d29f40aa803b69908c1226fc13f7c2e68f2b05838e75d4481c5be8c35a181bf4

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
Sample260706-3tyq7sdw2x
SHA256 d29f40aa803b69908c1226fc13f7c2e68f2b05838e75d4481c5be8c35a181bf4
MD5 f8cff84df1cae870581b1e7450c6da3f
SHA1 9a474f175a0e106cf0bb212a5fd65e4f862b5bf7
SHA512 84873162d5631910640166d5afd5a63387a32d02ac5f7b2bceff4ad76d95b9bd5cbbd0fb2fd3223b270928b5f6995b9958a78d2f9a3946bc3b48283aa77d5005
SSDEEP 24576:W3qgcetbQz43+whatr0zAiX90z/F0jsFB3SQkd:YbNUBoaB0zj0yjoB2
TLSH
T1C975BE0137E89131F1F73A767DB692654E3A7C61AE31D68FA240AD1D2E326C1C934B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4160	elevation_service.exe
4468	elevation_service.exe
6040	maintenanceservice.exe
1188	OSE.EXE
4984	PerceptionSimulationService.exe
5880	perfhost.exe
5132	ReFsDedupSvc.exe
2836	SensorDataService.exe
5432	ssh-agent.exe
1376	AgentService.exe
248	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\872bf33584defa61.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de475411a20ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000794b6814a20ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e2d8b12a20ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000160c8e13a20ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a085011a20ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4160	elevation_service.exe
4160	elevation_service.exe
4160	elevation_service.exe
4160	elevation_service.exe
4160	elevation_service.exe
4160	elevation_service.exe
4160	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5444	2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	4160	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1376	AgentService.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: 33	248	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	248	SearchIndexer.exe
Token: SeDebugPrivilege	4160	elevation_service.exe
Token: SeDebugPrivilege	4468	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 248 wrote to memory of 4196	248	SearchIndexer.exe	99
PID 248 wrote to memory of 3748	248	SearchIndexer.exe	100
PID 248 wrote to memory of 3724	248	SearchIndexer.exe	101
PID 248 wrote to memory of 3180	248	SearchIndexer.exe	102
PID 248 wrote to memory of 3716	248	SearchIndexer.exe	103
PID 248 wrote to memory of 2092	248	SearchIndexer.exe	104
PID 248 wrote to memory of 5532	248	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_f8cff84df1cae870581b1e7450c6da3f_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6040

