fe30ecf3d4d6ad04303ed18b554ec8a039a1ef8743a136e353551b2e08b31003d7058f5093293e353a2b44552c9c1daf4f1df1195
SSDEEP 24576:XVbqPb88hv/l+67atr0zAiX90z/F0jsFB3SQki:XVO88hXl+WaB0zj0yjoB2
TLSH
T14755AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 be2cc8ef2f3daea4b7b5d65e8f964999ba55845f85c9e453f260a8ae27c50ebf
MD5 af044c7bbbfe99c3a002925822e8d797
SHA1 cb5166b5366ab0c434302fa286e258d19d56c6c8
SHA512 9e6c60d3abf1836076b946cbb3fc54827dc5694d06c8113666730b94592fe8b410030d2e88e32aacc3b8d1f9cd9b3c20a4ee26ea76386b1869fa69bb0ed072bb
SSDEEP 12288:oR+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:oR+atr0zAiX90z/F0jsFB3SQkl
TLSH
T16E45230B341E80F2CDC31B3526989C4B1ABA9EB065E2AF45A2D13F4F9D3C1C6D1666C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 443650faaef36a503acd875215c530ca339a7510bfe63bcefd0b1a4cb376a4c4
MD5 e34588609b2d1ea8726e041ba5362f05
SHA1 b96d9d7f7d6f385126542125fa635caa8504e0e0
SHA512 844d049d10caa5936b98dd0dfd7e725f812a662eee5634ee8ba3ba64457f7999abb0d3a7f6dfff62e15917e9ac5ba9d09b10f23b473321e421527909d4393303
SSDEEP 12288:leBNUbTVO86UTUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8p:lJIUTatr0zAiX90z/F0jsFB3SQkU
TLSH
T14665DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d8873824e2e0d7786811af5e9a0f45525342a9e5d4cfeef05a3930ecd05173f1
MD5 a50eb5abb3326261056065bb2beaadc8
SHA1 d965a3f1ca8a9e9c4b41d852d5ae051574afc106
SHA512 5c3f15f9e439a97d1c1ec51fd058dc4d640fe33b1d8001520b7112b3fa27e337be61c94336e1883be31f6521e14287a6aee68ec25f1ba6a538c905c44825f842
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:AQvGAdlCEL8c/yRNw5CTB2Yyjl
TLSH
T129267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 334bc5352251986b1cdc00cdee23c4907481c26745f29109e12e9d709cfb55f8
MD5 08102e36ae1977a5edaa56a169ed7b65
SHA1 abd53e5fb53525e368010b309f586c0ba6245e3b
SHA512 ae1d6945ef28fda5323dbf722906e7974f3a4363fa0091faa699752d2fab213b78817124522450f7c49857346c02ae696daeed99d6af9b0e7ad23b447f4a3b4a
SSDEEP 12288:PAwSfxL/2Dc34DLLmt0LDQewsAjdUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHf:YdewsAjdatr0zAiX90z/F0jsFB3SQkH
TLSH
T19A75E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2ece87d4fb56ddb71f75d022b67730a491910ea324cd06fccd49c89f48ad9eda
MD5 25bb47586ef3a8b21b94a7c527c1eb66
SHA1 df7634f9c766623d6088b85852457d39803366ae
SHA512 f81db9830764e07f36878a29a2fc2bcc57b820f600c06d273ea57a57b9d2b036be2e61d279ca9136096b62f4dab1c78494fe9fba240a87d8fce0386776e7a858
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH0Z:3UEtQevvqc2W1cpV2EI32W
TLSH
T1E3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e8628d573bc8cd966a51513081d6bb216ab7a6a1686dcbba61ca1fe4ef368d6d
MD5 05c87023710bf67dce729ba408442bde
SHA1 bc4e5ddbb45f839969ec5e0956fddc9ef09bc948
SHA512 65eabe2a41d02c4e1bc1ca9191a174b4150a0a7567a72481c33f4614a417418b468ce1677179dbf0e0625ae5737c2b10a1f45157d5d8598fddca2c2c74d33a42
SSDEEP 49152:aCbRquA/m2yL5zQfFiV+XenmE3/z9aB0zj0yjoB2:voqtVjnmfB2Yyjl
TLSH
T178D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3771e6b124f89203df038ac3f7def314a49a3d6e18061ef4f269e9d4016c6c13
MD5 40c73e49ddd40daed90a177cbffea58e
SHA1 24617bf30095c366dc595bc1d4d2a12e28004241
SHA512 e069bc76029a1076a9fead915c5b446a60d68ee1ebad968464c531a548ddccdda2ef2c65a363cfac35d76f97d2665d08e3e6f49e5e6be0f44669b7bf599d20ef
SSDEEP 24576:OAhGLJIFoiwtA5l7S53gatr0zAiX90z/F0jsFB3SQkH:OAMyFoiq5QaB0zj0yjoB2
TLSH
T16F359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f0c34f3fdd04913f2a90dc36c365a5a9035ccd6875920ece7f5ba4ae1e73ec78
MD5 cf2b87c0ea4c8ba00708769ac0b91260
SHA1 d8c9637ba87fb181f324099e6d715ab920a953ef
SHA512 33d54e9da3865eb092655040e6d69ce10f681f71f73a20bb758d4d3a0a737a56273c584199e917937963aa4568db58ad542481b4dcd0e725f46aa53ca92e40fa
