4197db1f0420cf1da923c0b907791e3a48af13cbac90fa5050bb74b1cb80001a

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_94dddfa001478ca064c736e2d511d898_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
Sample260723-fdm87sgd23
SHA256 4197db1f0420cf1da923c0b907791e3a48af13cbac90fa5050bb74b1cb80001a
MD5 94dddfa001478ca064c736e2d511d898
SHA1 5fe7b5bc9b8bef210c01d2d64f2e0da2a27a4380
SHA512 3f4f139edc5c99b3cbeac8583fad694af5ef7afc2a0993318fa7f2d5c6ffe7a93518259ccda606165ca2ed2fd392710eb0cc4344518ff90200f968dd28e08b82
SSDEEP 24576:q3qgcetbQz43+wratr0zAiX90z/F0jsFB3SQk7:MbNUBSaB0zj0yjoB2
TLSH
T14275BE0137E89131F1F73A7679B692654E3A7C61BE31D68FA240AD1D2E326C1C934B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5652	elevation_service.exe
5492	elevation_service.exe
3924	maintenanceservice.exe
4936	OSE.EXE
5296	PerceptionSimulationService.exe
2352	perfhost.exe
3172	ReFsDedupSvc.exe
5624	SensorDataService.exe
1084	ssh-agent.exe
4820	AgentService.exe
1384	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7b48527f238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_94dddfa001478ca064c736e2d511d898_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_94dddfa001478ca064c736e2d511d898_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_94dddfa001478ca064c736e2d511d898_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_94dddfa001478ca064c736e2d511d898_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_94dddfa001478ca064c736e2d511d898_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_94dddfa001478ca064c736e2d511d898_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_94dddfa001478ca064c736e2d511d898_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_94dddfa001478ca064c736e2d511d898_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cf2a4225e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066ee0d215e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f7d0c235e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca4bcd645e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5652	elevation_service.exe
5652	elevation_service.exe
5652	elevation_service.exe
5652	elevation_service.exe
5652	elevation_service.exe
5652	elevation_service.exe
5652	elevation_service.exe
5492	elevation_service.exe
5492	elevation_service.exe
5492	elevation_service.exe
5492	elevation_service.exe
5492	elevation_service.exe
5492	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2440	2026-07-23_94dddfa001478ca064c736e2d511d898_amadey_elex_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	5652	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4820	AgentService.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: 33	1384	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1384	SearchIndexer.exe
Token: SeDebugPrivilege	5652	elevation_service.exe
Token: SeDebugPrivilege	5492	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 3284	1384	SearchIndexer.exe	101
PID 1384 wrote to memory of 5432	1384	SearchIndexer.exe	102
PID 1384 wrote to memory of 6000	1384	SearchIndexer.exe	103
PID 1384 wrote to memory of 1228	1384	SearchIndexer.exe	104
PID 1384 wrote to memory of 5444	1384	SearchIndexer.exe	106
PID 1384 wrote to memory of 2944	1384	SearchIndexer.exe	107
PID 1384 wrote to memory of 1924	1384	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-23_94dddfa001478ca064c736e2d511d898_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_94dddfa001478ca064c736e2d511d898_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5492

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4936

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5296

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2352

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5624

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1084

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3284
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2816 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2816 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5b53a26c749244ae34de90bf8865aa3a7b35dcaa6a572365862e5e8e065bf7a7
MD5 101807b8b180b2764b7ed27941b2e0f1
SHA1 719cbdb0cd62b7ff82f138b6b4beb1b074093196
SHA512 1e39e300303d51f112542fe7d91f3ae161f8c49e75cf68d2cbac517917879c5f4eca1175762fdc7ae470b7e07876d1b8a5e6fd8966ac276f849edc9c58369d41
SSDEEP 49152:1b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9aB0zj0yjoB2:L3q6HjB7B2Yyjl
TLSH
T167D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 44a6556d91b7fb8642a3cc04bf28f89f82ad31e88f448af45cd5eb88f839b210
