7ff803d735cbfcf26498c782c26fcf4a783eb31ae03c9f460aa1d08e34a2a8e4

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
Sample260723-ffrdmswvgy
SHA256 7ff803d735cbfcf26498c782c26fcf4a783eb31ae03c9f460aa1d08e34a2a8e4
MD5 4ac36ef38f68f8439e7bf8db01fc5ff6
SHA1 99a61fdf92548dbffd7535016fbe30bd403f9560
SHA512 0bc23a0ac7a960ffcd97aae38a3be61eb28ffe5d45f43bc94f5afedc9001b8ab5077e55e9d0f8e72a1b178577eb3e7c09f60a264ebe82b5ebfb0b76675422172
SSDEEP 24576:Y3qgcetbQz43+waatr0zAiX90z/F0jsFB3SQkr:WbNUBTaB0zj0yjoB2
TLSH
T11075BE0137E89131F1F73A7679B692254E3A7C61BE31D68FA240AD1D2E726C1C934B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4860	elevation_service.exe
5204	elevation_service.exe
4520	maintenanceservice.exe
2044	OSE.EXE
4492	perfhost.exe
1792	ReFsDedupSvc.exe
1276	SensorDataService.exe
5572	ssh-agent.exe
3004	AgentService.exe
3268	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d1930fd5238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b04563a45e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4e020a95e1add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be297ca55e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000071ddce85e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1fc97a65e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000917042a75e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
5204	elevation_service.exe
5204	elevation_service.exe
5204	elevation_service.exe
5204	elevation_service.exe
5204	elevation_service.exe
5204	elevation_service.exe
5204	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4224	2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	4860	elevation_service.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1792	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3004	AgentService.exe
Token: 33	3268	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeDebugPrivilege	4860	elevation_service.exe
Token: SeDebugPrivilege	5204	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 5784	3268	SearchIndexer.exe	100
PID 3268 wrote to memory of 2136	3268	SearchIndexer.exe	101
PID 3268 wrote to memory of 6052	3268	SearchIndexer.exe	102
PID 3268 wrote to memory of 896	3268	SearchIndexer.exe	103
PID 3268 wrote to memory of 5520	3268	SearchIndexer.exe	105
PID 3268 wrote to memory of 5992	3268	SearchIndexer.exe	106
PID 3268 wrote to memory of 1416	3268	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_4ac36ef38f68f8439e7bf8db01fc5ff6_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5204

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4520

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2044

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4492

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1276

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5572

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6052
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:896
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b509a9cfc1f6a16a04453a4fd16e2c3e18ea94e66c5b35fb42c1e321dfd36b0a
MD5 22dee1f6cbada902f21b4f047659fd7b
SHA1 8ace15dfeec230a3a330e85429f897dfef63f83e
SHA512 806beca29f973b2311c5724557989935d65c5ddb28d175092af3443a7d037636a2f0798c3cc697a9918b0c0d961edc1065187dbaa18524b07c9f5f283e4ff381