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+CsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:twuoOWxatr0zAiX90z/F0jsFB3SQkG
TLSH
T12465F14A36A90CF9E9A342388597C436F7F2BC112A61DB1F1360CA5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 27853e10a6d0ed70e20bdf16b115f3940856aece17295e50a6b237492dcc4bd0
MD5 9636be7a309693e236284e07d2a157c8
SHA1 467cc9d1a27a0f7d4949080a79c5dfc33f2bcd8e
SHA512 50bbc3cddd8511344a20a3efd246b5b1a67a65323ad79a99a8f779e049d58659ed577bf1399cf87e9ce210475c7aa76b73f39cdf385a49f81ba08fbd8e7bc14b
SSDEEP 12288:lBZ1IytUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8L:TZuqatr0zAiX90z/F0jsFB3SQky
TLSH
T16255124B32A960F6D5D3523C89E48906D7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 543a1bf3e91e6a01ab63d565a9d8c4c8370f6b5247cd9cc8ed27d12e442b1460
MD5 0d869a68b49482ae5a43538d385b2645
SHA1 1325ee446ab9f6b110ea891f8db95ce7f4ad6451
SHA512 57d5e34e36885dde73134e2e84e0cac2a981c2a5643d944a8ca42a9fa964df5d592e0b227d6aed614b1afa6c4ecb0a3d78182982e82c917ac07fb5e6b5022c9c
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:sQRQyi36YOcPQLvw2gAf+PN36B2Yyjl
TLSH
T11C667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d9f934f9a297eeccc7597a6725be591a3c9016f6c312a0abca9b730e50b9cf8b
MD5 6346b8667bac619339d82c5c6216a9e8
SHA1 c41eddbc4c8ebe50f4b54efa0879e498cbcd6f5f
SHA512 55688d2e3358ad0c9c8d31118b3820d05f54d182678e599188228111b8d58d32fe36f5685920a1408cac587ff0076da1b5cb68b8b353a0218069a525ddcce22b
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:hQRQyi36YOcPQLvw2gAf+PN36B2Yyjl
TLSH
T15E667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a80e3b45e0f47c107424ace5f6e16b484c7865e1c6cb539112bfdb9e29053ef4
MD5 bc0d1fe9f021f3735afc28bdb7374437
SHA1 7b77a8d3f1e09e74dd9565f45161f2d502708e1d
SHA512 71ec0886848e8ae922a8c64fac7260cec3c47a13d0c1bc732ddb6ca5137d1cdcd2db2be5e6ec1382f82743acc80467c73d1136067fb8e0a9f198cb064ae2e997
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0aatr0zAiX90z/FJ:268Qg55nhheWu7PNU3/NaB0zj0yjoB2
TLSH
T1E5B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3ed1fa6ce72f4a94e7d3da002b29508745f7fc37a128c40b4e6cb11bb573913f
MD5 7f262a2fcaa51ee5186c7a38063ff1da
SHA1 e9faf4ba0564f55d8608dcfd4cb3e4a377c48374
SHA512 428e29860312df60a8fdc508a81eb5ac559dedf290bf5892aa6c6e1444d1fa73247f1741093b37389ff99822697e8d723fff985aeaf14e7f381073dcd14e6189
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk997:8y5112gYy5azzVvL69nLKnhZpB2Yyjl
TLSH
T133167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 392dc4143ef2902360b75c893eae8d8d438e6826e4d63994373b5957bf1819c8
MD5 f0f1480698a341746047d3f8ad74195a
SHA1 c678ed040c69a09542554626503e7fcd761f5292
SHA512 a4924a2c7e9c46127349a1a69951475e633a777a5d1206bc24a59431775cb2151f68c10789724c7ff0daa19a60ee2e74eda242569e573d59382286ff21b1885d
SSDEEP 49152:lB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glTaB0zj0yjoB2:Lu6JmVxd2deB2Yyjl
TLSH
T1B3D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a4626da64aa52dac5c590846fc6150b268a8d4df2c8d5162b268f03e0df4aefa
MD5 7b8d56c358eaed3b92419b13582ad30c
SHA1 9dda53043f5e00ae4a2f6f66e26113bd420416d0
SHA512 4808d63c12a2b4322d6d26e07533081b8e97772dbed566ba1f3dfa1e070b594a5e329eed5ca352a63a536a3a4f37691508ca7ad771a73ec948d97f348c72f556
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xzaB0zj0yjoB2:nmifPbRfB2Yyjl
TLSH
T14CB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ceff0e28e1f868ec40016961b6d2684a9e18337ca8f5293fc3ef51acdc081777
MD5 65d07cb2073b0060b304773d90906a90
SHA1 a96315dc224ca1435e3c00f83f64cc793d56e165
SHA512 7657a06375664579d10cfb84d5170f697acf52aa415365a773f923d8288f459d9760135ba72cf717e948b1523c4161fc4fe7ef94fbead224dc1dd1fbf2ab43c7
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHqqaB0zj0yjoB2:T5dKTi61tB2Yyjl
TLSH
T138C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 46d286f09032d28fc30994f71d13a364dd3db478068a5e4c593bd756d8d3d48a