MD5 9dd9abcd004fa6234d94d13fa0dea36c
SHA1 9ba3ec776ce79ba733e2671814d2c861776c0065
SHA512 745572cec893b1f0bad22b6d93fb10424356494058c1fcf0a660d16296bd08e3e3b3807c2b4fe1a2ce2ffd1f26627db154358fd9b0ca5c10bb53e6ff970c0f48
SSDEEP 24576:ZXYfDtczAYatr0zAiX90z/F0jsFB3SQk3:ctcnaB0zj0yjoB2
TLSH
T129650229779504F9DC67823CC9A18506EA73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 bce615f26af39ac51e4cbdc8640826fb4a41c692165044d3178be05e2b634f41
MD5 3e4916ac902ae9e52dee0c87f1fec87a
SHA1 39847d691eccb1c5b03a1f3dc48eac0b224f3d40
SHA512 027d95af0706342bcddf5a94009ffd6daeae78a6fd7ff38a9d42767c5c4672124791540edfb865af8ca95c2edd6a4626fc461782572cb3263800901e21eafb89
SSDEEP 24576:n0Le5ji0hmxirMpatr0zAiX90z/F0jsFB3SQki:nPji0Ac6aB0zj0yjoB2
TLSH
T1C4859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2080f0f0311f3b3721745c847f874d2f1b568607a943791ae1bd003d4476b140
MD5 70712482b622de3a4ff06ece70f85afc
SHA1 fdb76a9f6373771d6e5d333a546f3a73b5cb911a
SHA512 01231a995e40697e4946aa76965e2a6b8a666cc790fab9014f1534a32e6e6d6f9ff0262b43b633dafd63bd34790502bf0fc5edc1cfff9ff9519498d9ca5af571
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyu3atr0zAiX90z/F0jsFB3SQkQ:E/ezSC6vUzPvxHjyuaB0zj0yjoB2
TLSH
T15B755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d4d14e22161f57913a066f9b0fd53688fb5783e977df210a8a7eeabc1807ce19
MD5 64d944dd5923a0bd6e13bdccefb1c329
SHA1 3903833639c714492f97aace898e5dcb4713f24d
SHA512 4ace73ce428c8781f29f7714668f8b3f5b5e43b7f34d5d73d8d76d2813981e753b978df5a16388c14d6352e01b56c4fa785b5851373c1bb87492fab560f2492d
SSDEEP 24576:TVbqPb88hv/l+6Eatr0zAiX90z/F0jsFB3SQkx:TVO88hXl+NaB0zj0yjoB2
TLSH
T1A155AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0f83f38d5ee5812d8493df1a0323e0ab06d8526421fa18e24531702a5917481e
MD5 84bc73c50458f1196dfc5ab9ac786307
SHA1 c3595d9f8d7235ada83ba26e1ef064faeb7239d4
SHA512 d24462761f570a181b6df41cf1ebdf909b489cd03c858a97bae08587ce6ff519d337d8d50069b30769f641f1b8a390dc6bba03bcc01e5b2a4ecb801b4e7bae5f
SSDEEP 12288:YR1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:YR1atr0zAiX90z/F0jsFB3SQka
TLSH
T1D045230B341E80F2CDC32B3526989C4B1AB99EB065E2AF45E1D13F4F9D3C2C6A5656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 75c496ce2549257093bdb789492cb6ecf11e92797c110bf2764c997d51a81d1f
MD5 a213f4bac88dce8cc16b86161422bcc8
SHA1 e6e7e146e4332145574183f4c80791766cf663a1
SHA512 6eff1140c9213a14975d599f7ef744bb470d0fb5612d91a99dd6e49d2ed69e7dcb3baf4e83a3bf9cd691f21096456c0efcddfb7ec5134d4339e2bfdc4550b030
SSDEEP 12288:OeBNUbTVO86UcUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik81:OJIUcatr0zAiX90z/F0jsFB3SQkA
TLSH
T1CB65CF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f102c5f607f78db2c8d8326520da1f6d47e2e74998afd72d1130321ca7ecd67a
MD5 4cc46b407009081124c8ca2e179b08df
SHA1 4e2cd41fa0dde8cdc9210a2067f62e5bac8be5a3
SHA512 7c7c2bc678eb2de43c6fc5a4b6b772afbf97e3494e748d24412e3867019f5da1b4d212218f7b00ec1da9c5b1110404adfc3c3a0fe06c19881221b22725ac7563
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THy:VQvGAdlCEL8c/yRNw5CaB2Yyjl
TLSH
T17A267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 89cde199ee397b876dd0e13466fa9e701c9a2290bd2df867a017b8816df00452
MD5 14e6c283cabb2a5f8da4051a69e227f9
SHA1 7dfb12780cdde20aa3edff7d3f020776160cf155
SHA512 c77321939932225bb704bd556c7c90d719975c87b8f83d2b681fb476934e310f97816fcb89e6de487609e5974fd54ce002f05f55cb2e3d7bd5aea09a02f32c03
SSDEEP 12288:GAwSfxL/2Dc34DLLmt0LDQewsAjqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkH/:bdewsAjqatr0zAiX90z/F0jsFB3SQkn
TLSH
T1F175E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 49dcaa2dae60a2d3c0c8a661717c619d601b5d27ce71c1eaa8ab0f71c34b5b35
MD5 654dda5c9ca05aa0ccf4ce23091d8b87
SHA1 ca45d37d4acd7fc09748255a770317b08cb8cde7
SHA512 4a4624503d2906393c69ebc594097e46de817708dd8838b73bee1af71552636e27259510b26d6a4e56e2dddf16f2b56b032ceffb1710d90f4efee0c298924dd3
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH1Z:+UEtQevvqc2W1cpV2EI32v
TLSH
T1F4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6dc5fcb44b79f84912cce0d9a829e1171e29c55174d7a5886b29861004060fa8
MD5 5dbce515f3191a06c3ee20aa4dfe9c44
SHA1 36115b5e0c23d8c0c93d5b67c552ce342653b054
SHA512 0bcac728abc2852e20db0f95eccce769ad5f8b4f8d0fda138d9f76bc0a6007b85f0b518a3e9f1a8ab98eea460abac643fa40c50d34e0146d959ce1b63110dd1a
SSDEEP 49152:sCbRquA/m2yL5zQfFiV+XenmE3/zKaB0zj0yjoB2:FoqtVjnmGB2Yyjl
TLSH