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1188

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4984

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5880

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2836

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5432

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4196
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2736 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3180
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3716
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2736 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f930ec7df5981768dec87e07f1f6a42caed85355445e71ae767e68750ca4f258
MD5 aead572cddf17236c64ad488558a6e1d
SHA1 0cf30cc385367ee740eb3519a3dab0e7bbce6796
SHA512 960dfe57b2ef1702188a9c1d3c997d1b5147d80da73652be7658e795fa44999c5ec1b6bfd1f92a867cdcd52789f36c387f0427f0ef77ea5dee2888e350a5dd54
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnlaB0zj0yjoB2:33q6HjBvB2Yyjl
TLSH
T121D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 14fc130aed5126c9e33dfbdc6f7a64fc729ef2de2dd4672d572551584eaadc82
MD5 f06c471a2b657e928fbfeda88a2ca8fc
SHA1 b62a6c4ba904d47c551592cfaa3f441b466337f6
SHA512 30b8f930e2a6a0d720a3985e083750a38abf11f673e8845cfe77084b2dc4a6b3119e5c8c40284db3d7742e21d0d8ce07da5f703992978e964ab8593292b040da
SSDEEP 24576:GXYfDtczAkatr0zAiX90z/F0jsFB3SQkG:ltcPaB0zj0yjoB2
TLSH
T17565022977D504F9DC67823DC9A18506EA73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4464b0942818a054af5e79b1a4522ec967408ee9e96065efd7e055d1dc22b5fa
MD5 ea9f8763e56feae8b8aff050d08f4c5b
SHA1 1c3f2e1c1d0174fe1e5422b98790b02badc940f2
SHA512 37b54aa1eadde4642f0c5d014206dcee5d89062d6952e8d660f8798afbfd166221e91f7b49828c73b92f6ab5be8eec16635e7086fd40d2f64a3596e23effd517
SSDEEP 24576:D0Le5ji0hmxirMxatr0zAiX90z/F0jsFB3SQkW:DPji0AcqaB0zj0yjoB2
TLSH
T1C9859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9dcf5c4747e6bd716d081e3b9f7c0788a4e3ee0adcdce55745aeb47e20349842
MD5 dbc362087f6fbdacfd4bbadd88b3a2a3
SHA1 627514e4b5313f1dda32c08bef70084852375bf1
SHA512 521fc689c8abf8733fab294bd3dbdbeac4fafa2942758071b2baf5c986428547479c6418393c694f4f59c2ff02bf0b042596e3da2fe6dcf26094db7a07426c21
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWE6q8wyujatr0zAiX90z/F0jsFB3SQkT:U/ezSC6vUzPvxHjy+aB0zj0yjoB2
TLSH
T144755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 062d04d19ee88b8eff5eb07801c34e792f85579e9db767f4dd36f28b3ba92510
MD5 218bf2a55e25f86c1c36e8773c72edc3
SHA1 80d684f71613fb7aefe8521bfbf0390dc12331bd
SHA512 d411fcc7cb99b6eb39166bb9dbc47cbec21d6ddc02ccc5740d7ad92f2c3ef98a04a3a9e305192c51152a01e8af78ab45abd959430518b500e05cb457b04f2dd4
SSDEEP 24576:qVbqPb88hv/l+6Qatr0zAiX90z/F0jsFB3SQkY:qVO88hXl+VaB0zj0yjoB2
TLSH
T1E655AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 169acfd764a8daff74b0673c858ba7bade8c51c8e89b8ae9bdcac8fa4caccd26
MD5 400e99802b7188a665b625b110f7bb50
SHA1 2b43d053047acdc4e66007963d90f85f1508d004
SHA512 2c9dcbfdbe262516ee6ee2f029d262e1e4ed3e7a5e9619b0f2e94df4e48d93ac2d9ac2a196435caee1cdbf0e954f868feaadd6b28b3bfbd308e77cae06ac2ef6
SSDEEP 12288:SR9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:SR9atr0zAiX90z/F0jsFB3SQkg
TLSH
T1B245230B340E80F2CDC31B3566989C4B1AB99EB065E2AF45E2913F4F9D3C1C695656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 10ad71073ebc6c948ff9ac0b872a695119dcf2fdc1d18148ed7d2c7d79a19492
MD5 2f71d653d8471dc781707866b40fc79d
SHA1 27da6cddf7b78f9ae33e0e96abddf914d0681c3f
SHA512 4b6577aa195f87f1107aa7a506760a57d6d33c905be656f345e0037e3a7d4e4f42c5fc215ec453124421d363bdbdae3597b213f27feee325fcd1572d6ef4fa9e
SSDEEP 12288:ZeBNUbTVO86UIUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:ZJIUIatr0zAiX90z/F0jsFB3SQk0
TLSH
T16465DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBE165930EDE235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d085c34414a21c6dd38c86834b2fb8faa52cce98d4ba519f200e32b51db90e07
MD5 84282dc4739fdd2d08ba2dbebaff831d
SHA1 a7673f2b642030c53cc82698c7d51397783075fc
SHA512 5339668a3efc50e6af84997cb1134f51253771c61c4169ce6752d84e94eba9e9cedc5db17f0f37998d565a4bca8c84934fb54b88a50f05084e9c3fb3c97e6c3b
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:dQvGAdlCEL8c/yRNw5C+B2Yyjl
TLSH
T198267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 99a2417cbb4c770fc7b29c8291c4fb041effa611fa20147015b44fc2ca8f7926
MD5 24b917640a085707f20f5c3328aa0359
SHA1 26538de63262c1e60d9c2b4a70ce51517025fa87
SHA512 c4ddaab2abaca07a79acc2b92f29d83152eff9388f595c25d9eba0e49bbc2a4c8ab120c782753d8b06679e81041db11b5934e5c37b24bc324ec36513028080d9
SSDEEP 12288:HAwSfxL/2Dc34DLLmt0LDQewsAj6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHp:gdewsAj6atr0zAiX90z/F0jsFB3SQkx