MD5 56fd012aebd258b175a91cc52be1e4f0
SHA1 80a25f69bef710477b33a7f14d101149cfc03dce
SHA512 05b6451d66dd40f664fb9c2b9684f275b0cac0fcd13f6ffa683c2cdd8300e29c846cd303910de1d95b1f6a481f32be63d0ee43c6fff27e074418a80cc57d76b5
SSDEEP 49152:jhtSn8EApI0figngiDn0AP5wvaB0zj0yjoB2:CX2iyph7B2Yyjl
TLSH
T15295BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 08d4f8bf9f0323e4eec560db4613ad36653f7b9673baedb62d4a3de9b5932a90
MD5 d47a2ec4c64222274dfcbac3c9ff1740
SHA1 04f4a052a450ad624b70e82792d55ed6d4d11043
SHA512 9f6f29e21c5716884631aca2dcdd88984b4c88e111fd1ebdf0f702d8941072e7d82d59f0558208b77af014b47173905456c5d018e0a78934b67ea1355bcdc296
SSDEEP 12288:eWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik81:eWatr0zAiX90z/F0jsFB3SQk0
TLSH
T10945230B341F80F3C8C31B355284984B5AB95EB4B6E36B85B2913F0FDE386C71565AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 47bf521b59e2e9604708a2314a9cff5998d5e75c0425fee7c51bbcef78b60405
MD5 a1b4e3ed7af2d952db2172fb93b43d49
SHA1 d6a7351407adc87433666de9cd67dcf3d40ca718
SHA512 882b3e7d0da7bad314c7fa22fdc5808008c0bbd24bc160be6fb87d1061d6a9d0268cdedf311cb1632701bfcdbc08b3fa8e662fe8e6ad33837abd798a9eef6109
SSDEEP 12288:/ZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8w:/Zatr0zAiX90z/F0jsFB3SQkB
TLSH
T12B45230B381F80F3C8831B355284884B5AB95EB476E36B85B2917F0FDE386C71665AD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 95773f6a3c5d49d0486d83a2728289f4c1328131c591e639d9dc70c631b31c9a
MD5 d72d3eb0b5ab8a680bd466daaa2261d8
SHA1 b2c9956f9381bb36cea21f2cb3d7e62821613732
SHA512 c5a48e23aecd470505a63c216287a04d8e7d5e189bd5bceeb1fcbb8cb4b87a1b477ecbfc185bd58f3790c8cf6573c7566fdd64ca0ef5e284875c5412aa50c91a
SSDEEP 12288:RrUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8w:Rratr0zAiX90z/F0jsFB3SQkB
TLSH
T12945230B341F80F3C8C31B355244888B5AB95EB476E36B85F2D63E0FDE386C61665AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3095fb383dc603cef2c1da3f4942deffc77ade433a093954fc60519065b4567c
MD5 012135adcff26a3411ec0b847601097f
SHA1 d5021d33c9c537ffed0505b97d8dd5014d3df311
SHA512 58f363820db6710231b950c720906847cb7c4bbdd2c2d51620984b7765daa1351d56a2a82367bfafa874cf9b3c205754c5d825372cdf584b4762448b2c53bc45
SSDEEP 12288:1VAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8C:watr0zAiX90z/F0jsFB3SQkT
TLSH
T16D45230B352F40F2C89397358694884696B5BDB0A7F3AB9FA2413E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 463e6b6e9a66d874cb441b869ab643108d2ad03abab57dee992b91e29ad73ce8
MD5 70582419b07c5e867eec180fb8c19264
SHA1 0381d34e29b3eda1e5fb18aecf98bbd2d51c727c
SHA512 46db2ee659b1411d61e6dff1a60651b0c3b63f3e0b933a6af99ed05d48cf956c4381fa377ae44403e0506b4b4f652a2ece506f6e474fce141fba496fe4cdacbc
SSDEEP 12288:SIUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:SIatr0zAiX90z/F0jsFB3SQka
TLSH
T15445230B381F80F3C8C31B355244488B5AB95EB476E36B85F2953F0FDE386C616659D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0bfac0626ba0a1f80fa1eff25c2d1e238f34881e7b2c04541d06ad542e7ab3dc
MD5 17f239d83b9d341069961bebc548de5e
SHA1 d6bfe5d1be9e1c1eb767b502728260a496f61579
SHA512 e69118f5dec089d64d739e0f10dd4f49844e0d61873472af2a0a985ac2601f11926657f6a0dd893f976937bad761c609a8d8ccd80c7c2d296279cf018141e7cb
SSDEEP 12288:dVUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:dVatr0zAiX90z/F0jsFB3SQkJ
TLSH
T1FD45230B341F80F3C8831B355284888B5A795EB476E36B85B2917F0FDE386C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7feafca11ed9d184fd8b38e4c3ae495130a3e21605df11fcfe4fbff52e2661ae
MD5 50592b103b8dc777880403636fc5b4d2
SHA1 edb39130f1cd9200a5ddb856537e01535a422ccc
SHA512 6aba4c2f481f9d11f88bd6c80254d6f3794deb8e9abc1c8d02affbfd5338e314a127962aa00c4e6daf68716bb178f07db16623df5be756c1d305a2c1172b1c54