T1D1D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b7d430a200653ed117dd99a026aee37e9c67cb6cb8b04ba7fc0877496d34abbe
MD5 8186d1e534b8ec0694c05d7e04f851a7
SHA1 278ddd02bf625a3c819c21654e71214e2a1b91aa
SHA512 bebb1d037e6ab9b29accac787c63d9af6a0eb6110937951c5829da852eab22c9fe29baee2321733bd29e0c47501a8d58490bde859fa2d34aac556e3ec4bf5774
SSDEEP 24576:IAhGLJIFoiwtA5l7S537atr0zAiX90z/F0jsFB3SQkJ:IAMyFoiq5LaB0zj0yjoB2
TLSH
T1A2359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e3723292e69996905e6a219501b4b7e137fb7a86666fe3b3099be804e4e88eb8
MD5 40f25798c046f6895c741e8e53e04a5d
SHA1 4a1c920a62a5aca07bcca4f1377e9abb7eae79b2
SHA512 d0c3cbbd2fc37bcb910ebf83531eb124a80a5101bca24dbccc7d0ace01a8d4edc9e914df426218db391fb75214ec117b3b40862f7b7c40a94e81f9ceedb9be32
SSDEEP 12288:zmw5HEjsChNVBFgl0WDm+CXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8q:SwuoOWqatr0zAiX90z/F0jsFB3SQkT
TLSH
T19665F14A36A90CF9E9A342388587C536F7F2BC112A61DB1F1360CA5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 dd7b04f5b8212b93e82816f231e261b3a0b5ff8bc85c9ff39be8b117d0baab44
MD5 82b8c6cbf4c0d1743d3fd950e21fe94e
SHA1 2f679878eb6dade73c244bc127ad02047d9acfe0
SHA512 015dead765ec325395476f8f7240260097f4368fa85ad46e7f4e7ac752bd0462ec2629a832cf8aebd6f14b801ffc627731f413ecc82e1aa1491669547aaa80ba
SSDEEP 12288:8BZ1IyaUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8T:KZuhatr0zAiX90z/F0jsFB3SQka
TLSH
T1A855124B32A920F6D5D3523C89E48906D7B2786123B287CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e23152306b6ee46314cdab081c2f67373e294be1bb521fc117b71c46c2a12287
MD5 e1b6f024f849872cab9a22bd34e6a89c
SHA1 e14dfe18d1e2ab99129a8428cfb9edbace109df9
SHA512 4c50ac93848e9ba48b3b347f25bb2b608c005fe29e165681ba0b3c27183049cc12ded965ca9294478f2b312e6b29a04f2b4b2b27c9903303beea94171d5f8958
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:UQRQyi36YOcPQLvw2gAf+PN3PB2Yyjl
TLSH
T1E7667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f90fe84a1e14313c74ab069399f09fee149cfb832857b4728064587f1ca86861
MD5 322ee68973f1e65d239ca6b2ad60e273
SHA1 8d704397b8dadc20d1f717bd760d212df1c0407d
SHA512 cf15380ec67351af337760e6414de6cc910caa28e7b4659c8ba33362f197f9dd31693a161084d6a79113eaf7ac205b5744140b52392ec84c555717e3bdbbecc1
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:KQRQyi36YOcPQLvw2gAf+PN3PB2Yyjl
TLSH
T104667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c679bcc2b0d04d80530ee056ca07b66d110b190feb4d270c17671e5fd8677d06
MD5 1f3c9390ec34ffa2cf190153ba728aba
SHA1 9413de08e9465fb7543a3bfcf1768a3afb663641
SHA512 a1d86644cb5a1c30726714a8792f809bbfc51c1dcd95453c277a57775543622ddbf68dff7906be476ce281c7e711738ea303acbfc4ecb0650b26317fb76ffb29
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0xatr0zAiX90z/Fb:E68Qg55nhheWu7PNU3/6aB0zj0yjoB2
TLSH
T120B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0cfb82085ebbdbaf4f58dc17b15e323c9f3550d7d5b9c6ae685deaf505d378d0
MD5 dfd137af9310dbb1ac4c959d27ee70b6
SHA1 2566bb07b94635d7264524071a82ec81a18638fd
SHA512 16805823bb0b43124e0d02340375b13d1b51b9494a5d5f236c861e70de541abbe9591b9ee4d55ad8bcaa7bc0b0cc98ba50054732786b50ec3cfae73c50b0f3f9
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99U:/y5112gYy5azzVvL69nLKnhZkB2Yyjl
TLSH
T1E6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b002e76032c7a5217b809b648e74ecf1f7e761e8b2c81c3a6cb633046ab698d9
MD5 0dab6f8b615d6f49abc1c5456106ff03
SHA1 974d2cdb47d0f5a09d6ada17cb1d6f1981ddef60
SHA512 c6e933bde6c29e1fe2f5118d3206bff219898aeaf1b93c922cfd3a3aec803c71d9b36b7dd6f82ad561dba0f9a50f32b6cac7521e5e301a38d4a7df26b427ef86
SSDEEP 49152:gB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glIaB0zj0yjoB2:6u6JmVxd2dHB2Yyjl
TLSH
T146D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4547436ddd8c1ac0a1e3fa17085c24b433f44ac32d77cc4d351491b9a99568e1
MD5 f5b8b54fcf03938e28fa7a66291799ae
SHA1 9b2d71a97bbfe662cd8c4126abc3cb137a97ba1e
SHA512 091613277b81a0208aa0712e567185c5739338daf792eebcb69fe658b9cfa9a23b72473aeb553e3ed6156de5adc6ade8b7dd61c956b04c334f97ae4626e3efc8
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4x8aB0zj0yjoB2:DmifPbRGB2Yyjl
TLSH
T15AB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ed2757138c4b64adf14426e9951f5ec86fc404bb20d0d9db008e8b78a3a3b6d9
MD5 49d8421a4b7fa8386e31e7ee9d005c39
SHA1 c6b8b982d227f23be148145f477985480ebf6ce4
SHA512 8a03bf04b0c28c8f77185c147efb118f3f900648a63d880835a2ecd2c7acfcf92d7585456498b78742d8be71b30ba5666b69dc7d5decc90b4a239ee8de8b7b2a
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHqhaB0zj0yjoB2:H5dKTi61IB2Yyjl