TLSH
T17275E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E89E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 610f6677019cab577350ff6d7f5fc5b2d8c71314f977132142e194346a1e5966
MD5 9d6f690a7f72e5ba3e6334c4143bc637
SHA1 16d08434ddf04e9a61e1551c8bcebad17175083c
SHA512 2d4709df722b817d23bc8d9c9eb8f0e3124f7cd8021f4fd4f9f5318ce1ab88867fae1cc81c521a9f04348a0301f3f8c579750596bc11ab55fc31120f6953e582
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHlZ:1UEtQevvqc2W1cpV2EI32/
TLSH
T139474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9ddb069f4c26ba194766f52c6aa2bcc4969f51c7a05356853206d89838e635e5
MD5 afcb37aba21a5845da83a82ad30ea1f4
SHA1 b8bc238b513b7868456b97d8ed3b6056465205c4
SHA512 06a37647beb95800eb84ab69f5a2937341559c7f3c036366c36b6c801cc30abd23dca537b38d0b5204ec5c24c8dc025f978b5cefa6922620381442f6b7ee1152
SSDEEP 49152:NCbRquA/m2yL5zQfFiV+XenmE3/zaaB0zj0yjoB2:qoqtVjnm6B2Yyjl
TLSH
T19CD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7cac59a0d560f203a18b256d22e80549f3dc315109833687d226db4b5da2749c
MD5 c45d2e13ab0c2ce7f0533187eb2685e6
SHA1 62c7fee54a7e83fe90589ec833e4e98f28cd4f04
SHA512 35304e772b3639d6f87a5fc1f21873725aeefdaa899d6a4e1de32edfe146c41734a9b3325f9e867a0765ea5c0052f083f418674d3f052e588ba96c4506232120
SSDEEP 24576:zAhGLJIFoiwtA5l7S53natr0zAiX90z/F0jsFB3SQko:zAMyFoiq5XaB0zj0yjoB2
TLSH
T1CA359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 dfc1aeb8b211f02ddd2ddf01b094435a582c1c8ab005ae143b59ef77987a31e6
MD5 c3d64a7bf5eb7fb79510f828345f4e78
SHA1 b07430ae7740de78bfd2808d504beda6c1bf333f
SHA512 6b407653d8094e1b1ffac5b34db62fcb77b091733ebc816e15c567c13a71b411a51d7869bf2930008c66a6b3eac217084fc72784780679fde068747d993a4077
SSDEEP 12288:0mw5HEjsChNVBFgl0WDm+C/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8w:xwuoOWOatr0zAiX90z/F0jsFB3SQk5
TLSH
T1E365F14A36A90CF9E9A342388587C536E7F2BC112A61DB1F1360CB5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f1be43ad5d1d86430bb0e7dc8d81285e27453b02ee37847cc89c8f976c680d1e
MD5 96ff377f12efb1ae737ecd69663a987a
SHA1 4dde698434c6637613a7a6b7548f040d39886117
SHA512 8ed390e17b5e7a1611c6f376974b8b44ed7a441729eeb8d573121d45fbafff45ce6bfa4d46fd60b7f49d67c0dfbb35933700e4c1ab715a6c1e19dccfd9654519
SSDEEP 12288:HBZ1IyKUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik89:hZuJatr0zAiX90z/F0jsFB3SQk8
TLSH
T1AA55124B329960F6D5D3523C89E4490AD7B2786123B283CF22607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e1644e8c570970a506c403c42d6f85222c5807c293d139741ec8791caf7f8780
MD5 f7fb2f7e8e24ad7aef5d16bfb85052a1
SHA1 610b0d0a640800b42d4c35bf1653f4196fcb2268
SHA512 9c6eece50797a4ce2b9011aaffaf80d3e9bfb61b83430867924ae42968ea9415f872214dcbaba97e727ff01f6f9383bfb32f82a36a8375e26c3ddf0423f31bc5
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:cQRQyi36YOcPQLvw2gAf+PN3DB2Yyjl
TLSH
T11F667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0ff723504ca3aab42e73a6d045af28949794b5e20007c1f712dcae341f8356ec
MD5 0f4ae91e2f3d131aef1ec7861ddba162
SHA1 3375f4c11b89be30a6713624670b1e1980cc6cca
SHA512 4c11e0321d62855e4c0a0c0c10c2896dc55969fb036f494f894e31917df9424547b0d0949ba563c2b2e5bc534bed235906afcdee4e861bde2cc2b4ed1a1f31b9
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:GQRQyi36YOcPQLvw2gAf+PN3DB2Yyjl
TLSH
T183667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3f720e63dead8cf96c021265650d53a1f4a34a25ef84701a506dfad2d6a11b34
MD5 04d412e69b03b53c76d0ba9c44574f36
SHA1 1ecd6b168efeb8ea97b59e397b71be29c839a698
SHA512 a23e4508c70959aa817eeb2159d315d673ea3702a61ae6bd4c3405df544daedeb191eb840680cee07e7241d9d86c54f04614adef34616c8b2f4e4ad19a9d28d3
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL05atr0zAiX90z/F3:S68Qg55nhheWu7PNU3/qaB0zj0yjoB2
TLSH
T1AFB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a9f60569d5eedcf92307617e27cf33f08f7b080d8b3231c55760aebb1defb649
MD5 9384dabcea2771a022cd519286236e98
SHA1 aede8d1542dfc1362895be5d52bc2978c8df93a4
SHA512 50c3040a24fa6b77fe38671c9f948eedd26c7196d60a15f27461f36bba8ccd856551b4e4599e6428d8c77edf4e8751140a244b9b46d592b9bcd26adbf64c018c
SSDEEP 49152:03aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99k:hy5112gYy5azzVvL69nLKnhZsB2Yyjl
TLSH
T1B3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7638f2897f52d42df8111acbd8d24ce0fccd93ade4b2f1db420d29fa2cb84c92
MD5 ab0d09f26fa3aef7d1216b2987c9d2a1
SHA1 68c3e11908a88871a9398f5fb36b09c4f92cfec7
SHA512 972c139fa2dfdb2814c3e366ac422dced603b8cdc9c016844785fb7166f3a6b0c3b78150de03054b5cdb7128fa09f3ed108399b09b2a546164b1cc5bc8aa1314
SSDEEP 49152:zB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glUaB0zj0yjoB2:Fu6JmVxd2dLB2Yyjl
TLSH