SSDEEP 12288:ihUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:ihatr0zAiX90z/F0jsFB3SQkR
TLSH
T10545230B381F80F3C8831B355244984B4AB95EB4B6E36B85F2957F0FDE382C62565AD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8869f06f0b6950613c5cc53b910661d74b3a3a6d9fcaf65ddef96dbb4d0e3100
MD5 681c0dab51487e6f0aec0d8d77120e73
SHA1 6fd22e34e48b46e740a2bcd27ffbaf1002542446
SHA512 94cdeb46b5e7355e9e65c93ce0228588ac83e9f660c343541c64139340ae2a689fa43999343361f320e4ea65f3af1c6c9e78f050aa13747145a3721e337a2a1d
SSDEEP 24576:7ZMSzFVSO5atr0zAiX90z/F0jsFB3SQkH:7ZMSzflaB0zj0yjoB2
TLSH
T12565019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e8ac3b39b5ee244ce5bd425e7e123d40b519291105e4ad44c1ef86043638af9e
MD5 ee2fa4ee3cbbd4504467eba101699210
SHA1 ad66aac31e8f8113f59e1d67cd0f9a05f0794d0e
SHA512 c78d37dc35916b76dfd97d53346df20d81a9d085f3d06c1b6d0d9f1d05f94e701c6d1e74e0d97d3e93463684c0175b82caa3c4ab1eecf671ace0d9a5a0d7cda4
SSDEEP 12288:t6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:t6atr0zAiX90z/F0jsFB3SQkm
TLSH
T1FD45230B341F80F3C8831B355284884B5AB95EB476E36B86F2963F0FDE386C716656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b5062784d6067ba082c86f8fbb1a483ef472f59fd49f7be478bb5bf1abe8deb8
MD5 705e183c94baf692a8f1e560bb7d777f
SHA1 1058f918a8f12b3f350ff9ddd099b6b382603575
SHA512 9caa3d08d7bbfee1abc3f5c305fad004dbb2b1024f2e3f9b42ed14d6e39f8d9d07589cdaba174ad5adc044a42497e0ca014764f59d4c752f975f6ba30aaeb31d
SSDEEP 12288:HOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:HOatr0zAiX90z/F0jsFB3SQkm
TLSH
T15F45230B341F80F3C8831B355284884B5AB95FB476E36B86F2957F0F9E382C61665AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 568de0c8ccccb288ca3e9cf14e1dba46ee67bb67e9ee2ccb1ff23d7f466d2f0b
MD5 5678b279dda4b2f4f78b2e2141d465bf
SHA1 f75883d55f3113fe4113e4c7d2eb93f958d5c559
SHA512 98315fe67beb099a3ee82010ae13019f6a3e5076aea707fdb75b09b311988b4505d56bb3201d1147aa30811fe7a0ea5710e65f837ef571ec97e05cb564d85628
SSDEEP 12288:iyPz5L8tUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:/zytatr0zAiX90z/F0jsFB3SQk9
TLSH
T13E551207326620F9C4639239C9901906F776B83117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5ec99dae30a2c41bdb0b727485bedca874140edf2eb5afffa950bd04b01106f5
MD5 7305b2b1684c4b82d920a5466b1a70a4
SHA1 d516bed1c13ae9f428e6de834bd31d9b95f02ef0
SHA512 7c3109f61f735881079f61d8f877c76d1f7d6a6dc273516c7476d7943d852b7bd57dc35084f5470347566fda29e80ac9e545688eed521505e8bf6ad55c77ca39
SSDEEP 12288:C6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:C6atr0zAiX90z/F0jsFB3SQka
TLSH
T1D045230B341F80F3C8C31B355284888B5AB95EB476E36B85F2963F0FDE386C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 70c0b559b577eedb74aba07692da44653394c86719c6a6311c3ac4397a615954
MD5 08073b97eb4dd7ad79d1923b1b5831a1
SHA1 770f2b7206a80588352cf3f759074da45f6e8e32
SHA512 d7aa5cbead1462aff9327cef77b0830b1f4cd2a73415ea0d0051ad03d9ee5cb7ff88f1431a2ef25744a19fb47298b4c49febabe9bbeb08889641ae801fcb17e9
SSDEEP 12288:S6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:S6atr0zAiX90z/F0jsFB3SQka
TLSH
T1E945230B341F80F3C8831B355244888B5AB95EB472E36B85F2963F0FDE386C716655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a6652ddaa6008242ea4fee9685509b167a92b6c0f4720bffa2023ca8ec316d24
MD5 88d97d4ed7c33f25e2a27fa3d546c5f7
SHA1 b3ffa5c54eedbdf0eb779b7cc8599fcf70fb5333
SHA512 75b6a8352c4c76bdd3eb3131a6636411edf0332a03993d761deed8ebe64648c7c1320803a7b7bd2f5dee321c6c5bb1f7690a9b591e282cb298f4368e6736255c
SSDEEP 12288:iyPz5L8tUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:/zytatr0zAiX90z/F0jsFB3SQkG
TLSH
T14B551207326620F9C4639239C9901906F776B83117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 22a7988736eb1f5020057f2350903a597d0028d5374a21c0ef9b0f3e056c0287
MD5 2eb73933c25c85450b6d1bfcc72d6b00
SHA1 6833e69a0acefc9e08598175f93144815faf6ae4