TLSH
T1AFC5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2e8a150de93535f6f8d02a7c6d84a3e954b916430a2e6c99d3552df70f291cbf
MD5 f5e105c38f4f9a9a41df28cdfc8c62e1
SHA1 3dc0e61ea1ef8d2a68d6e559768f9f332224ddc7
SHA512 d52c09fc308dedad8542019414b3aada168913c633ed9775d2317ded50c9669c320ccf0394788ddcb5b9487eb8840b2f77ccc5ee45d5bf78e7f6886c79531f3a
SSDEEP 49152:whtSn8EApI0figngiDn0AP5wYaB0zj0yjoB2:hX2iyphCB2Yyjl
TLSH
T11295BE13F2D900E8D05AD178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b23f794c5130deb24aa20fdc1209660e2806d8f968ff4c45d8ccf918ed1173b5
MD5 fa83106678d4b729b374f946ce3fc83e
SHA1 4602ad2b804ac55a8334fd5aa49c49b96791d01e
SHA512 0780c08c340712bd5f3948110cc5e141eea29d57fafbad2b2835761addfbe4caf3c2856bf1a840516158d0fe1f184d29a868889d860d8bd8ac3596bdd68b013c
SSDEEP 12288:SNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:SNatr0zAiX90z/F0jsFB3SQkF
TLSH
T16545230B341F81F3C8831B355688984B1AB95EB476E36B85B2D53F0FDE382C715656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 84e53658542ab54760d0d7dc138e199b5a39729d7dd4e855d5bf1f9f1ffac0ed
MD5 1a16e155a646badc0cfb466411c144bb
SHA1 d95e9789537bd9848dd6ed374494d29993d6d67e
SHA512 4b87ce2641cdfd4869533b361082d3b7ae583f8a85437452d83407dc94c12bd52f12a90b38186ac7f62175b59dae98171e123e9d8f6597727d3702fb16f1b6c1
SSDEEP 12288:V2UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik85:V2atr0zAiX90z/F0jsFB3SQkE
TLSH
T12045230B381F80F3C8831B355288984B1AB95EB476E36B85B2D53E0FDE382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2eeff58f8576e8e3efaddcca52370f163f948542ba09c5a0683b007ae98c4c91
MD5 a5a1cbdfbc75a9677ee04ddf20f848e8
SHA1 bc3e1d42a76a8844845fa59518e303eceeb985de
SHA512 d5680aa3d51975d612614207757de586eb64421e2a9b30eb569c608b062f20f87ae4598c430eb6e65b5cfd6ecc5dc856d0e8b47e8daa6b55a5b4c379ca1f0e28
SSDEEP 12288:wUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik85:wUatr0zAiX90z/F0jsFB3SQkE
TLSH
T1EE45230B381F80F3C8C31B355248984B5AB95EB476D36B85F2D53E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c85ee3049ba8f9a4a10b34b31d339c6886dc308fb5887e5ce3e682afba39fc73
MD5 9084161cf70a875c4f6143d3be4a6b5c
SHA1 b16e16fd321616c5ed9428b939d7c0457fef3359
SHA512 dafa25c413b8d6daf2371d603ffafbed6e125ea4fe97975101dd02627c739f6ac834f5322e87b1afeebf28f3fc15a51b3fefc1be9b876d35fb5bb968ba178c8a
SSDEEP 12288:lVbUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik85:7atr0zAiX90z/F0jsFB3SQkc
TLSH
T1D445230B351F40F2C89397358694884696B5BDB0A7F3AB9FA2813E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6950c89ca17c364c25f4ce5c1242b254c25230d466ca51405e0276187f42ac01
MD5 071b6300f2a5def7f0977b44f49dfa80
SHA1 64268e9fee7c7ea6847b62b9331e1448f61c0f7d
SHA512 dd13017348653d4ea1ab56059da28716a048ee83cf0a2b335e5dc093ecc5c2aaee95306c0a28326b7a8c439831fb38dd8ea9c618a7a6b1bea0896afdf6fa858f
SSDEEP 12288:ODUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:ODatr0zAiX90z/F0jsFB3SQk/
TLSH
T18245230B381F80F3C8831B355648988B1AB95EB476E36B85F2D53F0FDE382C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1b44277682b1f5f8fcbbbda18b590b6fee4f13401973620136573271e388f771
MD5 48342c1925797c3f66ced9846ee6e4b6
SHA1 8c8694db1ee00ba6eb8df95f8f434281640f8ba9
SHA512 92f327468e99d22d5abf6aa781230bed0d78f943ad7c9f55b46f0c35ef4d5dca5ae3737b67e45459dfde205a7919928a93bf33ee97dbca45b9fa58fccae4ad29
SSDEEP 12288:9iUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8M:9iatr0zAiX90z/F0jsFB3SQkl
TLSH
T14C45230B381F80F3C88317355688984B1AB95EB476E36B85B2D13F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f6fc37ecf40d42c16cad5a4638bd37aab789ebd5b1d346d68d8bc9b4f3df4257
MD5 fe4ec3c89fbde64feb9d86496233337d
SHA1 590e5626eafc21beabff8ba0a399f327b7c6d964
SHA512 ebc3508e1db8ad822cba31332cc30086e994b0ae3bf054a86ae9a5c15f5eb365c021cceeb8dc97cce819eff1c21578ebe8053564e7e80623dc4d80f55ee86a3a
SSDEEP 12288:reUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8i:reatr0zAiX90z/F0jsFB3SQkf
TLSH
T1DB45230B381F40F3C88317355648984B1AB95EB4B6E3AB86F2917F0FDE3C2C625656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 92e1d6fb33add3e184ce67f816cd06f1f88f148d4f645c8e6b6f38bafe9300d1
MD5 8ca7e17a6fead29e982fa84130ac81cc
SHA1 83b4dd1e5d2cc1855d4dcd60080f73d664f81c0d
SHA512 48f287d9220b4aa9b5229f3c525e4c51a3bd3ec7d9aa910fe380f0e2ea7d207783201ec9c003db0090115c67b466a11c16e5cff71eba1acd483ed2a66a7ae4d2
SSDEEP 24576:4ZMSzFVSOWatr0zAiX90z/F0jsFB3SQkF:4ZMSzfSaB0zj0yjoB2
TLSH
T1EC65019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9f82533f5b52feb2aa1a6094b81b77fa56395e3ed77eaa3f0cd2f31735ff0653