SSDEEP 49152:yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJaB0zj0yjoB2:U3q6HjB/B2Yyjl
TLSH
T1FBD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e48d3bccb8a14541e13a7009cba34484d9decaa61945d118bbd402c7ea33b8ac
MD5 e5a5a150ba4580ea4e6ef4e67d0a35cf
SHA1 5e28ae8ac81d5efe56b4025d570ade7769c57912
SHA512 fec4a7f5a95c421577f329f82c90ca5bbe7273c7dae463bee847feee233ea61df107a8a004905691805627b9fb295a19eaa12308167e8d6d9f1c6ee37e2fc8b0
SSDEEP 24576:vXYfDtczA8atr0zAiX90z/F0jsFB3SQkU:atcbaB0zj0yjoB2
TLSH
T1DD650229779504F9DC67823DC9A1C506EA73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 37554824f784867537bd469256434e046de5ab0c29cb28ff8143c2449ada0f16
MD5 224e741eeea6e83a6a2eacc6c183d5e4
SHA1 94a2b39d5767488f6036a2c92ade9bb70cfd33f7
SHA512 7a3b011017e2380dadcc8e6e6531d4363a5cb56bae2b1a06d5ff0bbcc7f59f4bd975bb160853685b556a33c36846bbfd15c78c6b7735b3dd0b542488ff5b6d6a
SSDEEP 24576:b0Le5ji0hmxirMOatr0zAiX90z/F0jsFB3SQkv:bPji0AchaB0zj0yjoB2
TLSH
T1E6859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4d7108754c93ffb8ecdd491a6aeb666b426a6683ed855ab4eca685855bda37c0
MD5 f9b24bca8c6a2576fca305e364769e90
SHA1 63f08c465d87a4572d857c6675b32db07ac15ae7
SHA512 fa8a62fcec27a3faa9821445ffed491ed90ea1779f6a7edf694069c24758fd63b75aa67b9e6f798b4dbb5c8436ec532c9b8a61cd6647e1bb7cdf07bb8815fe37
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWE6q8wyuYatr0zAiX90z/F0jsFB3SQkw:A/ezSC6vUzPvxHjyFaB0zj0yjoB2
TLSH
T1FD755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 899aa54d8d16fd18fd8ae9eaa468f9c91e615a089a0754ea71687fabdaccf664
MD5 63ddab7d9a12dea72982c3db150fa8af
SHA1 c775c7194aa8eac143955a5075ff2c0237a956d4
SHA512 e7b9697bb9000451f1aac51a2f9698683088e1081fd790a7cedeb759e9cbd2fd0e9175b9819512e60b4e36d3cd1a118fbf1500bc6d3e5ce7495dd4476c5fe6ba
SSDEEP 24576:wVbqPb88hv/l+6Hatr0zAiX90z/F0jsFB3SQkU:wVO88hXl+iaB0zj0yjoB2
TLSH
T1E155AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d1ca4d4097b23df4a1cf3da20ec22f14561417e079a35de1d1abe27965165eee
MD5 9e2b566dcf301e4553c4da721b6e74c9
SHA1 198e9ba2b508225907caa67ad37fd00017d6a4db
SHA512 50e762700ffe56b02bd08aa450cf513f87b7e22df8c716bf96bff9285ef7d12059d38f37d785b61db988df2e72de6031ce57e8ff5214697936a98ebf13671548
SSDEEP 12288:9RaUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:9Raatr0zAiX90z/F0jsFB3SQkM
TLSH
T11945230B340E80F2CDC32B3526989C4B1AB99EB065E2AF45E2913F4F9D3C1C6E5656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 331051716b000b4d2ee0d89eb988fd46bd452fdc58a95ad587b2267f6000f14a
MD5 ec82c42cf6905b183d5591b4af5885aa
SHA1 0e592a319b1155412c93e47a48251e01b3a583c7
SHA512 d784a8d2ae91433c1f1a903745008eb8756076e9075074bfa3a418286d56490635494e9c099b98cc0cb8e25d15b2f32d0b0e9361c6ea440d5f6e5f88883841a7
SSDEEP 12288:2eBNUbTVO86UPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:2JIUPatr0zAiX90z/F0jsFB3SQkY
TLSH
T17E65CF3BAE28FCE2C67A4D785B91C600D77278304B62A3CBE165930EDE235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0db8c174183764d41dc9c8a6ee674c75dc377562e49fc165c0be757f8514a067
MD5 55cbac74b072bd4c3ab5385f78c16265
SHA1 8b644602fb3ad80598fb521fdf3a16dd93cce968
SHA512 301e8d7b34b14758b714708530aaf02b929ad673bfe197e3dc83069bdf7e5091b33d569c38ccadb9299e637641a95a20d9e7eb46f7e410ab73409c306b5be2b1
