9e44ab7f0f68d8b01b70b52159432174a725894de98a46a34e43e5adac48c912

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
Sample260716-nylvwab15l
SHA256 9e44ab7f0f68d8b01b70b52159432174a725894de98a46a34e43e5adac48c912
MD5 57ab4d5f8ea7cd286a9983ddd702d105
SHA1 a61ce59517f04f7ec22c5718413e04910eb08dc2
SHA512 57025d1cf7300866895cdf740518777c8b3bd949dd50999c31156ec5ba2410f09efb3201ff8bf0b35f18103bff7267653467000e12c352a3d64fc276cedaf49f
SSDEEP 24576:rXMWjIbFMZs4YnQ/tbw/2Mkjy6Fr7g0oT:b7IWKQ/lFTjN4
TLSH
T1576501217AD1C437FA7302758CE987BA5B6ABC522F3542CB37C8071D5E352E28A36752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
372	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
4524	elevation_service.exe
6020	elevation_service.exe
1408	maintenanceservice.exe
2584	OSE.EXE
300	PerceptionSimulationService.exe
2936	perfhost.exe
1512	ReFsDedupSvc.exe
4608	SensorDataService.exe
2744	ssh-agent.exe
1764	AgentService.exe
2252	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\361ef81b5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eea2f6101915dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000eaf0fb101915dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ecde1c511915dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090ea21511915dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031861a101915dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000adf15b131915dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6b2f7501915dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4524	elevation_service.exe
4524	elevation_service.exe
4524	elevation_service.exe
4524	elevation_service.exe
4524	elevation_service.exe
4524	elevation_service.exe
4524	elevation_service.exe
6020	elevation_service.exe
6020	elevation_service.exe
6020	elevation_service.exe
6020	elevation_service.exe
6020	elevation_service.exe
6020	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3380	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	1764	AgentService.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1512	ReFsDedupSvc.exe
Token: 33	2252	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeDebugPrivilege	4524	elevation_service.exe
Token: SeDebugPrivilege	6020	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 372	3380	2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe	86
PID 2252 wrote to memory of 1876	2252	SearchIndexer.exe	98
PID 2252 wrote to memory of 4364	2252	SearchIndexer.exe	99
PID 2252 wrote to memory of 2144	2252	SearchIndexer.exe	100
PID 2252 wrote to memory of 5716	2252	SearchIndexer.exe	101
PID 2252 wrote to memory of 1208	2252	SearchIndexer.exe	107
PID 2252 wrote to memory of 2400	2252	SearchIndexer.exe	108
PID 2252 wrote to memory of 204	2252	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Users\Admin\AppData\Local\Temp\e59bd5b\2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
  run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6020