MD5 134e66b699fb4ded0e12cd27cf068017
SHA1 3935a16df2781f3a16cf82f0f1868b78fd21f1e4
SHA512 291b2618bd1900148359b244d037b7f7390bd4fd0de2364af8b93a6d1868664b7f04e2bcc543d77c16da12824174180bb958856b8141bff210a5cb22ac85cf85
SSDEEP 12288:NRUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8T:NRatr0zAiX90z/F0jsFB3SQkG
TLSH
T1E845230B341F80F2C8831B355288984B5AB95EB476E3AB85F2D53F0F9E382C716655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 daf72d6bb8b17fb0262b07d8575c37cedc46a746842e037520b641df49b9851f
MD5 087e78769abfd515f338eb9e8ca678e7
SHA1 e0ed8b75a002679398d3365e00fa7d2b893614a8
SHA512 0ac818c827fd48e1f239ee246ca9bf93a15b41182c3eaeaf50e9f4f4ad84c28030eddb6fb32088fec901a9dbc65a493282eaaec0b3ade88e394920d3dbaa75af
SSDEEP 12288:KlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Y:Klatr0zAiX90z/F0jsFB3SQkN
TLSH
T19C45230B341F80F3C88317355688984B1AB95FB472E3AB86F2953F0F9E382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 6d98178e559468f9734b04152a44cfb6e43842f98f4aa8d6a0d87629bbdbe2f4
MD5 b58303589c861acab96e757744812958
SHA1 3d9ec5613ce51cc8d4d526cdaa16cf56a87258f3
SHA512 2b7117b8dc4fc17e071441b8d3565724722fab6f0b5353079f29bc47b0200b0a3899d926e5736bd470fab2ab4d76d8e2b9bc4d058103e1eba2fabce3950c6324
SSDEEP 12288:oyPz5L8aUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:pzyaatr0zAiX90z/F0jsFB3SQk3
TLSH
T1B4551207326620F9C4639238C9911D06F775B83117A19FAF53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 59b1764d0d66d0cd07d822b95f5d23cbe6f073537148436ac9a7436a56685a90
MD5 838ae1dfb4e3e3ceb6c5ef369c91eb3e
SHA1 5fbaa8d27d867430c7762209b9934b02ae731670
SHA512 14ea13286f9d5497135e11cd935bc84c31c80af6f3bd9fc23650d1bf48dc18aecf6fef532fc0f23463fe0eb60608d4409e53aaa4a9e0b56230a130c9869d2239
SSDEEP 12288:cRUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Y:cRatr0zAiX90z/F0jsFB3SQkN
TLSH
T18745230B341F80F3C8831B355688984B5AB95EB472E3AB85F2D53F0FDE382C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6f1bf191378acd3bb44cc8ddc00cde6ad5b961a8f8878e74135ae556654b1c99
MD5 ca1aacffba5d2afcab64058f2c9ad259
SHA1 6e2466d05eaed6aaf00b06c51f8d841f6a3df12b
SHA512 323becc65142df9433f0570cd6658617cef23a11fcacb91d90b971eb76019c66cdc4974229480946fa778c96b71a004f4f7babca4c1c4dd0a12b778137147463
SSDEEP 12288:uRUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8I:uRatr0zAiX90z/F0jsFB3SQkV
TLSH
T19E45230B341F80F2C8831B355648984B5AB95EB472E36B85F2D53F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c6e9941ff7e60c334756ef4f83194dd4054621b9411e8ebb22c6317209cc483c
MD5 b89993688c65b882f995f7ec926f3346
SHA1 9c10d702136abfcbbe3d3e15f275b0ca0ea34fed
SHA512 b27a406d912efe2881eeb887bc810ec63981da19616d527235669c545e359b5c11d58ed9fd1a79e8b56df69dcdcf65c718bc76791cc5381a39cfc448523d3f3f
SSDEEP 12288:yyPz5L8aUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8+:vzyaatr0zAiX90z/F0jsFB3SQkn
TLSH
T106551207326620F9C4639238C9911D06F775B83117A19FAF53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 fb16e961a51e94f7f89fddf478f8bf18ac199bf9e7a02e23bb4a5c2ff5968f35
MD5 3b55ee5b2e6ead3de7da4b130bb7c230
SHA1 bb14d72395a24c2e2ed0f5e8a1c735a1a497357a
SHA512 62fdff743ad85bcfa5cf2ad529a5f792311159858c18f32869daf58a262ab730c3d882b6d40b1b86812cbbe77c0cf678498263ec60c7f6a439e0c435617d3b9e
SSDEEP 24576:gTHaLl3z0zDkatr0zAiX90z/F0jsFB3SQkB:gT6Llj3aB0zj0yjoB2
TLSH
T1A2650199735018F5DCA3823EC9548906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 3d20f12db10ce5e2e4482c7fb59f11d221bd1bd34298f4862a13cf96dc79f4de
MD5 b226732ca4b4a56afbdcd6681251356e
SHA1 a3599dee3396d83039be0d162e70a749d1d1c0c2
SHA512 90967921cebb75182f3537fbd57203217702c882e22b84dac4d7bdea768c29b4a1ec73e9516705bd466f5292072d77617c504bae7306294f2eccc73a88ced57d
SSDEEP 24576:B37d9CHKy7GZQatr0zAiX90z/F0jsFB3SQkd:x7d9CHKyaSaB0zj0yjoB2
TLSH
T1F875CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4e581d8dced710e6fc74d8d22b9189a112ad67f783f9916877e4375dd5257011
MD5 a39bf82bb01814eb4d3ab4fe69f6d0a6
SHA1 0d02052ffd2c7df261f17b9bc9e7a021473a50b8
SHA512 8cc0950d1c59ba7421aac97ed691d13056a2b9464ba604384c1b222b86d16a1f9b27240a8c005d3f3cda281c97d98d54a22d583c497fea5377ff4df153c8a7b0
SSDEEP 12288:c0UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:c0atr0zAiX90z/F0jsFB3SQk1
TLSH
T11245230B381F80F3C8831B355248984B5AB95EB476E36B86F2D53E0FDE382C716656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0ca5385d377f72e9d0fba13e988ce8612c49eaa247c58a0ecd7f9653f6c0b4a6