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THJ:XQvGAdlCEL8c/yRNw5CHB2Yyjl
TLSH
T165267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f003f303c3bf91007e5cdde21dd9787fdc6800e5240508ac11ba5e118b33711c
MD5 0f8e515172ac14a6dd4001a95bdf3644
SHA1 6b85b153435a14ee16b5057175a2fbb42984b63c
SHA512 06c27fcdb55e5c6e09d46b3603393478bc5e069412125101dceed7bcc380f595d9511c641764fd55f72b301da84a764f166a9cf62f7f02fe23ad013fbab5aebf
SSDEEP 12288:1AwSfxL/2Dc34DLLmt0LDQewsAjRUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHB:WdewsAjRatr0zAiX90z/F0jsFB3SQkp
TLSH
T1F575E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9f829687346ced0948c13cdbbad0e5dfea32611a861e80e426e72daf08a076f7
MD5 34d7ff17d7ebf8dbba55b71adf666bde
SHA1 67d46a48e8542d2f5fe8e48629d5bd552a613fc8
SHA512 6c4da30c526f8acfaee9385de586e6f0e3b7b61052b8fa7555267b9c98574839d02f1b3fe188b8e14b13587abc98ce15e53ea83218cda76214581709951a6e6b
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHwZ:EUEtQevvqc2W1cpV2EI32q
TLSH
T112474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 31737de1663f0f5c5a7bb015348d6570e7c0c7a05c4aaafeb8ad282e855170b9
MD5 3352af57945e9d9eeff5ed8bf2a7e0a4
SHA1 aea619957c3fd1015de7441f077795f9026b8942
SHA512 c1aedd6cf633ec76393c01e94f913093fc3284549ff24eaa4a71c17a4237dc3be40e888fa42d58838142dd855d59615affaf7b90ba024d4f78ee42ac3986a4c9
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/zxaB0zj0yjoB2:AoqtVjnmjB2Yyjl
TLSH
T1EED58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d5efec6b5d581f3c9e0c7b8c5e1053939ff796c2aaeea87a46422e47a179c052
MD5 f7086e2a9a752a75228ce7844422529f
SHA1 0b5a38b198b8815c93634fdddb29f4ae082dec83
SHA512 7abcd33f29a1bc9c007d25c675227a375abbc79c6f1a41845f6a09fbe07b8da0ebed007e2e8c13cecf4d1baf67d1aa5abf0a244ffdf16a9fc6a50b511cba6350
SSDEEP 24576:DAhGLJIFoiwtA5l7S53Matr0zAiX90z/F0jsFB3SQkg:DAMyFoiq5caB0zj0yjoB2
TLSH
T169359D81E7F955D4F5F3AA7899B68571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 eeba7679bccd3bbea36347758fe17bda5e10b39bd3e39a5ce45a9dfc1569e9f9
MD5 ee8b2a223ab8aff53bc01f587278da40
SHA1 97922c9e29bdd8760f8d1047d5ea6fdecb73a0dd
SHA512 47d22eece059b35be3af859eba241535fd390a0b7d63340fbf9019b3db467adc60945c8a9d65f77496807237c67e66fbbc71283b641667bae9100bf984745af2
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+CrUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8A:7wuoOWuatr0zAiX90z/F0jsFB3SQkh
TLSH
T1F465F14A32A90CF9E9A342388587C536F7F2BC112A61DB1F1360CB5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 932d05d4a0bab49a29bf78d455f947be6245b40fa93d203aadf4dbd9ccd67ea9
MD5 43570684b107113fe306e2a8c9009c28
SHA1 b223233971e92516f8ed4ea0825b552f1d9dad1e
SHA512 9915669efb5c0e7739930d030c90561404d56488248c83f2629e3a8b1bb7ca8f347848d789f8b8defc4eb20d49ecd38dd117d2e8f8c4b705c540d768ea609074
SSDEEP 12288:/BZ1IyBUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:JZuWatr0zAiX90z/F0jsFB3SQko
TLSH
T1D255124B32A960F6D5D3523C89E48906D7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a4bbd331f3d38cc0ec5f59f3edc88cddb419acf4dc488844c88c12d83cf42aac
MD5 e20d12e4cb0be9dabe68196647c7fa2f
SHA1 ce292a8cfbeb1a0056ab42edf43942d08be1e05b