SHA512 c602582aeaed5ddcadcff66269910f83be7cec8a17c35284652b0d0dfff0d7e307b67f3926d1bfd6a42fc83a6a7bc0dd8d1d8450cb9cab363a4a96f23f2b12d9
SSDEEP 24576:STHaLl3z0zDbatr0zAiX90z/F0jsFB3SQk3:ST6LljMaB0zj0yjoB2
TLSH
T1B2650195735018F9DCA3823EC9548906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 dc0b9cc6a119df40741531af97568f66d7b2e663f3408ea76eeef8bae2a52feb
MD5 061809ca88706bf53d919c4b976eb4d9
SHA1 41fde6a34975caa27a648ec8e1cb55758985c931
SHA512 a9cd76415278ae244685c3fc7c206fa149bf1414fef76abe6cdeb468c77ead6ed43f845957a0857cc8384d31e81b563286d451c8de8c155472d5aac705f58691
SSDEEP 24576:m37d9CHKy7GZnatr0zAiX90z/F0jsFB3SQkQ:I7d9CHKyalaB0zj0yjoB2
TLSH
T17A75CF91F3E810E5F0B39A3589754512DAB67CA91B71DE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6ac42069c826c1f91f39f77babce799c2c3be3cfc8397d8dd2b18254386aa6c5
MD5 ca8fa7d143edb0876ccd904d2ff46494
SHA1 31596e499d233ca9ef7acadc68bf4e7c27a451a4
SHA512 55b85856a9bba6cd1d3dcfd42e20c7d46356b3a23a8d6326f2565f582bdf98bba8b56a9dbff0452563213c50d60fbf64b688137e70bd4775838dc1e6f456f4c2
SSDEEP 12288:wLUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:wLatr0zAiX90z/F0jsFB3SQkO
TLSH
T18145230B381F80F3C8C31B355244888B5AB95EB476E36B85F2953F0FDE386C61665AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f3df1a2a3e071b442826d7eb875a2d60397646f9b275393292704d4c70b37e6d
MD5 97efefaed4da2f403a12c4d7cff47958
SHA1 5b8f2227f02f48159b6f44bdc7913c4903353a66
SHA512 5399dfc5f1a85289fc47944b6b04b7cb3a039c4c23c09ec91deed4b19ee3f3905c0763cd5294f1de8ca58ef7d93ca2ad8ad806074dc903cf81c9f7f28b08bc77
SSDEEP 12288:gNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:gNatr0zAiX90z/F0jsFB3SQkm
TLSH
T19445230B381F80F3C8831B755294884B5AB96EB4B2E36B85B2D13E0F9E3C5C715656D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b90acfb840c02bec23b6a7bb953db73a4d328a5de29858708747e89293baa590
MD5 22f9b6bf66e24ceca8dbf1237b74615a
SHA1 19096d93036aa04798256fad5471790d5e6d60be
SHA512 3f74a76c676fc87b6ac3bedd84adfedbf8bfb92d3e328835013bf5ff3d2489645d6b19c8b6c2f732a9796b95022fb904bb8b54effbee15d469ec02415bdc0660
SSDEEP 12288:MUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8+:MUatr0zAiX90z/F0jsFB3SQk/
TLSH
T1E745230B341F80F3C8831B355284884B5AB96EB476D36B86F2963F0FDE3C6C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6bb3084f4991b47fee5f455e86f1f82a53e1377d924540879abdb15d7b0e3b75
MD5 3ac6afc5f7f412cb584f17f7a1eedf2a
SHA1 aa9d77250fc364a4f072d5f305752f1b4054a1a6
SHA512 2ac86bc52a8e024bef54b37c1f5e9e71700e59088262c5a6d5a1c4c67c22268cb604da874d057837ee575c40679359b8388c8bd3ff5b249f58904a4de26aff67
SSDEEP 12288:76UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8+:76atr0zAiX90z/F0jsFB3SQk/
TLSH
T15845230B341F80F3C8831B355284888B5AB95EB476E36B85F2963F0FDE3C6C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1ab8874904cdb74d7cb747c0c2b8d887f238f6bcafcadc85d2cb51a78b9cb418
MD5 66a903fc79f51f3f298bb7c1bc008b8b
SHA1 74b53f1a54d921dc946c7e8e45b531ebbdfa3e89
SHA512 b3f160f12e58410b331157c96319aefa91b7d897ad8b56143d278b4294f20255102856e2a4928498d57e9412422847bf47b9ee2aa47dba1bb0f8293a12599fd2
SSDEEP 12288:XLUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:XLatr0zAiX90z/F0jsFB3SQk+
TLSH
T14F45230B341F80F3C8831B355244888B5AB95EB476E36B85F2D53F0FDE386C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 22a3f80d36b219f9881512b068214f2bb65b48af13ce2784bbb0d243d0dd3b1e
MD5 a12d2885fab123f7111bf7feb3fcb9b1
SHA1 6b62d33c4541531465fa05cf95a5d90e0023ae16
SHA512 263b570ada5fd320b1fe954fceb3a574504b1d8136eada4740518c4766ff57d09ed2f43b8b83eee4ac2e36140af4822d9a3cd54cf11b3b7838115142e86e4026
SSDEEP 12288:QCUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:QCatr0zAiX90z/F0jsFB3SQky
TLSH