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1408

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:300

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4608

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2744

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2956 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2956 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cf7c711e0d6ed6ac971dfa1912f6ea9914f0fb577587be59b796764d6a556593
MD5 7e2c3d8799e613a1fc757ff8dabcfc06
SHA1 966f244be56c7ca97ef5cf5081f2a08ef735de6f
SHA512 b55f33fefcdf0855142fbde0dce7a796322c2e05156c5654604300c449eac9c1812e1e40a7eecacb75ea811b602e7a05089bf779ad3f9d113a31a8f2020783dc
SSDEEP 49152:1b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnqQ/lFTjN4:L3q6HjBKLm
TLSH
T160D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f60b96e7c69f2d2a8df063576c1ba4c88b71d8cfbe87e766e8f6ebb5b7d9fd0e
MD5 dba9eb0efc53481e5cf5799ba1afa2d8
SHA1 ed7e4713a281c92621fdb1a44bebaa3cf26c648a
SHA512 08e70de6c02fae57bee19420ce4ba108b70166290a8944b4eed893fbd5ba688a319854143837a5b08ff6cea91ce3f1a024bbabbeb05b0dbbcce0c06ec85e8c35
SSDEEP 12288:k1XLsswWkxy2lRq2czABGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:iXYfDtczARnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1C665F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d4bf4219d93a4465cc62b1914377377a711e88b988db692648e2e12b6d97cbf1
MD5 7226490c1c4f54cd4893fb061d4c90f8
SHA1 244b0e6153911974fb53b07efc34bad85e281bf8
SHA512 7112c25c484c4e5a4714878c3eb2049a3d7c4e8da858c884e11d3fa255fec9b70dbed2171dbcec6d4f12f58c13efde38da81d303fd53259ecf26295c1f7f3b40
SSDEEP 24576:L0Le5ji0hmxLrMCnQ/tbw/2Mkjy6Fr7g0oS:LPji0AlrQ/lFTjN4
TLSH
T144859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8082e00c3fba50564e64b0f056d945338c33ef1767370157e289bf2a3424aedb
MD5 ac9b398813279897e3cdf26e8a357dd5
SHA1 276d6eec8922f29c43417838824c466879d69057
SHA512 e80de573817bdcfbdc4497686df4d999dfc0a42f9c7223a37cd1543bacbbedf5cf75be6588a8252ba61fd84da049c77bf852bc6fb6a9bd29e21f78c84fd7572b
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWE6q8wyuAnQ/tbw/2Mkjy6Fr7g0o7:F/ezSC6vUzPvxHjyHQ/lFTjN4
TLSH
T169755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4e202ed8fb174e021ecd39cf3ecdf46edb11c6fe847117eced54ceb5f594dd68
MD5 114bab8a10d6de6426b15a8946342302
SHA1 260dec1ff223373e1041105a1d7ba328ae762301
SHA512 17a0a40b533e3dcbb9c74b72c0a8633e5d5c0e61f4148f8e48968ad2238065ebd9cd22ba8b6537e026b075786d790ed03a60b99761180970b899abb752015f76
SSDEEP 24576:QVbqPb88hv/l+61nQ/tbw/2Mkjy6Fr7g0o9:QVO88hXl+uQ/lFTjN4
TLSH
T117559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c716a6851ffbd363cc4331bf08cc2102507067f20ff65e22fda82991d0848b1d
MD5 835e00eb322adfad42318aae17994996
SHA1 c388b354194ae3b0fc2d6c4ed575d3d689808663
SHA512 d15f005a9c3ea46096eb968c7b9ad8747f6128bb04be2e85fcf1ae69208dd4c16bd5ea714eb78103f9e241bb480322d1bc0b9144f9bf612cbd33016a54daef86
SSDEEP 12288:EzWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:Ez2nQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1185523796A24F897FF2B06B15C8284826B7B0EC1BFD4AB4E6744362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a7e53fcac020c3dda33a0770e392285fc9b5210a66eae8522d24aee473b13df4
MD5 45f0c350597fe7695c4b3bee708c868e
SHA1 92b2bd32927b3aff06666a75dffd3bc24b7964cf
SHA512 98463fc3dc63da28df60e05dd5c66f0eb5e77d279a5cc9e80f0b80207d6d274d0b346a05dc7240a2a89f9cc5ef4a7ce1ebfb46962676603fc5b74ffb8664dbf1
SSDEEP 12288:aeBNUbTVO86UNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:aJIUtnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1FA75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 41456edb912196f93672a5e0f2ae57767fdd1ff580000d4233453b5964227c88
MD5 4be425ba60a58546b3e527e7ae9332fe
SHA1 caaaae3b3aa8d69b03a46076f5b6403dbb9f46a8
SHA512 0fba1ed6349e4ea9bc09df5f9f8ee234243ff358f7217d87677294937c4a36ef20a162ccf3acf893dd738e39551b71c4a124cf385a204f9231f07a90973e3516
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THl:XQvGAdlCEL8c/yRNw5CjLm
TLSH
T1C8267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 94bbda89562085458d3e7ca14f8e8073579f9428b06c716421ee4c3153f34ac6
MD5 ecd913d78143021070ce6cd58570570a
SHA1 8d61cec0de6ad94b8358782616ef5411672b0a5b
SHA512 bbdda1a119aefc5e4dd3db999f3183beffabda62f747b34f95bb0236233bf0b0e888933376518e41cb564e653faaa450b6e173a51a107696428c2694de0868d0
SSDEEP 12288:8AwSfxL/2Dc39DLLmt0LDQewsAjLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgZ:hQewsAj7nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1E875E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 96879cc27423ecb71d9f36307c61c1724ba7f59d6fde3df287d14edc77865485
MD5 1a73b6e6751d34c88de435539d10ce07
SHA1 08b7263bda736163e66ca42b7d2462abc7759d04
SHA512 26d4834c997290a50a8591bed17d98dbbd2b909c7cbfcf3dd865d97a61160f3aee39565228b7e41037e57b84c36d14e2779fa7004493a5584d0cb0820517d138
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHIL:IUEtQevvqc2W1cpV2EI32