MD5 544e420a5e53f34870f49c44ed7277f4
SHA1 017c832d24b743989b3eee6b5e775c2aace2fd05
SHA512 93efb4ee523e8db47178f7ee511197dca981715266894b3f316438986043b9afc888a28403fe43191e9edf26751e486cfbf4a6250672f948729b077af7690d61
SSDEEP 12288:V6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8D:V6atr0zAiX90z/F0jsFB3SQki
TLSH
T11645230B381F80F3C88317755688884B1AB95EB476E3AB85F2D13E0F9E3C2C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3aa542c1edc4adeb4a8261060e17bb17f1c993d819328116ba5811017cc75ca6
MD5 f8d8b8fcb3c087c4ac296f555c4eae30
SHA1 cbfa1b6982bfd5448ee7874c539770388b53ef51
SHA512 c24dc0df760c149c2b530af9a2d82d2f3f70d7ec474e2f37aca55b9e8fc35f89cdfd946c4e1e87747035d11bd12e263a8edeb6599cfd1c956f18c2806add17b9
SSDEEP 12288:D/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:D/atr0zAiX90z/F0jsFB3SQke
TLSH
T16E45230B341F80F2C8831B355248984B5AB95EB472E3AB86F2D53F0FDE3C6C615655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9fe3115617de9a7a08c8afa20b4cce177dcd7ee6633329d72c18006ec5830f5f
MD5 3834b43bf5477fc55f2de681618539f5
SHA1 0fa7235c5c88646fd14bfbdd7a24e825d0a133d6
SHA512 0e84c7a7a7afcf30a6c0c1397b62f7507aeb40ec05faf861ca595a4fae4665470e9afb145817fe7539bb97d680b944996ec6d34dbfd866db71db6b414c150642
SSDEEP 12288:URUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:URatr0zAiX90z/F0jsFB3SQke
TLSH
T12A45230B381F80F2C8831B355248984B1AB95EB476E3AB85F2D53F0FDE382C716655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f498f2a02f2edf27885496957f4795f30c8e10916a82d3ebc8b2ab963c111269
MD5 b63fbabffb25e9e9c209b1145b166058
SHA1 44cb4eb48734e62453be76618f9a766aa83adc64
SHA512 a0a1b42f84d41813468a504ab6ee7c0abb5013e1f6d6cd42f8caeb679534a14940b6d323c541ad0f66e7f8f2ddb945b7a20cc410cbc4532477458f5d4027400b
SSDEEP 12288:s0UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8C:s0atr0zAiX90z/F0jsFB3SQkn
TLSH
T14C45230B341F80F3C8831B355248984B5AB95EB476E36B85F2D53F0FDE382C615656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 bdc33eb245503e8bdaa9f5d012ab8bed257b0fc0a762493ed4310e3fc649be7d
MD5 97ec86904d6f5f7ab4b8b18d2b41e5d3
SHA1 271672435a0c97ca91201b70af9cbae0de7ba91d
SHA512 11dc4a2477811499bd62fc3cac08743c13044efd70d457e5401307569b2e04472ac5f2e71994b7f3396ed2a228ee04fbd8c52e87142f071c7b32afa51442c055
SSDEEP 12288:25UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8m:25atr0zAiX90z/F0jsFB3SQkr
TLSH
T1FB45230B381F40F2C8831B755688984B5AB95EB472E3AB85F2D23F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f9cb441c7666356923b963a5322eb4dba73a92ec111a1466487553143fb525d9
MD5 9a32c018a54e871580cb725370c86bb5
SHA1 b4f19ae25f2d1b70ea94495c45beba88d4de7f28
SHA512 074ca67c769ddf2ef6cf5e41ec945daf25be518dd0fba0fb45b868233cf840a1ace99d4e299979b73fa7e69b51c371132fd762ae187ff3d580595f60ce0ea8de
SSDEEP 12288:aDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8S:aDatr0zAiX90z/F0jsFB3SQkj
TLSH
T16F45230B341F80F3C8831B355648984B1AB95EB476D36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ddd57932599f7a98e83d409ce4438ce9361af2a64840addb5f645c4f1dc5146f
MD5 f24931fea11ea0779225a5dc97d91710
SHA1 6b4774c8b9edcebbbfa1da83c53fe8bd8d985127
SHA512 fc01a7a8a086b9d7d127b3a2b55278c3eae3b7570dfbea5bb47a2760a94adae108855ab6f825a61c7725ce80826982270254062e2bee88d3b199941e1bd585db
SSDEEP 24576:Rfwvok9RX6wkyAIVatr0zAiX90z/F0jsFB3SQk8:3MnYIVaB0zj0yjoB2
TLSH
T15D85D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8b802fa075db9e6f6ec448bd0814967f158f2a4e6489818213abb042d946dac9
MD5 666f31428992abd92faaa201d0c03d61
SHA1 55a02fb5335312fa7ee8989c3a0c21c2eb78adcd
SHA512 4c28a9a10bd0d30f6d2e44f7af3459708a1b9cd600d5bb0e89eb5289e8a73acab6859d797779e4dfe7c3c1ecdd28ae30a6f2f451a38e6ca7efd123a255d3bbfb
SSDEEP 49152:9YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04aB0zj0yjoB2:9ySzPvB2Yyjl
TLSH
T143066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7092ca84a0b6be4c08c5c7cb235207f619d3f0b0db47ffce48bd770a43bdf966
MD5 c4cce04af33707e570558db2554f156e
SHA1 c8dec0caa8e297bc874a2b249d9794f9d5518abf
SHA512 455361d886aa4b8fec27efa18588c8422e1ece44302b18ec4b1d837c295d0bb8df12bf88a32d6492deb0936aa3309301cfaaaa4bbe182e555c920d45a18edf47
SSDEEP 24576:247Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYGatr0zAiX90z/F0jsFB3SQk7:247JUQj1irIhCnDHUPfF/oaB0zj0yjos
TLSH
T1D865AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF22B0537D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3127384b75521d4ccc3aa5f032961c996cb3ee699f3b7835866282a094d7b7f2
MD5 ca849b1ebe9737c240cd039dd6d7da54