T1FA45230B381F80F3C8831B755684884B4AB95EB472E36B85F2927F0FDE386C715659DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f67d668a55c6af220dea62a31267f4e99cdc66541bc94d5e7fa0beb8a258aa30
MD5 0140ca08bc9f69c2ccf534f4ae2e0fce
SHA1 f44627845eaf12ba3b067b54de8dbfc5d9faa358
SHA512 b020259826ab48e4ea96958fdf19a9d23a8d71bcb0c1a13fe32c59dfdbc535dfe3c52119450fe7389047dadec930020748a17da9587b479dfd679892eac49378
SSDEEP 12288:LIUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik86:LIatr0zAiX90z/F0jsFB3SQkr
TLSH
T1E345230B381F80F3C8831B355244888B5AB95EB476D36B85F2963F0FDE3C6C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d99829970537123fdc81d138acf97916c7e5f47a466f3689f0aa0137c23ac09b
MD5 980450bffa6f0f5d3258be59a2977012
SHA1 ec918051a02c96b644e24b224dbc71b9a676c88d
SHA512 d57d9960e413fa5eee9f36f5d5238ba235908f1a2c3c4c10409257456fce7a2f57fe9b5fa69da00eb2dcccb667b3b722a9da4e19bab029ab73d9b5606caa18b5
SSDEEP 24576:Xfwvok9RX6wkyAIeatr0zAiX90z/F0jsFB3SQkY:RMnYIeaB0zj0yjoB2
TLSH
T12C85D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 89cdb1cf9ef2859f8ec2d193c15199b7b8bbc086281140114e8db8203b17b85d
MD5 a27a3e52cfbe74ddd39502616e35cb56
SHA1 474f5ce138789fe6a00b080dfbc225b9e06c3e9d
SHA512 db16ce70c24e8b6a30d20c79a97daa45ca754af0f620b5615e917458b7b3503915429c2aadb4490a4ff040a38c622acac7a7f02a7ab4b5f1e485defe1471f824
SSDEEP 49152:BYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PaB0zj0yjoB2:pySzPaB2Yyjl
TLSH
T125066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ef486238a0eb7661b1f71438eb7974deec850189658a81bbf50c2f6fbe213fbb
MD5 711076045d28336773126cd1e48502bd
SHA1 733193158192c326256936ff7ac203a4c153599d
SHA512 d3a8ad4b3e55898f6766a981b65b1612e5838fe9c10089fe15de49cdea17d66835fc9dd091cf5c58469c253d39ab8466f37a0104883547f7d66636ab7d3a8f72
SSDEEP 24576:s47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYJatr0zAiX90z/F0jsFB3SQki:s47JUQj1irIhCnDHUPfF/faB0zj0yjos
TLSH
T1A165AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 74e7ec709554786d90d05d534890b2b0b017533724e954800c45bdad24c31693
MD5 78a1338a2c4954b099e827cc4f83a81d
SHA1 4510e6386cbb3e8bb80f296227d49924c7b1fdf4
SHA512 01c9259343f3933be370ffe8c06cf5c815160d8242947c4598340f0c902c41c76d181b53e9938344f2c30eb15447c057b1b329178e17a3ee808e2c630cf0b56e
SSDEEP 12288:cNsfqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8M:Nqatr0zAiX90z/F0jsFB3SQkt
TLSH
T1FB55F00AE25801E5C4AE6239C7544A41B7777C6493E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 aa8ea880dbf7c75b4975f2d6a1c7341efbaf2c6107c5917e047de98af3aa305b
MD5 05747a059925160cce7a1c4a6f7e8178
SHA1 8d35b33d3ff909cc0161a88dc585f1cd84856a96
SHA512 3db75b09efe302992f80767c83322b10d15e6cca1dc6b95cea948f3ddc24bcadc2166b4a8ec3af4dfb1040ec0844a5c661c2c7af1907e318fb758dfc42912bb0
SSDEEP 12288:yZJ5GULqU3fv95e3QjyXVzx/gQ6MKA/OVq68rjf2fmfUpXUPyEGlU:yZJcUWUP3KXV94QI+kNUjf2fUUpb3a
TLSH
T146452701B62AC78FC66940325E76D6CCA7707D01FE49AF0373C9473F9476658BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1009KB
SHA256 93a762863e9609746585b5e88b63dd687433ac583639a8022a5edc90c68424db
MD5 2a077ae4b2f65d4b62fdeabcd4b1ef96
SHA1 1f06acdf8f3e2beb2fcebca6826156261a66cbf7
SHA512 c65c013123f82e7e96bf4908fa763cb21f28ecf538698ea1248759cc607737bb99e7fec71b32774579b24411ca0e7c8365208cacf0218abeca71926f55eb28b1
SSDEEP 12288:WKhSXa9urFh0HrBnliv59bqSF5VtuTvbpdcz0xu/9Vo5hT:WKhuCHVlOrOSF5VqvbpdcD9efT
TLSH
T1EA252945B177A70FC6B640374230C6CEB774AC02AB493F0573884D39D8AAB59A6E57E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a07f60cadf0cddeaed61fd4cf54d632631af79830943b7cf4e5e62e19f33338a
MD5 20c742c5a0e4275f398fc21089ab453f
SHA1 508da50c0b2e64c4feb4306151afaa79ca9e543f
SHA512 e6ac04c78b95c7d43aae0376b7b3c979f540e136e70c46a255627fb68fa1bc238d770ea22f057b4442bc38f5058961ebbf0bae998fd8425afd189eb8912af839
SSDEEP 12288:dM7yUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:Wyatr0zAiX90z/F0jsFB3SQk+