TLSH
T1A4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 26b6dfac5d958ab37c16cfc4d7c832921ce3a1713402f6ddd09b274498fd834a
MD5 98c4da0fca3145e1e61680db34d81ef3
SHA1 574684bb3c962d79028d78c556d4e7c8479c17a2
SHA512 ccc3fa617358674e9af5254e89b19461e4bcc9ead187a17a25e9d614a044bf5ba886d7005cf7759901846e089a3d487b6cefb058ffd67092bf3d582b920d97c7
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/zbQ/lFTjN4:OoqtVjnmfLm
TLSH
T1A9D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2e4311f4bc89a4f2661f338af71c36c08c1b40a222f51effbc25944ddbbf09a6
MD5 511815b26b9fb5e122acffa38eb22b8f
SHA1 0bda52ccdfa82f9606ec1e6b22d12b434cb5efef
SHA512 46bd56d930350c251293cf26487b9cfe6059669534ac856c752629fba496f1c75f2cd58661a58da771d174e7bf8f527fc2f52629759001220e13382bbb79cce9
SSDEEP 24576:dAhGLJIFoiwtA5l7S53cnQ/tbw/2Mkjy6Fr7g0op:dAMyFoiq5MQ/lFTjN4
TLSH
T1CD35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 91c42c2abf0bc8eba56a750857f24ee1d7e233ddc411e26ed6ac03926255c8d7
MD5 545b3ac1f7ad3d8f32f62671925104e7
SHA1 c091e528a75c47f629cb55d14a9b4859364981f8
SHA512 3c4466c08b0f5950c28cff2ebe011adfccf4bfe3dbac8fd33b1c450efa21fa70540bd71b25bc32a7b929586587f10d7538cbf1510a82535a0082fc02766b74ca
SSDEEP 12288:Nmw5HEjsChN2BFgl0WDm+CAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMw:owuHOWnnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T13365F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2322fb7c45ce494b0d3499f02bbe9c15fa686e11433dc1644741e5dce03453d8
MD5 c68fe7b1fd0db7393ba719689573deee
SHA1 6489b63d67d7351ea2f153e4b4c7e2872890a8d8
SHA512 d043db714f6ca248e1372d7eb60f6f5d1ae37a368b16a62424087b0a0223b4fedbc1ded89a85f90569b417fa9f26e0cec6a0468bee5ce104f0b92de485a78336
SSDEEP 12288:HXZ1IybGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:3Zu6nQ/tbw/2Mkjy6Fr7g0oq
TLSH
T16E55126933A4B0FAE6674278CCE28646E773388267B183CF275442695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 159d7b3fd679fb80c5e0acb2ecd84e59710c19e93cc18a68907468fa7f994f5a
MD5 4efbdf6eec10743a8a5af6916746b840
SHA1 48e20a583b47fed5c68bb762a1c8bebb960656a4
SHA512 8513bc512d707092d3b4845cea9c4e54bc9a5f550e27a8acc428a4058be3fdbda3de391584f9e5e42cb3a48760990b8cbc1002526cbabc04b9b09457ae321f9b
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:cQRQyi36YOcPQLvw2gAf+PN3eLm
TLSH
T1F8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f4704a5242becf26b0dd16958d57ef9764c110130a70189d1634365129ef8e20
MD5 0357cf3c5472bfa90d86b21416dcd852
SHA1 3455100332fce1869408833351ff1ba0682815a8
SHA512 5c1284fb50ea4f2f7f215c99969260f776084492377c751721bc069cd529d980e7f79090c74869a4e8c31aa4dea3a7a2838c76282085b62d7e5a5dd9b6be8749
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:fQRQyi36YOcPQLvw2gAf+PN3eLm
TLSH
T12C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 47a558d6d4c951c5a3a55dbe4bc7da64109b2bb6a92084fb892b9ce8272ca6be
MD5 047441f0d08719eadd9d5407bcb261e9
SHA1 211bcb47a1ecd9552dd34d9ea1ebd289a208047d
SHA512 7af6fd3b9ec431ecd62386113170be1c21a240bbddac55550da018a585b27d9b1ff272b9785c3e1d02f8c29158cc2f96927bceb674cf83f9b5455386eeafad08
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0qnQ/tbw/2Mkjy6O:b68Qg55nhheWu7PNU3/rQ/lFTjN4
TLSH
T1BEB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b11522f8e77fb13f50abae628ed2e73166f5cfc8f8e900927db42c43065539f7
MD5 8d8743d670b2bfa64574b8822929c6d6
SHA1 7a0006693508bed496db26f19fd39a06c1d79a75
SHA512 9e220c1903419834bda287fc96868c6af7be0f9996e15bb6aaf51f64dfb13a9a932ffc62800dfd0e12bffbaa0ed580ce543b0e80e99406b0ea42fd2e6408168e
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99z:fy5112gYy5azzVvL69nLKnhZBLm
TLSH
T1B0167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 82467b0a002a8e4dd93b58dc2f687c03e94b80624e5acecf6d3cbfa588dfaf9f
MD5 d5d38496427c4e1109b79162f879bd36
SHA1 c67a04e45be0c5b9bfc25a64354961a01da5c0f5
SHA512 7e75905b45e3991b6a30681dc6a4c100b1b3e68a55d811d372ef9d5cbd6ba00524b56221d56c72a5dcc9bdc3068a725b6c80014e22fcabe32d7621f9316db031
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glBQ/lFTjN4:Ru6JmVxd2dmLm
TLSH
T1EBD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 eb4655a44ffb0928c7182d481eee11e621be757f7f090b2cb4d7d618868a2b9e
MD5 5e014542c7d0073d40a9b03ab3f01a4f
SHA1 10ba242da6474cc9c41d25048474bf51af79c552
SHA512 1c969d6a9671e28e7283fa0ce7698994a1d176dbf418b348df0b1ce3c0a5a4a6c90dbd9f079a9a34c3df4d864ede3cca6d82b76cfa330c739cbeb68d5394562b
SSDEEP 49152:l1hpsNoJpF1A6UU44CwH7R4xNQ/lFTjN4:lmifPbRfLm
TLSH
T1C8B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9057a724a5cccc16574280dde23bdbca6a04f24638a75b3c1d8d9f4926ee39dd
MD5 d5793cf45815d61f1d6a3a953702cfb4
SHA1 bcdbdf9b93600ead2e91246b30c6337b845cfb64
SHA512 3172d37432f806a75acd6fa9619916e775c670b9a2302ce93e6b287365b27f10332e6e647ada8cb48b15732fdaf11ec4461ae8a19abc23830b2f907b70ae7439
SSDEEP 49152:oSuZQIY0Be2KRRVtOnks6NMHq6Q/lFTjN4:y5dKTi611Lm
TLSH