SHA1 ca9bf430de92d511c8b8531cc8da000964a23a16
SHA512 887a53b872959df41c8774e6d427ba9f8afd4f01309d46952026bff09f4fc3d0c46dea7651a9fa54d2de94fbb4b495d05ee8f267948895fc14c7572e5b7730b6
SSDEEP 12288:PNsfhUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8t:shatr0zAiX90z/F0jsFB3SQkI
TLSH
T1AE55F00AE25801E5C0AE6239C7544A41B7737C6493E2D7CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ba97550ae6b680c5dff05779b871ee2348004fb8f20b53f92cedba933170b1bf
MD5 e6d6235632377d20eb37743339202aca
SHA1 a39a3d12dad8bac57a29c6f3ac76fec92fd29011
SHA512 ec100b1dbe3fedbcde1fa13c2d3e05e8011655383fac41ae5591857dfdd505ddd5d72b61a18d1cd314fe69b4da581ce0c9a8443754954f2190b66fc20aac18ef
SSDEEP 6144:oosBC2na2hdpIrERdfKDexHv41y5pp5kvLm0eAIDU0INCQZ7DKHSxB8q9NKyf1QF:6jvz2y5ppuZMYeQNDKHSP8qLKwQEXv
TLSH
T16F350701762BC75FC6A940326E36D1CCAB707D46EE456B0373C8873FC576568BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 094d0e270a1a36fab6cd27430f5165e19b496d35a840d635bfe3536cc5249657
MD5 1844cfc45b71eed8b244875712a99395
SHA1 b30818374a7ac76b753165de87248bcedfe03e60
SHA512 254056c905e798cbada6b80e49f1d316e0a16ca58ec13650b8ffa4762e74de5338abddd3a299ea441654c385ed977995f1a0066ffd833484269f9c62f3872cde
SSDEEP 6144:Hkzdc4CZoF50yjmgIDIDmkvqmVskv0kZqU74KDexH++zN3GOUAvdL184KDexHExg:H20yjmuxTZd83GVAVB8/x1sCo
TLSH
T17A65E7819537E38FC1FB5032072A9B4DA7B4AC13B7056F1673C8053AD86AB25B4B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4a498c42c5298899a971e425738dd6769a73bdc24e197e2d990e3a82c64f429c
MD5 99a8b190d1d73fdd1b184f47a1a113f3
SHA1 8f9fca1edfa338ccdf364757e2abd9b7479ce8b1
SHA512 838dd304fc0fb6052ee1a3fff3b13c96da5e074fed357866b65d0f5df1efbc9fc76b60b3be57784669b08bf2aa38ddebec01288834b2659554b67d3c3d84881c
SSDEEP 12288:4M7JUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:ZJatr0zAiX90z/F0jsFB3SQkr
TLSH
T11F452307351E80F2D8E32B3416988806267EBA746BD29AC7F1813F4F9D386C65D756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 90194b7dcd4cd0fb3623b7f7ee59853b939f3edc81aae94d2d94ef738c22e505
MD5 07346838a3de66ad6ee19a0daf3ba114
SHA1 a19d5a416435a466f6ce4a766d5a75d9b175d24f
SHA512 46cb47b316da0af1d8349b2d57ec8250dc8aae4505dade2c71c04109f9a0ccf19719653bfc1e601993e1695d0e94606309019c4dfc6dd96e7c4d0dd1e3556b0e
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bY3atr0zAiX90z/F0jsFB3SQkD:xgb4mBIBhGFGaB0zj0yjoB2
TLSH
T12765AF1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 2d3ee763573e3d7a0f9046b3813f6890c37687144c858a0fc615fc9b7d3583bb
MD5 b3723a821bccb431d32a0c91e9dc4be5
SHA1 66b6719ef5f182139a1fd97a511c73ce5cee7201
SHA512 c45ef62010d324ef4bff5a536a67ae018fb4a49f3056e20d7d23a44ea53932ab8193c632269cc2a4aec78883cc92d1a663eb7c1df1059b5021bda77a47d4ea54
SSDEEP 24576:kG88u8FpJqH1bzria7/mWatr0zAiX90z/F0jsFB3SQkp:X7ZFPqVea7/faB0zj0yjoB2
TLSH
T11D85016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 4feff4da1a82cf3e374681c38543ec1ba52e3394a2d6ab7f7e28d03c9ab161b9
MD5 7961dbb3397b5480ed642b91a75a724d
SHA1 c33690db6cf83ba0acac3c4e94ff0dfdeafe4453
SHA512 f4f740934da674c0f8a612ab201695189ad31a8a870788de564dcc5843b6b6d169abbda77fd3ffe195d5498bc77ea300f79418d689e64c98d663d9933688ed0a
SSDEEP 12288:yHvUrBFrEjwaQSUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:yPUr+NQSatr0zAiX90z/F0jsFB3SQkz
TLSH
T12265E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b6dadaf048f096adcca5c6607d64b5afdb9bda249f994cddea69ffaa14136914
MD5 b2b8cffdbaf27c741ac9bd1a52cc0ec2
SHA1 c8e8a47d8633177b855366f3cdc6f4c891cbb23a
SHA512 0c3c17f0fd6b0b67adce67ad95bd6125d7d201f3390e7d6f1a7e411b314a28cdab9c903f043d3c3a441bd444bef55b4a07f7ecf9f1a7eb57672ee92c7c9f8b53
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjiaB0zj0yjoB2:mG05lO43bsB2Yyjl
TLSH
T17AD5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 28195066ae082991426b35a678ff88602456cba77ab49198d96e610ef2b10e12
MD5 bee760619eafef9582b2394be2f267d3
SHA1 a8c01f402c7fbb9705cab1e57d543ee1a8cae902
SHA512 690147ecfd2170d73038e83e54db741a39befe164d0ce2da15426a9410e290f04bc37625c31ed8b8cec9f3f18e536d26961e5381d0376e1558c9db25b09303ec
SSDEEP 24576:Ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidn4atr0zAiX90z/F0jsFB3SQkZ:Wa5POZ3+Jt2pasx2+m6aB0zj0yjoB2
TLSH
T16D65BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9cd5b611d6649d4ce6473e9c756be704e0d315490b53b302f829460ec38e719d
MD5 2b00b27091d8999c208c9ca4c2934fc9
SHA1 89314e8db6209fde507bcf7e5ddf4ff5ff224982
SHA512 de3256d9504f70a46ceab340e6315ed38a9a167e40525f2b08f026b9e6e43615cd403c41943d430684787ea59f96afeac68a1dc41cfc33c2f11ed39053ea428f