T158D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 16fd4839f925431202e6db77feb206f246ea899a719f3ca0423c5789674c1d69
MD5 798c25249d5a4bfe77003bff8b2d8398
SHA1 bd13c9db4a47200cee10d706ae55048a67f9d436
SHA512 4bbc1ec97ca4b65c54836cae6476b552f8f337119f75ca2664e6e510371ddbacbd788e97448b0e82b826a80779138ee68238d47a76e3dff5e94bfa141df6ceed
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xoaB0zj0yjoB2:kmifPbR6B2Yyjl
TLSH
T15FB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 10d46606868bf8cf37ebcd4ad7654bb13c19836bf03f7a2574fcc6b5d9178560
MD5 c12ca0b2c93eb8b0d3e522fb961d3900
SHA1 4185dc04930932f3988d4c3fe37ced85d5f38d5f
SHA512 731167d83b55d6008c2222b0788681b2cebf6213d8f25c5806a098afb34fb6f2f7de427bb4b93c7feedbc409fbabd04fbe33664a4cecc270e6d4c6ca7a3fbb62
SSDEEP 49152:YSuZQIY0Be2KRRVtOnks6NMHqJaB0zj0yjoB2:C5dKTi61QB2Yyjl
TLSH
T14FC5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2fec0d279b21d89e8d2eb3a748c361764291e2f12051e5fa686063790d658888
MD5 80b770ba9ad2c38be83b46e2c906334d
SHA1 976182ee97c908898893e7a1f2c497607a03c479
SHA512 eaba2c396ef026c1f2f8a1a6d0f2472f0f803312ac5f5fe30a6e7464d6d1fa6130a38108b1d3e3015d1157e66f0c5a790c05d47ef0e2796eea85ff5521a832f3
SSDEEP 49152:ehtSn8EApI0figngiDn0AP5wUaB0zj0yjoB2:/X2iyphmB2Yyjl
TLSH
T15F95BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 67d07a007791b15abc18e7ee79944156a219910d76c390ff40baa275983b54d1
MD5 2e16302d545932ee9ab430665ff0909b
SHA1 1c15c15275295cf947462ebebd505c9c26522c89
SHA512 adcdbf1f9154c02ca309dabfd0eeadc2ce0f61bb3415a7cb0103d109ee8474b57d4c9d7f79dd7487d6596523cf376c6e11799fefdea98cfc69ad848b4afbf23c
SSDEEP 12288:9VUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8M:9Vatr0zAiX90z/F0jsFB3SQkt
TLSH
T17845230B381F81F3C8C31B355684984B1AB95EB4B6D36B85F2913F0FDE382C625656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c76ba823e340f194e6fae9d13c9dfa260a2ab465a69a2a77d2dd5af0c2afde4d
MD5 a65234dee7925050883db519aa2ad8e0
SHA1 e6001a6ec16e0a6db020991fd41e1f653745f17e
SHA512 4b211e620e9e1239c0761b8dfae0e13eacfb2890b279471ba9906df44a76d8414297e07974337025193e1b1a25c74809360843bc2cce9cb045982edb224aa721
SSDEEP 12288:mmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8M:mmatr0zAiX90z/F0jsFB3SQkt
TLSH
T11F45230B381F80F3C8831B355284984B1A795EB476E36B85F2957E0FDE3C2C62565ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4ef9f43c75b49acc6176aee438dd4b19019a670a60d9622fd661e8a5ec08eda1
MD5 469abe995e9abf6678ac24af707b85bf
SHA1 bc771c74a554d3f06318f88a9f675b923c18ba00
SHA512 107ce8b798765ccc0d79de659462a60d5bbf3d5fb3714aa588dd9c012bde020378d1ab268ef695c97623d0174186f676704dafd97426201645d350ffad0e8e13
SSDEEP 12288:tAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8M:tAatr0zAiX90z/F0jsFB3SQkt
TLSH
T1E445230B381F80F3C8C31B355244984B5AB95EB4B6D36B85F2D63E0FDE382C626656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 90cd03ac28299c11f8e3b675d22448abe857ff5af37f31c8dad86a0dbea5b03f
MD5 02ae2ebd4486ab35e9ff0577dbd6bae5
SHA1 64ebc85313ff014e5d57416b85e79acd65f5886d
SHA512 7238fb5e550ba59e4c0117b7f86d56f587556013b694f42a16f06868afa9d75bb43f38d750d6d918852cf7a8535fba5c14a4e40a130132a5cbec1334214a6968
SSDEEP 12288:lVHUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:natr0zAiX90z/F0jsFB3SQkR
TLSH
T11545230B351F40F2C89397358694884A96B5BDB0A7F3AB9FA2413E0F5E343C56934BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 47d24b402d7aa7878c055449499ec7ff8dbf55f8db223d34f1e62e26291f7ded
MD5 6675d1a2ad71dfa7913511a2e758a0e3
SHA1 f4c16c34874810103f5d885ae0aaad78b621bc23
SHA512 ef6f16e80dc3be46ac6eef5f7bcf1e78dc6423b2c788879fe91856ebf7b4fd220a4d2e094c9bad8e903237134c716cc7c6fe189d45174a31046245cda581cee9
SSDEEP 12288:lPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:lPatr0zAiX90z/F0jsFB3SQke
TLSH
T1B345230B381F80F3C8831B355644988B1AB95EB476D36B85F2D53F0F9E3C2C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 75345420efab0213956b414e0eb780c185e7b676d8098d7ab0610b76a5cd3908
MD5 2298065126aae3b892bbe32cc17afbc8
SHA1 7a85736445823e4ab70d2479718680d6e17219ac
SHA512 adf91dc1210f847ef6ee3812bd735a35ad1af971c902c0ce082b7e40561c3f4d4fa5db85d16476eea685161de719de971a4d3bef09693e5212bd25d87072040a
SSDEEP 12288:3yUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8T:3yatr0zAiX90z/F0jsFB3SQkm
TLSH
T18145230B381F80F3C8831B355644984B1A795EB476E36B85B2917F0FDE3C2C61665ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 646222d0f09f712edf751b24f2dd79918df94d5e341912ee90af12bd76c35e4a
MD5 07fa1083ae1b13b230b4c46d215b92c0
SHA1 70536b48a58c28358d5b8864e9279f39a1831a50
SHA512 8b103386db25f77d77d08ac0d0f1b5cb65abbe35665595d5120a5467b969211c322a70637d7685d8a98efe25fba4154da0416f8956c5893f9bbf2a6eb3556b91