T146C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2eb6423c295defd897ddf855b2a8bbe4bffcf3018263c68595ba92cd213b6023
MD5 420ea015f5f2c0d8c57b5e62c89bd8f2
SHA1 29cfdf6d04b3825185231bc1f3371db8b52eca0f
SHA512 4eb7b01e2fe8a9ca76c5cb836663545b08bc31975b1fb4c61b9d81ff7522fac78c24fdd19437e07fa882f62db903c043f138bb2a2b0a2af30a3e9902c22fe658
SSDEEP 49152:dhtSn8EApI0figngiDn0AP5wRQ/lFTjN4:MX2iyph7Lm
TLSH
T1E095BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 faf8690eecb8060ef3f9ed509f31c8d3bfa3d45e4e37548e35bb10d45cb8b108
MD5 e749cfbe35421640c59ead618ff4c368
SHA1 764161b92ae69543fab383e5e7a6dd8772b17570
SHA512 91431cbd8827c8c4650bbffa847f8ace5041b744148b78214a3df506172ec0b3abd141d10aaf53a53adb889412bea8f43ffb99207d3b3eaa9b278513e8ebbb4c
SSDEEP 12288:MuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:MunQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1EC5523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f440104a330ac660efa35fe1645b071489c0739d7d29c57b4b827fb6a3a8bbc2
MD5 2f22feb2dd22a53478dd27e6e4742bac
SHA1 2bc1ae6ab0bd421a1716eeb994bd747b7326eeae
SHA512 3fc205decd2a63b04971aabbeaf873867b4de9004aedf396eda2b5e32238c48616b24985736514537c140b7b52aaa89095ab9c1e536046657a3da6400cc2afad
SSDEEP 12288:jPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:jvnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T17E5523697964F99BFB1706F14C828182973B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 047b017297e37b9c6c369acaacdfe3931c9b71078950ebe1c1b29ec9397bffc6
MD5 e9b956a7752593ceef35df46fae30314
SHA1 7f790ca9b1b8c0a83e7309ac37d0f47d4726b6ab
SHA512 4cf5c58a8a1b8f1487069aad04a07ea10d425952704229d3d64393317e00904e1cda02bb9f0e548e8cee36bcc7891037c25ba69046992eff4317cd2a4c0e6d50
SSDEEP 12288:bFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:blnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1D15523697965F98BFB1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 64b352188ccc87cf23567eace1ca274530c6280b6619dd76561e94b2b0945b50
MD5 1cd7ebfea1c3322350d12894a7155161
SHA1 2df4267d95721f03db0abbe77fadc56870af9917
SHA512 57230ef46958ad87c4662503ad0d62db8132a64dec5200e512b953c1e868e2389e7ee86f2407bfd33fbc95fc93a778f794813a0a467df7a2090dfaf5801a5bee
SSDEEP 12288:ZV8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:InQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1BA5523693A69F4C7FD2742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 385ff6b193ee3cd7c22b047ada0c1983ffa15c0b38745028a203f943486317ce
MD5 79b88e9df0ac0bc23e6ce9ecb745eed2
SHA1 44fccd6f0075d735d192bf00e0e4d8293e806ff5
SHA512 a21900076bf9bffec788954208f0efaf28315e95f5b852ff71b825856bb613e051f38fb2107ff3ecbe6d979b219e09c1fbd09ba3384fbe37b121c9e234efe241
SSDEEP 12288:fEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:fknQ/tbw/2Mkjy6Fr7g0on
TLSH
T1B95523697925F98BFB1706F14C838182977B0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6bc77dac2fb61409b29ae4a035a3a5a06bc6212a170ec9360b53aec428d96420
MD5 b80fec41ce7bd0a6099906a168145f93
SHA1 4f30d0238b3a8975bab8508753a7201feae6cd9e
SHA512 a2adb2899f4be36a8d8d4d5e61d9da24e299d1282025cf7fe4bc07b1a6cba5131f0f7da979a81490abac8cba321b300200dffe821f37227b1a9d1e0dd3adc812
SSDEEP 12288:8DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:8znQ/tbw/2Mkjy6Fr7g0ol
TLSH
T16A5523697964F98BFB2706F14C838186A73B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 16c9d790651e95e520385ca8da7543509e9314c30affa48bd862989d55a638be
MD5 705c964036a95d2ca446f6c979089b04
SHA1 8d45e264d7760615c94bab7a53ad4b55c986844d
SHA512 801feeb6ac4a9fa350ed7725ab308851a23dbf115e6d5bcafde46624e9bb2b2d2ffb9fcafe8684f5cb30988ac1362ff31059673c111fc59b2d5af938b7150493
SSDEEP 12288:v3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:vXnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1AA5523797924F98BFB2706F14C828186977B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 099667d6269df39c1f3ecd7b1e60effb6a415cd593bf10529ebca0242dcf3608
MD5 f87bcab7b6efdaf1b20f84ae83498b12
SHA1 567827e8fc1f2b927c18ca92bb08e7b3dfcdea53
SHA512 bc2748dfcab046f9fb2f508c8fd5934f3b356095f499fea7feced863de311bd737daaddf3da3896a56038bbae3a6d9d417d4ce4a5ff98da826feacfcfca6e368
SSDEEP 12288:3iZwbDzzFEoS2cPvyvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:yZM3zFVSOPnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1CC7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fbdbf5a9b8b5bbc14d4d0cc17a05605949862f4cbbd728e229e96d5248aa52da
MD5 9991c786912f7b6c7df13b1e4d041cfc
SHA1 330e0a21b1d3322458d0e594cf0b947c910e65a3
SHA512 332255ed8eab5deda592e0d426d893fc8b713145e921097adb170170860c7aae000337ff6f9b4a6fcfb4e5fe64ebd029c4c0dbd47b8a5c90a898973b57712561
SSDEEP 12288:mKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:mKnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1085523697924F98BFB1706F54C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 77fe4613da0d06cc1668cf69f9c943286cbfc818c97a60836dbf0083f9507924
MD5 78c8c3c5bbf3f0ab0299b979b5008199