SHA512 170e12b7c571436dd4659a0c68a49391922ba3f1092ebdbf46a324d40fbe1def643e5b567285528f52b1fad415eaaeac9f3bfa0abd6a002f5c0f4f948ceb3d65
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:lQRQyi36YOcPQLvw2gAf+PN3uB2Yyjl
TLSH
T130667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7f2dd614f7bc3b49766a45ca6fe34ddb497d72078fe111a4a9d8a08313204cb2
MD5 317b242993806d57f2c088d25cec22e1
SHA1 88baf230459d4cf147ef6fe32ad8fb68ea874362
SHA512 3a4847e1d3fc7f48eedad25d22fe5b89e63d06705c54b9d6bfd720a433642cdf29d2f0db5f589ac460a05701b052c968beb67bed54f785ec3f810aeb561d378e
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:CQRQyi36YOcPQLvw2gAf+PN3uB2Yyjl
TLSH
T121667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3bcf8e0e784b72c1db6bccbe6a7d4c7ed52347cbecb6778ea56bf1a3f980c504
MD5 1ad9c88c1a26d8b0a556dbc6cd9f52ad
SHA1 33ff9014a4de16a81da683021d257da405e06a4f
SHA512 c35e7ec4e987c36088fbfe3af5048b320535b4d9d37c321747809e1be99697c947f1bbda5c8ca56a15344b19ecf22103b01a4cabe77e0d15ed15e3da3de860f5
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0matr0zAiX90z/FR:A68Qg55nhheWu7PNU3/haB0zj0yjoB2
TLSH
T12DB55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 795b1fa74e0cce67cc3120153103a8085708078bec8dee7d25d84c2462dd7812
MD5 5501e91339c5fab463f736f950d20ed8
SHA1 d03d46fb55f9e74765ef6598dc10810913f4df80
SHA512 40641203e979eb003af71e6e2197d75f7a87431a7b2e316981f0cd5e8c3f807affba622da72e79299bdff1a61daa1a047c21bcae82bf77a44dc29560c33fd687
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99X:Jy5112gYy5azzVvL69nLKnhZdB2Yyjl
TLSH
T18C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c677ac578d39d74d701a374417cc982e79f827e14d6a23fed0e0799a52e03793
MD5 d1fc897d22e2966494c54bb878785c80
SHA1 ce7e22a38f21be7897a217aed6f20ee1b235002e
SHA512 409305564f590eec483de4bd7eb2c68e1740ae649bf78e38c79fce52e2b98c16ee4e6f0c658450450734e694ddb359c5f24e59581585436afbe0c8fda31d635d
SSDEEP 49152:EB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glMaB0zj0yjoB2:eu6JmVxd2dDB2Yyjl
TLSH
T160D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 425e0e3316b8b7607b7702d2f2814e1d8993eec32e5dffbb434b3a35240ef873
MD5 8935d9ab6dc87b117e6be3d12140365a
SHA1 cdc142f027b3c317b7b98b7381ec0683620be151
SHA512 9c74d316a973cddc6a76af48dd6c3f0bd04cde2050f931a46409868df937973d9e37c2f52e065dc61bd56f23c0cbe6f025f39ac2f7d6ef3d00fcd3f5e735bea7
SSDEEP 49152:31hpsNoJpF1A6UU44CwH7R4xvaB0zj0yjoB2:3mifPbRjB2Yyjl
TLSH
T17BB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1c0e42cc18ee978c067e0aad5d9ee202e324d09c337b0a2402fed2af27bdd112
MD5 cf2258ce470080b45dcdf46032a8f293
SHA1 1f25e4b5b079f230f3289f627f0333d0af6ded56
SHA512 ad033d5a254f74baae93f8c017f33941b93c6f52c32f8f163b21a60aedbe70d772ae43d982d019e0e16bd5e6f8d3e297b334d7c340a9efba8ccf8784cc62281f
SSDEEP 49152:tSuZQIY0Be2KRRVtOnks6NMHqWaB0zj0yjoB2:j5dKTi61hB2Yyjl
TLSH
T162C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6cfd221c2b2834a4e96d955f440498b6850ffe0d2f830552a1dc5de8d818e2aa
MD5 721627d419df601b07a63da7bbdaa210
SHA1 9ab6aaefa48a372617037b1094f4fc741d34c719
SHA512 c1f7460101cd1d719fa59df2ea4466774263809b954e888800423e9c852945b08ed22da08b1c2001c55070dd7bd85278ca89872780b8b4687a29dd9bb5b5f491
SSDEEP 49152:QhtSn8EApI0figngiDn0AP5w7aB0zj0yjoB2:BX2iyph/B2Yyjl