SSDEEP 12288:/OUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik84:/Oatr0zAiX90z/F0jsFB3SQkJ
TLSH
T1D645230B381F41F3C88317355244984B0A795EB4B6E3AB85F2957F0FAE3C2C625656D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7508707f1876aaf16b1c9f859dc410e8383f1ef416c95a0121c352c6b676a9a8
MD5 4e2752dbcca61d6211b6b3d155fedf8f
SHA1 605546c63f5fb2bf97ec61b02f4abd277ec2cd8d
SHA512 f6b0c918ddec76fb024e0cf2ed445dda5e71b59dd8f51cfe93fa9c25d8c03067dedeec54c1ce0b1f0dabb72163f025a553edfce1fefdb6c0f558e64fdba4a363
SSDEEP 24576:AZMSzFVSOGatr0zAiX90z/F0jsFB3SQkR:AZMSzfCaB0zj0yjoB2
TLSH
T1CD65019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f8ece178d36ccca7b0e5495782bc0edbe9e41be3d5a068c12d0c4b48c4b1c438
MD5 8a4d80a28926f8effdf8fb6aba9f83c9
SHA1 1f2d118694b4223774acfa0930ef95252ed71402
SHA512 23a9b59b799e62de18f3b7ed0ecbc294f1f2bde2d6625e4f71344313fea2ab6db1b7af0a5b635d6b8a992fbfbdcc529a6d959bb4c4fb791d4d22b5e226480322
SSDEEP 12288:aZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8S:aZatr0zAiX90z/F0jsFB3SQkT
TLSH
T1D345230B381F80F2C8831B355648984B1AB95EB476D36B85F2963F0FDE3C2C615656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cee2cc2619928d64b295648ffb0873993e6b3223abaa80aa2762697e35fc845b
MD5 02dc1182b2cd8475315d0d71251f2d73
SHA1 203a11b57666de30330c59206800e27bd048bcf5
SHA512 1bd69f1a14d7081927282de50e71a5c1430fa26e8f0f4e22865543b244d4c0f98038e45b69b23fad0fb2aeee1b7007afb9559668dbbd30d4b0c5f0d05df7916a
SSDEEP 12288:ANUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8S:ANatr0zAiX90z/F0jsFB3SQkT
TLSH
T1A145230B381F80F3C88317355284984B1A795EB4B6D3AB85F2957F0FAE3C2C615656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a52e043ba906f5ddcb160fc415dd2a1cbf1f1cd3de78c5e0974088dcb82b5fd5
MD5 8aaf2aeff9dc281b2c56c906f5c88a20
SHA1 7ad34804db22b2d362ce86c5c0a6cba808b25993
SHA512 d4949abd52f331a6bc1391d2b58aa6942282e08c480f7c3e5f0b003415a6ddd350d0276a2f000be50a0a8fb563643a87a07e64fd39f26c7e376440ae637a650b
SSDEEP 12288:OyPz5L8KUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:TzyKatr0zAiX90z/F0jsFB3SQkq
TLSH
T124551207326620F9C4639238C9911906F776B83117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 145a2d4427f346d53fa8bb22c5cfa419c156e7e2b06dc7de66a11b17d8a23c57
MD5 285d9f786fae8ecf698744acebb5ce15
SHA1 bed82fb2b565b9bffb36ed150db6a6a247250f6f
SHA512 6246f91154b00b89b3f5c1e14c940c0b0a43a81aa86067ad027f2ffce7a1d5bd16207078698b9404cedda423251e4d2ff112536e39dc10317174a3c945b53b96
SSDEEP 12288:mZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:mZatr0zAiX90z/F0jsFB3SQk5
TLSH
T19C45230B381F80F3C8831B355244988B5AB95EB476D36B85F2963F0FDE3C2C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e636d53b8fd74cde4db7e3edcb0b6e02b353f37395b3328a6c06d76fb23d53d2
MD5 8e1d53ff1ae9811f6940cc923cfd1cae
SHA1 765d40b5d0f1069faf950450751ce91fffa7ce7b
SHA512 f83856a0941c458a7ce87c507e3dd5aed2e2679dcde343329a9931578f2684de1bd772af26458ae471808a08deda44aff314e6a9db4e70f18be0f265d71edfcc
SSDEEP 12288:GZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:GZatr0zAiX90z/F0jsFB3SQk5
TLSH
T11545230B381F80F3C8831B355648984B1AB95EB476D3AB85F2963F0FDE3C2C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 aeaa1d8251f2f3d572aec8825d83fcd197f2603a3da609822c89e515276ab98a
MD5 2852f53b5f507c2958c0df78ed1df87b
SHA1 8e8477e7c31d9e08d3dc7c6b385eb6c4d2730117
SHA512 e8977b0be6c0a52c00b1d3f2df9b127a4e305e100d05ab672f9f1ddc78b86bb4c6f8d3186b62f91afb95290b9b4415cfe98f9d3de2deabe209c9d94d176a7869
SSDEEP 12288:KyPz5L8KUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik86:XzyKatr0zAiX90z/F0jsFB3SQkD
TLSH
T150551207326620F9C4639238C9911906F776B83117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 17d126d6026652eeb32530a8d9b2f5a40ae4a5e44d22890ffa0b76f394132559
MD5 6eab6848186e184f9f40ceea6d15f1b1
SHA1 09cee3b01e0dcc46a50ba40f7d1e93316259e3a5
SHA512 474c187c11f6f3fc61f7a43179c64ad738d02b838eb42d7852e26b3b9d9aa5522c870884f3890a4f0258c66bd37a718002564dbf2570533ba72d07bff4961f23
SSDEEP 24576:zTHaLl3z0zDwatr0zAiX90z/F0jsFB3SQkh:zT6LljjaB0zj0yjoB2
TLSH
T188650199735018F9DCA3823EC9548906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 10f09cfe9d1a3c080cbc089c63ee501c76ade6fbbee3cb3ee1f9a3480b495266
MD5 833d54fde16f969775c6a84ba51a5c70
SHA1 9498b7b600e1284161b507117100ee625ed79dd6
SHA512 cc2333a1e0eeff8f26a8bf3ff45fee65f4061e0515713935f597bbc2b285761e62fe4e1c0f718dfee00507af245999c6f0064e0aaca505044e77ea25fddf32d8
SSDEEP 24576:B37d9CHKy7GZsatr0zAiX90z/F0jsFB3SQkw:x7d9CHKyaCaB0zj0yjoB2
TLSH
T10B75CF91F3E810E5F0B39A3589754512DAB67CA91B71DE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 dc8cc186b00d66d101f688a8c8d1a6bbd63f4436151b1fee1612d7caacb63bc8
MD5 1fe9597103d0ee6764ad405f6f0a09ba