SHA1 c32dc8cd8531aba5e4fb2bff5050d69e77d5572c
SHA512 bb6cdc96d0e960e5ef507e434c79ce92091642df41f5e335374bced966ea88733b7fff3dfdf26ae0acb11ebb9cbe930cf3ad4ba0d2d2788a5ff6bbfb18666e82
SSDEEP 12288:tmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3I:tGnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1265523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 79d468ef62b6de2c3dc62a2ba1a9e9e9d2b8326d944b626c724d54e04dec579e
MD5 7165b6cec4927f3329f941dede76dfa0
SHA1 ea815f6d90da412b27892dd1a2fc658ace6eac9d
SHA512 cd5f3f86e4c025a03f35f01cc9f466b9c35d7783f7822c4c6d42e2cd520bfd0b058b8fcc884df42cd5c43a1c1227c90d58b89850e47e32f67b332df88a0429aa
SSDEEP 12288:TyPz5L8bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:ezyLnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1F665021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 30cbf351d01a26b47e85f00c18f6813e08feb00527dc1162188f270b96ca702f
MD5 c554c6823842ba1a6abffa4141cbfeb9
SHA1 928674c8d1c280f5ff8fc4c499a05c97ec2cb4c6
SHA512 86f6a16be9ccb307072aa210cb673bf389027e3484cb87b47755f8f3c09e76d5d8c0e75905f30e6ad06a867291f01bbfd2be43edc458aa987d58ce649c2d6225
SSDEEP 12288:yKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:yKnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T12D5523697964F88BFB1706F54C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 85370e94b75a491d6809068f71880dbcd11ff807bb76976642a754adb8aac791
MD5 b750f9026bc08a3ac0b3fdd545237cae
SHA1 21402ee170769fbfb190176c3ebec8fb76ee8e23
SHA512 61e86fba59fe99b35e799dbd6be5a088441d478e7f4e0d6fc607e40abd8908fb1867e4538a588b421f0dc949cccf53757f2e3d09dc9f7105f1708dcb3dd31fe6
SSDEEP 12288:FKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:FKnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T10A5523697924F88BFB1706F54C8281869B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 3ee3d9917e69b6bdbc5dcfc6219fa2c2e18a1365bb46333ec89d78aa21b479e8
MD5 bbef90379cb0201377b9ce9d766c2d55
SHA1 02d111631cf801a3c270d9ecb388805f27dc6952
SHA512 43ee6f05ec1c676ec9d471a40c4717c9d795475ca7a9c74637e2143f82462b8e33191ac20700d7eacec578eb65bf321f45cac5a5c38a4e7c13c56b97c7896a45
SSDEEP 12288:HyPz5L8bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:qzyLnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T14165021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 bb9e8c6bc45123e8036ca1983bda82432ec73dd049bb3a6ba15581808f4e5a00
MD5 efa6441eea06220d2aa6e02e0aa74eb4
SHA1 0ebef68a5b2b3af0884b180d34fa858ce02f6e27
SHA512 76889861b83a3339c1bb6bbb81bd6bd29ae8a8fc33b1702dd65c13ddc6da4a7e682063ae73879c8b26a04d0164c8a13c2504af7bb2509f895f7aa484162e44aa
SSDEEP 24576:bT0aLl3z0zDVnQ/tbw/2Mkjy6Fr7g0oD:bTDLljAQ/lFTjN4
TLSH
T1ED7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 8fd32a541966f3dd5ff913e93a9d6042d9cde37a82519dbace22ac99b91464ac
MD5 039a0143fa83af55846e98956a48a13f
SHA1 60018e10790648d2f526fd986744985fa8221f8e
SHA512 cce74816abf3ff130bf4d37e53300f3fadf62136d18cace30008cc3b2a1506f7db8a0c051483e4ebb40c909c0a0e0f537a63788a37ed4837627dabc6b1831acf
SSDEEP 24576:Q31d9CHKy7GZJnQ/tbw/2Mkjy6Fr7g0oH:a1d9CHKyaDQ/lFTjN4
TLSH
T10E85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 80a418596e3d7bac8011ccdb01eae4d46bf7274ad7fa7480538fad1e0a78f19b
MD5 def9fabb3ae5fbffa0e0e70644126b3c
SHA1 8da1851df7917b3b6f452fc66801ef387b93fc59
SHA512 dec3fcb45384c9cf07da7b9420a91eb3e867c2344d08c6177671100f1def6154412d2f02f82151896e79f6b7dfe25d5adcaabde12616bb59218afc9e39e1270e
SSDEEP 12288:PlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:PFnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1FB5523697925F98BFB1706F1488381829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 afc8eb85b556ef3683f1ca477f9562c3ff6f0ec1f17b0640658e5ee2e4978a9f
MD5 ce29f3c069f3e6d49d13a2e18d0d81e3
SHA1 6d16b39c7e6a506134d42b1dfe986fb86bcc0751
SHA512 1c5f4be88f4048cc0415229b3df1e8f52fc25f0a595f11a547188c3b97444e8602b2968831e78600c763c9727b0359cf09fb57e08544c63ac10b84db7f53bce5
SSDEEP 12288:B7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:BrnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T13D5523797964F89BFA2B06F14C838182977B0EC6BFD1938F77481129967D39406CA3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5d3cbd5e2a22d82ffe8fde6a667bb0013076766e162187b103e79f7400482d36
MD5 b1490863cb03b67fa518716ee0750665
SHA1 169c94aa8db8af986ead88762dd7ccb51ad3e9f1
SHA512 ee6134f60dc08a7edb414985a5ca86579463afcc0e4ea776f26fed83c0d2e18c25efaf6be8c3085e12bf7ee7c29d945ec09f607362c8f21ce6bc48ac24a177b6
SSDEEP 12288:woGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:wonQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1665523697925F88BFB1706F54C8281829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 5d09762f7849c6993de1613d3dfbf938d6cf0000919ce8a4ec1408b0c9611913
MD5 2266cdf533a35a2d6a73b2158a61fda4
SHA1 5c1835cffd2cfd3dcd096ee66cedaeaa20b11c9b
SHA512 c25cdd7d4f18b4048a12409aadad22a188cda9d570fcbf796217bb900e51da75707d35b001c29c44b09d1479023dfb76f78dbb138c5c5cb23c778c2724b6405c