TLSH
T138452307351E80F2D8A32B3412588816267EBE746BD29AC7F1813F4F9D386C65E756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 93893a5de226b4a0e9d47a6305c1ea541e49a09348fcb12569df6055edb20c60
MD5 517ffea4974abd84fc4c3613ee1b51d4
SHA1 77f51e662e45d976978da7b5738a5807561b329a
SHA512 b41ce582962f5b0ce418823c3de7f8b1ae47ee8a1cef9a391459946e7a3474ae4995575dfa3345352553d35d89fd96da49ce22fcef764b98d0016c6f7c9a15fa
SSDEEP 24576:8gb6bmBIi49WNNFpg1rSvFv7bYMatr0zAiX90z/F0jsFB3SQkM:8gb4mBIBhGFJaB0zj0yjoB2
TLSH
T1A065AE1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 1c8f92ea35c56fd37e1abf3c81fbc1ebbe498c2303dadaa3b3c65f7bea44b7fa
MD5 4d946c7c9e6b34bd56229be324faf1d3
SHA1 4e488cf245e3ec903ca624755b465e6200658c5c
SHA512 445e4d3a9b8b2cf0bfec3e434b1366d6dfc5fc143bc38846c8fddaddc0a14738802a319d5d0399b5a6c3920c5ef598d49017a19be4dec569ba3ae5ec0c0f7475
SSDEEP 24576:PG88u8FpJqH1bzria7/m5atr0zAiX90z/F0jsFB3SQkE:+7ZFPqVea7/0aB0zj0yjoB2
TLSH
T1CA85016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7cc616c59776f48c0a8b7370937c378a4b43297c13ca3a862f3388ef1dce2760
MD5 99002a4e100bc74a97db70f2ca185b94
SHA1 19f8b7b9c8c0ba6f98016e7fb8958d9eaf3f0d36
SHA512 9a78b07a77cab442e1de05281a606ca822bcbb1e1ade8dbf0980ac3932e88683fee00044f8a5d1a318b71709b2a1524859ef2b06adfa16d45611b0a43ceb021c
SSDEEP 12288:PHvUrBFrEjwaQlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8W:PPUr+NQlatr0zAiX90z/F0jsFB3SQk3
TLSH
T16A65E11F22AD18E5E677A13D85818609E772B8621352A2CF02E0917F4F37ED8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c4220a83f8d314310caba5afca1bd9dce7e1de31ecc96b5bff571e58dcbd3d09
MD5 2f00e63d143e74ef1e3e807600bc9101
SHA1 8851ea61c944f6d9ad9f7d6563cefe684079e41c
SHA512 68de39a0fcd764fd8fa7742d3b7908a483e48f99182d1734b84ce5b8042e2065d3befe05494ee7b0764e4dcd99ee2763abc604e64c75585c993daac7d4eee4e5
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVaB0zj0yjoB2:VG05lO43bxB2Yyjl
TLSH
T116D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 07903a3e6bf4271df4bad28eb83280c666e5b2913d3452ccd7d48939a6635d7d
MD5 d415d9052ca43b73c9ce74d82d0b4e2c
SHA1 8767fc939485721a896130b939dcd1b5b446c857
SHA512 5af52d7106d56bc6f0dfe2b866da6a3754eca9a3416639dbd536ece9270c3d7bb2ad12f9d23ee599ef839aa1da6dc4b72df2ec27fd4b83b2353dbe36f2b2a506
SSDEEP 24576:pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnPatr0zAiX90z/F0jsFB3SQkt:5a5POZ3+Jt2pasx2+mNaB0zj0yjoB2
TLSH
T1E565BF5EA6FC00D5D5B6D17DC583861AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cb1d385f4562f5a0b3cc9225b8277d6b1bccb51070e9e3fb4c42569c5a3f34e2
MD5 c7e1a031104a94fb6a399d9be48d8644
SHA1 011c636c295bee38e41e9d35fe1add47002a2c2a
SHA512 c65914bb64227a95d76aba81d7662a7f2ac258556498540d70d92a00988181846fbffef9f97ec63233974f8cf75ca6d9e327b7bb8f616b956cbf2ba92c9bf30e
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkRatr0zAiX90z/F0jsFB3SQkH:INc/zEOVHFUaB0zj0yjoB2
TLSH
T113858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 43bf965aabc12ee8e52b93c0889169d8d8bbca181cbc0e99713ff0d4bac94675
MD5 d05d28d8b460375519695509a46f7107
SHA1 021b874ef6d8e4b576639ded37e2b2023828db39
SHA512 0583b09ab328459f377b8a104cbb380d6f6b153291281286d762d7afd88da514a202a4f733e97c0b3d44f2ad1b7748f18c8800b04cc4cf3ca42b0f33c84a488e
SSDEEP 24576:H8kNvNnaFeYhJNtmZBmXatr0zAiX90z/F0jsFB3SQkX:H8MwBtOmXaB0zj0yjoB2
TLSH
T1E055BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f2712d52e290136965d7ec2b00aea49f50bcd8d9d0df641f0d3f703b52c62ba5
MD5 1f41da9e5dc0abd3b6486aab45584c54
SHA1 74c0131febcf8e0f1f1173b4c704287df78d89f4
SHA512 0f4be9a012bb6613cc5ec3f1ec1c1c28dd5238eca0151b2e81f01a0688f4553d778d0cf12dab889ec6c9bffd216ce342b22838fc2ef1eb2ff4f28b85872799cd
SSDEEP 24576:VD3FHshBIYQgA2atr0zAiX90z/F0jsFB3SQk/:VDVHeBIAA2aB0zj0yjoB2
TLSH