SHA1 5c8d818e2c28e37aee442b75968282a3cb33f7af
SHA512 548ebdcd6887abf7c66fe0b2d8cdde0235a58859342d6825d1cf0a890cf6ff8a03df36663e6177c9db6c42f84ca659024123af15d16f472c64e2f1c90ffe8d81
SSDEEP 12288:0gUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8U:0gatr0zAiX90z/F0jsFB3SQkV
TLSH
T12B45230B381F80F3C8831B355248984B5AB95EB476D36B85F2D53E0FDE3C2C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 234a5ace7379cffa1f73022572ffac0aef5c6c7ab9f44b2ef7b36da6899d240b
MD5 901eb1d3c9411eb81634713d2565ae7f
SHA1 ac1cc6f07e2e0ad59138bb4796a111e8e3329cdb
SHA512 d1c1c2b1fb264875e08b582676311f9d4613ff010572161ac57c2acc077a5fdb26f29f22d801733a170f9b87927d4943a352206b5565820eb3e13b0d713fb9a7
SSDEEP 12288:HqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:Hqatr0zAiX90z/F0jsFB3SQkt
TLSH
T1A845230B381F80F3C88317755698884B1AB95EB4B6E3AB85F2D23E0F9E3C1C615656D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 179ad05686df6a9d34e4610e22213c7b5f41f37bce6361183f0cac40927ff9ab
MD5 1cdc4ab6b833dc98506d4546df713f28
SHA1 d8e1b2a33607cf0bd884e8b546780b05363864fb
SHA512 3c1bf87fc43f4ee28d3765ab062825af421b1d80b1e36c4eb2b44749db2261a321bd44e8c714163a1c2777ce1fff3359a914d30eed3152b10a249e5eb90acb68
SSDEEP 12288:NLUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:NLatr0zAiX90z/F0jsFB3SQkH
TLSH
T1BC45230B381F80F2C8C31B355644984B1AB95EB476D3AB86F2963F0F9E3C2C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 21e9b166702d065a9171e2ef2b81a89ba59afe5a6b6020e42e5d838f3041f498
MD5 31ebbbebb3862fb12cddfef1a33008cb
SHA1 45ca447d482aeea853c2014d3b413d3766b9639c
SHA512 1d72b815afb96e210c19b98d98e9eb3f74749d08c3626302cf1c6ac64d8cfda4688e532e2f6a86ae7c3da709bdb6d10b17e093c08665dd105171b7d88ee7f557
SSDEEP 12288:vZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:vZatr0zAiX90z/F0jsFB3SQkH
TLSH
T1BF45230B381F80F2C8C31B355644984B1AB95EB476D3AB85F2963F0FDE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 12aa047a7ac307593b779093d1e6f0e7b59cd2bbb882938707305cf50a19b7e0
MD5 aea925e97fac32a32355387a6346d20f
SHA1 8dcfa57c25b9703428c852c1de31e586678642d8
SHA512 45cd6e5cd52506d8b07ee8289ef6ef43df165c26acc137813e3400be8942ab489fbfe7ffdfdfe49c2e0fbce37ae909e782e4062747223c8712dee0819e90fdbc
SSDEEP 12288:FgUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:Fgatr0zAiX90z/F0jsFB3SQkm
TLSH
T16E45230B381F80F3C8831B355244884B5AB95EB476E36B85F2D63E0FDE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b4825385058d9f6f19cce68b1136d77fe26d814f38f5c70b89fa2905a290b75f
MD5 7d7c7ec6d6bc57c79be8c81f969e9300
SHA1 d675aee8c7c24eca74cfee31d4fb5c4fb8edc25e
SHA512 a0c50d376d72130b3b3240c090b6b7719040833508da42f893de403d614e260bd46948ee48f8fb39dfb5a43d66ecce7fc8da76e8be6fc7a11b07a584de1a83fb
SSDEEP 12288:rhUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:rhatr0zAiX90z/F0jsFB3SQkF
TLSH
T11345230B381F41F2C8831B755684884B1AB95EB4B2D3AB85F2927F0FDE3C2C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6d83fd32999da0ff29702c410f8c150ac533895374c12302205b38090258f7a2
MD5 351f59321b7b42c5d3052070d8e5669b
SHA1 8b19470aaddef4487f66bc5d01d36a81ec2ff1df
SHA512 f1f1c651c6b7f96e85057ac42487699a790a6376569b04e898059986ba08833ccf1f7d4e44a705e66d1641b25afac6c239467b92ec58785a125d72beee20aa83
SSDEEP 12288:8PUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8W:8Patr0zAiX90z/F0jsFB3SQkD
TLSH
T14445230B381F80F3C8831B355644988B1AB95EB476D36B85F2D63E0FDE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 96f2871ff3c4186ae62f6f9853a1df1ec5e9bb5bccc2e366fd553cb04c3dfa00
MD5 a9d202afa1e3953307655883afbbce2b
SHA1 f83d29a2f54b9c6262179c27bde5789e5792241a
SHA512 00f395055a2551fe2c39b5387fb4f527d4f3dec26a2232b6aca85309209ac5b3efabf3f16488dfcf8b0b8bf8c630ee876a9846f2b052182e236619de10cf9aca
SSDEEP 24576:Qfwvok9RX6wkyAIdatr0zAiX90z/F0jsFB3SQkg:YMnYIdaB0zj0yjoB2
TLSH
T15585D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 57cad1838b68f959c117e30c13a0a74639e454175785869de25a6d978b2a82f2
MD5 e11aee67a2084175d7e2f29e880cdd74
SHA1 72b32e0c9b33d3835a3787ba927f11d0e168d0f8
SHA512 a67b61fa8fcc14b467b7eab9ce6917b999b617c7ac5bf63130f6d047a8f0552aeda9693d70a880f549a1fb1f0f77eefece9995542d94b900f40fe3f6406502c2
SSDEEP 49152:sYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00aB0zj0yjoB2:SySzPjB2Yyjl
TLSH
T182066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9a30f98c7ff4966155d7db9c19f9923653475231dfc9fa1a2a502bfbcceab98f
MD5 c89470c866f17ea146451c65da853eb5
SHA1 f0544254ad0ed07e3b15e7ca161cc61cf5753456
SHA512 6db84d6df422ab86130d6aee596056d3f7285fea806b1e19c165558517d264822b89c032c4be24b14c276a3707a1a40ccf20a0b80cc3c6589b957dc92d05983a
SSDEEP 24576:t47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYWatr0zAiX90z/F0jsFB3SQk1:t47JUQj1irIhCnDHUPfF/EaB0zj0yjos