SSDEEP 12288:rKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:rKnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1245523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9dd93f3f8544f2de5c2c0ed0f6fcc9af8d76079ac4ee707999c085b0ac28182b
MD5 ebc5f38f929291405db8c44e6e0c106e
SHA1 b0eac42c7e92c61e40e477d49608534b54d9c974
SHA512 5271189d15d72300fa0a01fe1c4fa909365657461888f9939beff8c6001c1c70ff4611c69d86de71538122753db0003530ab075277cbc19dea4400fde97576eb
SSDEEP 12288:QlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:QFnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1875523697925F98BFA1706F14C838182977B0EC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 599413206f21dc2706c72cbd8b20f051c4f8c00732d9ac1a998a419c42d9cd2c
MD5 c7b0cee80314cc226a9a1969c0b4b9d3
SHA1 103b564852501f545427f048464c05ae47b458bc
SHA512 0abdc7235384a2989c42907217562e706d11338ae4a0f6d8b08f2adc4330195e89b39841520e3d3938494a92b553fb13566558b1c1f69c1d536e04c357f61351
SSDEEP 12288:kyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:kynQ/tbw/2Mkjy6Fr7g0ox
TLSH
T12F5523697925F98BFB1706F14C8281829B7F0EC6BFD1938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 ef60e4bf371d9e4460fb6c804c27f0fe0f4b8fdabbba6c0737b23ea5beaba4c5
MD5 d56902f8b049c615dc29d1f462809c7c
SHA1 37a4718a45bc591c7a91fcf57cc77882d71de503
SHA512 9977451fee21348074930d4050ec09d7888fc81f5193a15d689fff2ce0425c8ae04a2cba3001feb6b22ba74a8f457d6f187ff02b43f7b81c857562485ad3b433
SSDEEP 12288:dEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:dknQ/tbw/2Mkjy6Fr7g0oN
TLSH
T16C5523697925F98BFB1706F14C838182AB7B0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 3d76e633b1f7d64c480633a2d4fad6cba05e0893b0e97545bfbe56cabe4de41e
MD5 3e3a2eda8a2a8086f9b4e57c7bf244ae
SHA1 ce8db4d0201a3689523084e3a396f4e439ec3f8a
SHA512 3a54c78891a3b2e2a07be08cfdc4eb3371635988605d09f4a0050211540fd5a373a3c15c237c19b9301403cac6e7c0912364009bd9cb33ef743e1dbb02985c5d
SSDEEP 12288:0dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:09nQ/tbw/2Mkjy6Fr7g0om
TLSH
T1795523697925F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 ddfd294f5ec2b331fee238a0967a8c0b5362e287d6980055fa76d7c6686f6bbe
MD5 3bb4db1888df09e9dab43ca06e844477
SHA1 5cf240a22c5cb33bad22b51eba5a502be191f843
SHA512 bb187224601c1b52a631d1db58597a3b24b5483b55ce51bfc6f69c178a56f9489fab1c0967cb77e3d47ef92382867f8d0c176a095c545f8e97db07fa9018ea1f
SSDEEP 24576:Sfwv/k9RX6wkyAIWnQ/tbw/2Mkjy6Fr7g0oP:JMnYIWQ/lFTjN4
TLSH
T17485DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3bb3498a34b6ed2c6259bde6eca554014f140bc0609ef9a9654dfe2b7549c6a9
MD5 c685ba0fb430a0ea9b6eff4d0c7973d2
SHA1 c9864d1b079c18b1a450b134768296cbce2bdc71
SHA512 d0bb1e79c99e5243a5335adb5b948a12df3a435ee400016a554d53d247c3117f235f3cc32c5a87d601b4cbf13059b2e0de97c378f50e39021ed424a47a2ea55f
SSDEEP 49152:MYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xQ/lFTjN4:yySzP+Lm
TLSH
T151066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d2545e04943ed28fee8c8dc9f0a04b627fd41f47f0346e3baac53e73b4d95f0c
MD5 06e616ae42c10e07ad87057b910f64f1
SHA1 1d70034248d0c1ff0446f9405eb8f8d2604ba906
SHA512 41f55583297c1df89ba95111e52cb55f28ea823f7dc911226315312b34f0e1d5729eb80c9366ac1bc7b88403f7c8a55628b3922fdd91a68d421a5742fed6059c
SSDEEP 24576:I47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYfnQ/tbw/2Mkjy6Fr7g0on:I47JUQj1irIhCnDHUPfF/BQ/lFTjN4
TLSH
T11D65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c2b6dedf675d8a589e66a003b890dea7deac87dd4f48c7fbe302919845b291dd
MD5 c2b1a7fdf068dad84d4b72733aa8c857
SHA1 2d94e746bd4283beb8e78e35f980d95fd79c89d2
SHA512 c2f67b9cf6a9cc9d478c669169c8e5c99f76589eda58e0f17799a810d5dda0a4c2df8ebe62423f0ee50e399600a1aff680e34a597f46fccad7e17503b30f3d56
SSDEEP 12288:cssf6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:S6nQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1DE65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 76d7b45de9445d909dde1333d5476164a02d6a8ffb2a5e3a9a2c7b1617ac02ab
MD5 d15b918d46329f2c932c0f01228ada4d
SHA1 db9209ae29032c4d008466c19dbb839c9644a137
SHA512 042a4ff452b28fe5e34858daf842822516e31ae268b3a22094c75491840ee46d5a2216a790e755127df2c83b093372fff571a7ddd35d1cf07051625ffc041758
SSDEEP 24576:xQo6UPVuomLI7g+uJ2RMlIjTWBjMhnPqb8:D6U9uZI7g52RMlIPWBjMh
TLSH
T17E451740762BD78FC6A950325E36D6CCA7707C01EE05AF0773C8873F9576668B6E6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 5792df96af962b997d1c6bcf6a8073c293293015b63d5a89dc7d8c1c26b0a708
MD5 d4c03ad15334e72a929dbfc837162e36
SHA1 af3ff5a8821d68d0ebb4500cc195934d57ce79ac
SHA512 667257ff4a91ebbc8fc9084b7e7961ce0c32bf075c3fd3cc8222d36a90e0412068ed87227891a1f6b1f5eddbb4330e3a0fff9df15c726abc32d0a7004d9181fd
SSDEEP 12288:6We86qTcV5SpYRaThJTWOseFhyOZtAIF5EY/7cG5pU/FY:6We8noXc6ReL7ZtAIdDc0y/FY
TLSH