T19975E13EE65D00E4D47BD2BCD6638906E77138A8036266CB12D091BA5F6BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-308-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/572-107-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/572-114-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/572-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1052-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1052-126-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1052-128-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1052-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1052-120-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1060-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1060-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1060-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1060-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1208-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1208-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1208-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1208-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2104-71-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2104-72-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/2104-77-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/2104-274-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2188-44-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2188-32-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/2188-42-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/2188-31-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2188-38-0x00000000016F0000-0x0000000001750000-memory.dmp

Download

memory/2588-0-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/2588-6-0x0000000000C00000-0x0000000000C67000-memory.dmp

Download

memory/2588-7-0x0000000000C00000-0x0000000000C67000-memory.dmp

Download

memory/2588-27-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/2588-1-0x0000000000C00000-0x0000000000C67000-memory.dmp

Download

memory/2600-509-0x000000000F100000-0x000000000F97B000-memory.dmp

Download

memory/2844-370-0x0000021A8B710000-0x0000021A8B730000-memory.dmp

Download

memory/2844-384-0x0000021A9D190000-0x0000021A9D1B0000-memory.dmp

Download

memory/2844-351-0x0000021A8B4D0000-0x0000021A8B4F0000-memory.dmp

Download

memory/2844-353-0x0000021A8B910000-0x0000021A8BA10000-memory.dmp

Download

memory/2844-339-0x00000212801E0000-0x00000212802E0000-memory.dmp

Download

memory/3388-60-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3388-68-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3388-167-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3388-58-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3428-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3428-101-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3428-95-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3428-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3428-305-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3428-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4760-53-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4760-131-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4760-46-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4760-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4760-47-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5592-507-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5592-83-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5592-292-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5592-505-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5592-89-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5592-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download