TLSH
T1E265AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e05f08b0e4111eba95a0f79d832a20f8bd549715898c02b685ccf51f6c2960db
MD5 80a4aaec28f5826cc19bde17931b0f2c
SHA1 23b177d46f64afe148e97db2307de8246daeace1
SHA512 ba58e1a69c307ac4c31363edffda660acccc710f9f33245f6dec2b6af08115dbbfa9f27f4e8a9ac2ae4347de2e2f8fb0bb47e27bdec8eae6ee8ab7f51336151e
SSDEEP 12288:JNsfJUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8D:OJatr0zAiX90z/F0jsFB3SQkC
TLSH
T1B555F00AE25802E5C0AE6239C7544A41B7777C6593E2D3CB62D0F93E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 e570546028ef61cb4ae92dc64f3cf8e3cf0762070566252c9697afaa8f6f3fa3
MD5 efe9b7ea5d2bfc39f21a25e0b495f7f8
SHA1 ee4410d2b2afaafdb3098e67db3e338f08d2e517
SHA512 c5b47b272e38066b61d244cdeb0a4f4a7f45151213f530c26bf2e3107d45730f3f34707e133eef987204bd2988897a41a6580cf9ca1225fd57322df47a3a2cfc
SSDEEP 12288:mhOeki4MvUxpzGsj7sy/8NFZO/KlRMG1iZIhLbIKU:mEbajFZ+KlRMG0ZIBo
TLSH
T1B9450610766AD74FC6AD44721E32C1CCAB707D41EE44AF0773C8873FC576A59BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9f13a0f60efb12cef2e9bed4db883e3720cf868caf9d43935b73e77bdd77c522
MD5 43e07bee7001ccc0f91eb8334741312f
SHA1 8fca3b10bea9c3506840ab997a04702875564797
SHA512 aec07bebe676496016fd1a64a43c7a0e67c013ed5f2970b0fa1d13df1ca2ef03c764136e5c111ee8114965f67112210d42c5377c8fa5f85b38ba29911a5b0067
SSDEEP 6144:4fKDe1Hu9IyKpoBKjLGvJ1wW3I1CxDZaso5HnfKDe1H/KDe1aa09QZuUlGL9e25+:spqULGkWjxwso5a5U5P5+5rBbrhYWM
TLSH
T11965D740A536A38FD1BB50B203269F8DA764EC03B7456F26B7CC443AD86A705B4F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7bbc63d3b210b6c1c11a4e90829f8b7a55997e4022a33805c5a51a4e14864243
MD5 a27344340f50c951997fb3b8442bb11b
SHA1 9af082915d680228980c49e6a945658daa3c24b8
SHA512 8dd652b56879214dd24ba1f5b151cc9c3ba0a0df8b425d347eef65f4f762d110b6ffcf166ac90da30a18c77c32f51d3dba6a182c6eff3fdee77bbb5c19817838
SSDEEP 12288:CM7dUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:/datr0zAiX90z/F0jsFB3SQkT
TLSH
T10F452307351E80F2D8A32B3412589806167EBE746BD29AC7F1813F4F9D386C65D75ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0631935f66ad07a95be956347a473e38fd5d387ae7e831689402a1af8873ef60
MD5 05e2b76048350d27258e9973b8a471d0
SHA1 f10a65c141f226d02b9ce7428ca5a2e5185022e6
SHA512 6edaa18ec5824b9b649ac845cc36d9aff563b1a4ab514e958d191819ed8ada6e307fa67013c6417a1a7afed7376a949821700911327e3120f12286caaf9f52b7
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYjatr0zAiX90z/F0jsFB3SQkc:4gb4mBIBhGFWaB0zj0yjoB2
TLSH
T13F65AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ac173fc7e012819e6f62f5659860912e80ec6d33937144e0208ecb7cbebbee1a
MD5 9879a05d5c5108428094d918384129c7
SHA1 e251e85151c07866d45e2b29f8727b76c43a1442
SHA512 b15b177f660e18848d99f2fc7866a8771a3cc5e36ff754ffcec5ba9752efe60de4c9dff30606f0968f0fd23fe138e1963d7ac62c84b8d3bd3a65284ed05d30dc
SSDEEP 24576:qG88u8FpJqH1bzria7/mGatr0zAiX90z/F0jsFB3SQkc:R7ZFPqVea7/raB0zj0yjoB2
TLSH
T10985016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 482fb56ad27aaee69c51112a5f65bd318c4c0a344a2f0ab4cd84015b6bfe98f1
MD5 405048efe8d3606ac365054e78fd8b32
SHA1 ee4be16505fcc4441c92db6410e034d615cd5c81
SHA512 706e96eb777d5abdf45579b9b13b037550c72e0f4c6ec79c0ade4e50f99ad73a7b02cc7648c9c7d66d524d56bbc9688d2f276716a95cdca493e0657708fce0f4
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSaB0zj0yjoB2:iG05lO43bIB2Yyjl
TLSH
T11FD5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3b16f42e7fede75f509ad6195d16f871834efd8e65b40fea852b894013af8755
MD5 2d2c437ac587d2ce52d2d44e6161da95
SHA1 09c0da8bf67bf454907cf2ab34d860cf7fc98e6e
SHA512 f8af8bfa01f83b8bb61f7bdb6159523adf9c1ce983cb768123aeeeafd07149570ffc062236684579f1ab8eee40c4a62906f322473f4332125843298a9220a300
SSDEEP 24576:mfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn0atr0zAiX90z/F0jsFB3SQko:+a5POZ3+Jt2pasx2+mqaB0zj0yjoB2
TLSH
T16365BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ecdf6b9e812bda5dbb2569b511e83b9bf2a5d75b83e454097ceb0011c932ad11
MD5 4ce5916e19b5694223fb574e2942c5a4
SHA1 ce5934dea79326a637d229b8af196e81c0f2c725
SHA512 9f57f68a9df646eaa046effd1088e85803f543344d76b7f05312835bce865a37c007cd394ec1c329263999e7b49f3b5b9ff235c690a28c33b3c1bb6c4be799a1
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7Fk+atr0zAiX90z/F0jsFB3SQkg:tNc/zEOVHFLaB0zj0yjoB2
TLSH
T1BE858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 daf688ab4cae20405b69bc3407ceb5788285a2123c330105113eb186e2a5c6b0
MD5 55a22ab1d38e9adba3004af00cf37f78
SHA1 5c53768143ed6d78244884bf51db3b244339783c
SHA512 63d132122c170d464f555a96c3abd3139d3b1bd9b05f3a75954b7b1edd7170ba2cd3f39f1827fef8f05bf4ab16b36df69f26ab2b2192655384848ad920e57dcc