T16A652940A5B7E34FC9BA90375332D68DAB785C02B7453F0573848A3C9866A7DB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\e59bd5b\2026-07-16_57ab4d5f8ea7cd286a9983ddd702d105_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
SHA256 9e44ab7f0f68d8b01b70b52159432174a725894de98a46a34e43e5adac48c912
MD5 57ab4d5f8ea7cd286a9983ddd702d105
SHA1 a61ce59517f04f7ec22c5718413e04910eb08dc2
SHA512 57025d1cf7300866895cdf740518777c8b3bd949dd50999c31156ec5ba2410f09efb3201ff8bf0b35f18103bff7267653467000e12c352a3d64fc276cedaf49f
SSDEEP 24576:rXMWjIbFMZs4YnQ/tbw/2Mkjy6Fr7g0oT:b7IWKQ/lFTjN4
TLSH
T1576501217AD1C437FA7302758CE987BA5B6ABC522F3542CB37C8071D5E352E28A36752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3c6803dd6b303fc22ae981467611665c77fc3429dfb3c01639359cd9eafdae7f
MD5 247247148176d115596a4972a9527e4a
SHA1 be53254565eec5380df5910d514a99293ab4c1da
SHA512 b5742d711271bb10f666cfc0ca9dcd8ee06d69c33d6df536f283a3599fd51d6ce36ab40b2237e791fa63b46999eec0f4376986cf8db926dd9be2fb96504a008c
SSDEEP 12288:c67iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:XinQ/tbw/2Mkjy6Fr7g0op
TLSH
T1C15523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1c57d3733ec9187c49d5ebab64e61fd0a25fe691a7c3df7927cad6d7570435ec
MD5 db280b5c43b07498538e56ba31338dcc
SHA1 b20fbebf70ee12bfc21dc932c5f505a26bbe1050
SHA512 f1ada0f3ac8d061eb229eca9b41b54437f6738533d27f4d43422993604c3a776645483b2afa7fc362c1e496d8b487976d09a754b64a984f55c95b11011be1ebe
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYAnQ/tbw/2Mkjy6Fr7g0oh:Qgb4mBIBhGFfQ/lFTjN4
TLSH
T17365AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 81b67e3bed9983f9ccb242fff204ad90ff1c514c1f1a8705baea2fd60441e135
MD5 4620ff922837240e3e7e2702d3d68878
SHA1 25f9224caed6fc9c09b8706e83fedc6a5b7fa86b
SHA512 bbc0b558666aa2b8aefc4775b160aa916426d5ac22b559cddd61040b41b8204598bd875f166cb789e06bb00b8f89708257a15a2ab47cb0fe0e5d9545464efeab
SSDEEP 24576:2G88u8FpJqH1Qzria7/mPnQ/tbw/2Mkjy6Fr7g0o+:d7ZFPqVva7/IQ/lFTjN4
TLSH
T17185F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3f5e2c4b0884ec798ba84c06e86baec3ccc4e1483b89a19a8d2cac3f2856108a
MD5 c57fe8a8abd2fc97f9d8cbbd171946d1
SHA1 046d5b83c51a69abe68bfce8f402ebc4da56d326
SHA512 beb6661c3d245546773b2a93edfa63e1de4bfc06df6a2278e862bd8cb40ce27c5c35ce7453731130527e544481e5bc6f6e5eec623d3cf663fb22b6e2a33e573d
SSDEEP 12288:5HvUrBFrEjwaQTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:5PUr+NQDnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T12165E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2f8d3c6f07f0ea3c0f6eed06ea4205d0aa4724f296344b2c4f8724d86886e894
MD5 c7846ba20df6583cde9eb598511bb4ee
SHA1 84be1872862068288aca2bae16efcc38c80fdb64
SHA512 eb8d86f6ba3ff6e8e9c897fdeff54e91192fe84458e11edf1a435881f2346b69c9e9e8258f725bcdd4c589c8fccb792bafbb41416e9dc647602ea5b29f4a9a23
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzQ/lFTjN4:NG05lO43bZLm
TLSH
T159D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0a43c2253e235243a26d055b2d0c7e55a87f4e4c8b6ab4397a0b48c1344a618a
MD5 af78edacf30bbbc1f4031f04af5f51a3
SHA1 6c65e93e41b15ff623e322bd7c5aaaed9eaa2a3a
SHA512 f9d2248c3ad6ee8e5ef71f739793aa5c3258aa9fea59d636827d94637785e0f08ba6da9983fb75fcbbbeb8efad4f6ef3ba0230f93b0a65115236bd65b02927ea
SSDEEP 24576:zfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnxnQ/tbw/2Mkjy6Fr7g0oZ:La5POZ3+Jt2pasx2+mrQ/lFTjN4
TLSH
T11965AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7f7ffa40902956087c8cda981d4f6247e6fd42a4eab140a13b3fede3fdfef568
MD5 a0423499513f65bbff278c22ca579057
SHA1 cc442650861e5c8b0cbc28a4950da9a6d996bbd0
SHA512 fe29679a089082bff83e8a0206592911ff15ca47404e2add486041e60fd19caf7d779f8c800a68811384a9bb60aff6c864738a5a7d1010546dbcfca4cf492118
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkHnQ/tbw/2Mkjy6Fr7g0oB:/Nc/zEOVHFoQ/lFTjN4
TLSH
T1D0858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9054705d000f553188308d1e6772d382f9d2eb1bd0afe6c0b4ea75d238c942c3
MD5 c645cb10cae362b1d3398aab01e3e30f
SHA1 e58466304cfb3eb55b696a9008fcd6fa324fdec5
SHA512 894d48c2d915d484e1b630a021478097cf8e85160ef0bd33116a0d9898cd586dd91f7eddc102b25b7ba4a092b3d3f82bc0fb51ced05f26c63ea12bb05b88dd7e
SSDEEP 24576:18kNvNnaFeYhJNtmZBm9nQ/tbw/2Mkjy6Fr7g0op:18MwBtOm9Q/lFTjN4
TLSH
T12F55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7292d69c432ea12170fb491d2d6e0a1c141fd2b64e376e6f25af26dacc684f0c
MD5 980fab781b1b295a4a2acdcd1ad60b0f
SHA1 32ca5f9a040786730f8ec1ef99adc97cb2adda01
SHA512 c9277e9fe4b2fbcb4e56d8cd2467b2d65b26f05e0420cab849e6270682651a62977ac034f6b5f8323683ae5e24072de41ee9b087af006dad31a79db62e02ea74
SSDEEP 24576:0D3FHshBIYQgAOnQ/tbw/2Mkjy6Fr7g0oJ:0DVHeBIAAOQ/lFTjN4
TLSH
T14075E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/300-75-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/300-83-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/300-304-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/300-82-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/372-20-0x0000000002060000-0x00000000020C6000-memory.dmp