SSDEEP 24576:YNcwHdjbyQ4nLC18lb/EOjowL7Fkuatr0zAiX90z/F0jsFB3SQkP:YNc/zEOVHF/aB0zj0yjoB2
TLSH
T18A858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 73925e26506ddb915c30269afcaef84a691b126e04ccd98b996201331e1d37ea
MD5 48b2e520816caa8d31ab75de3ee2b4d8
SHA1 7c606e5e06ee2ac4a39a1c328ecd8d6c6fe1ba7f
SHA512 7ca54c0244034a6b0c23a310a272b7c4a584eb30260359e67e2fc242acc377cfaf7f6fe12cdba6370c6387e414cb6b22632ccb87952dbe38072351e8dbd1abd3
SSDEEP 24576:98kNvNnaFeYhJNtmZBm8atr0zAiX90z/F0jsFB3SQkZ:98MwBtOm8aB0zj0yjoB2
TLSH
T12F55BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 37321661026e5aaae688a788c90cfa583555dea21f785bd7ebeaac7d97043a5e
MD5 7c7857732f3eccf32f7b2e2958b304c4
SHA1 e0905757765e1a1cea60a5dcbc97fee4fdf1aee5
SHA512 b81eeaca7deda7ec72541d0ad9ab5978b963afd1a755a27036fd8b937f9154db6368fa17b0e4a595c38bfb9319c18d070cdb95dc4c22b396c66aca18f857dda4
SSDEEP 24576:2D3FHshBIYQgAtatr0zAiX90z/F0jsFB3SQkO:2DVHeBIAAtaB0zj0yjoB2
TLSH
T1F575E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D491BA5F2BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1084-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1084-126-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1084-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1384-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1384-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1384-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1384-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2352-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2352-83-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/2352-313-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2352-88-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/2440-65-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/2440-8-0x0000000000C00000-0x0000000000C67000-memory.dmp

Download

memory/2440-0-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/2440-1-0x0000000000C00000-0x0000000000C67000-memory.dmp

Download

memory/3172-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3172-332-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3172-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3172-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3172-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3172-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3924-60-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3924-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3924-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3924-46-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3924-47-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3924-39-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/4820-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4820-137-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4820-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4820-141-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4820-131-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4936-284-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4936-50-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4936-57-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4936-51-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5296-78-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5296-309-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5296-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5296-72-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5492-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5492-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5492-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5492-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5492-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5624-106-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5624-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5624-317-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5624-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5624-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5624-112-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5652-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5652-20-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/5652-21-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/5652-14-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/5652-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download