SSDEEP 24576:g8kNvNnaFeYhJNtmZBmoatr0zAiX90z/F0jsFB3SQkN:g8MwBtOmoaB0zj0yjoB2
TLSH
T11955BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 db9ce8c64bb98879808ae7b5413a1145e962321f8121ffa788bd33f9f8576129
MD5 64972edfbd15defc891f3d613f5c9ea7
SHA1 bb9eceb3cbaae241b05adfeef62e47e66f122c31
SHA512 47f456ba4a7cea125b9002da61b324e474176085b159fd9204850d6f4fc27095c3fc6f60a973ec8bc491269877e7041156670261e68e1699d91dd689ee6d8757
SSDEEP 12288:MHvUrBFrEjwaQiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:MPUr+NQiatr0zAiX90z/F0jsFB3SQkT
TLSH
T18B65E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 60905b9351346128f8f7d89b004482c0b0ad680d78f44317095101b0dcd17404
MD5 bcb9953994a47ae3c59ae5b66be64170
SHA1 344b9962ba4238a287ca2561006e7fed64420e4d
SHA512 28e9eaf5d84ee3ca029f90c0d555b656354d571ea72538045acd75587fe1c21a943f78f0f12715328e4494ad070397c782c4afd07fbad85aad476d1a826f67ab
SSDEEP 24576:gD3FHshBIYQgA1atr0zAiX90z/F0jsFB3SQkI:gDVHeBIAA1aB0zj0yjoB2
TLSH
T11875E13EE65D00E4D47BD2BCD6538906E77138A903626ACB12D091BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/248-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/248-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/248-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1188-55-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1188-61-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1188-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1188-274-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1376-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1376-138-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1376-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1376-140-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1376-132-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2836-113-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2836-107-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2836-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2836-317-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2836-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2836-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3724-332-0x000002152AD40000-0x000002152AFCB000-memory.dmp

Download

memory/4160-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4160-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4160-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4160-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4160-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4468-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4468-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4468-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4468-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4468-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4984-297-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4984-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4984-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4984-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5132-334-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5132-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5132-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5132-95-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5132-89-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5132-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5432-126-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5432-120-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5432-320-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5432-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5444-6-0x0000000000AD0000-0x0000000000B37000-memory.dmp

Download

memory/5444-101-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/5444-1-0x0000000000AD0000-0x0000000000B37000-memory.dmp

Download

memory/5444-0-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/5444-77-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/5444-8-0x0000000000AD0000-0x0000000000B37000-memory.dmp

Download

memory/5880-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5880-313-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5880-84-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/5880-79-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/6040-50-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/6040-39-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/6040-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6040-46-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/6040-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6040-45-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download