Download

memory/372-97-0x0000000000400000-0x0000000000586000-memory.dmp

Download

memory/372-13-0x0000000000400000-0x0000000000586000-memory.dmp

Download

memory/372-14-0x0000000002060000-0x00000000020C6000-memory.dmp

Download

memory/372-19-0x0000000002060000-0x00000000020C6000-memory.dmp

Download

memory/372-322-0x0000000000400000-0x0000000000586000-memory.dmp

Download

memory/1408-48-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1408-67-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/1408-50-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/1408-55-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/1408-71-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1512-99-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1512-396-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1512-394-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1512-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1512-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1512-105-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1764-145-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1764-143-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1764-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1764-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1764-137-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2252-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2252-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2252-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2252-382-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2584-287-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2584-59-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2584-61-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2584-69-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2744-131-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2744-125-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2744-381-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2744-124-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2936-87-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2936-319-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2936-93-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/2936-88-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/3380-327-0x0000000000400000-0x0000000000586000-memory.dmp

Download

memory/3380-81-0x0000000000400000-0x0000000000586000-memory.dmp

Download

memory/3380-1-0x0000000002120000-0x0000000002186000-memory.dmp

Download

memory/3380-6-0x0000000002120000-0x0000000002186000-memory.dmp

Download

memory/3380-0-0x0000000000400000-0x0000000000586000-memory.dmp

Download

memory/3380-7-0x0000000002120000-0x0000000002186000-memory.dmp

Download

memory/4524-24-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4524-32-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4524-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4524-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4608-380-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4608-117-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4608-377-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4608-378-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4608-111-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4608-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5716-393-0x000001D2B9230000-0x000001D2B98B0000-memory.dmp

Download

memory/5716-411-0x000001D2B9230000-0x000001D2B98B0000-memory.dmp

Download

memory/6020-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6020-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6020-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6020-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6020-42-0x0000000140000000-0x00000001402D4000-memory.dmp

Download