TLSH
T15A95BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 eb68ed64f1580a3491efb63ababc81cc66eaae1db83489fe978555f8a834bc32
MD5 9865d9d442920f8403fd9993bf06e6cd
SHA1 4c838ddc81c673d88ffb2b323f1c4dfb592905a6
SHA512 4678cca1acb0cf54329a6ac8caad4157e6eae497e94a806e09d431d86481147744ba937274dac83b39927b5686d5c2af2deb4e1f18796ea13d93f9948deaee1e
SSDEEP 12288:JiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:Jiatr0zAiX90z/F0jsFB3SQkK
TLSH
T17345230B341F81F3C8831B355684984B1AB95EB4B6E36B85F2953F0FDE382C725656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 981dda8d0eb8aee4decb84b229ef6b0f0af37dbed671d2cd632d018f8a385fea
MD5 7c4cf976435ca48f3e038c8d2c66d10e
SHA1 3fc1cf14cba803ed103cba148f76a87f878d8751
SHA512 2e37bc782a7f983e4e6fc8aa6504d33e7ed560f163290f0b521c8e3529abf49b33384fdf8d1011faf2ab35b1e398630be5347da3c2befae3c48dfe43c4d31241
SSDEEP 12288:XdUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:Xdatr0zAiX90z/F0jsFB3SQkK
TLSH
T1B745230B341F80F3C8831B355684984B1AB95EB476E36B85B2953F0FDE382C62565ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8b931b4a7b5baa494dadaff97659bce4ebefcedf9177b7a27c255f8aa52592db
MD5 21acbde6313d93d4fc31055be8b33ef2
SHA1 1be25cc13f8d1cfb23838d2152b7943822ff778e
SHA512 f5d66f2429c03d7be5b17fdb452484ed444c0b8e91d8a79fba9e48aff95c79102d4e4be60d3924dd284b76608ff48a130b1d6e0b468babff9ce6d748bb227f26
SSDEEP 12288:7XUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:7Xatr0zAiX90z/F0jsFB3SQkq
TLSH
T17945230B381F80F3C8C31B355244984B5AB95EB476E36B85F2D63E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 139a5a181064f288055fea41660c4a704e066a4240a4bc030f664f3ae3a210c2
MD5 18c7ed2c110ad75e01999ea44aa3b612
SHA1 b6bcc35cb20cb4f30ff781422f9398ef47688270
SHA512 a29944f9e803cd5d5d9f0b451e68aa75c99c25c80906fcc8d20cb06bb527bc51e9a854f5ae49b90d2009eab79e9c68fd4d46e6e03c8c6068d40c9e7dfeadcd69
SSDEEP 12288:FVsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:satr0zAiX90z/F0jsFB3SQks
TLSH
T15D45230B351E40F2C89397358694884B96B5BDB0A3F3AB9FA2413E4F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c44aebe9db069ba2b6e623ae03df6baa3ec0b251b96331ae1593f6ebffdb9fe5
MD5 811f91de20375365d74bd90a1689d2aa
SHA1 7843c997a211edf270c6e8170066ad4e45d6b707
SHA512 3c6d80a69278aafb07dd2282389d950b020d3c0746719742c6f4ae1c5496adedb94290efa79107f487e6bb0862fa1c51089ace1ba0ee5c94443a427037bf5288
SSDEEP 12288:+kUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:+katr0zAiX90z/F0jsFB3SQkL
TLSH
T15B45230B341F80F3C8831B355644988B1AB95EB476E36B85F2D63F0FDE382C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b80a97782ec4f65d09832e799d53820d10bf7079e43297507d8e9186f60c219f
MD5 98a553a3af1f177cec9395730a05c5e6
SHA1 bcbffbe84e82ae4bb9e8e4b6a8f9204df4aecbec
SHA512 b9bf7e021ad7c30c440d24becc0010004607e51e30c1a91369dd9d0d7aead69c60a74d7bda368635b18af0f59b2187f317c2feaa30dadd96763cce47c8ba293f
SSDEEP 12288:bZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:bZatr0zAiX90z/F0jsFB3SQk7
TLSH
T18845230B341F80F3C8831B355684984B1A795FB476E36B86B2953F0FDE382C626656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 20a931f9ed54444a4f76aedc68a1ac294fed64d0aaeb04deeeaf5aceebbd6abb
MD5 6b63e03c3ec09f5152f1daaef5e670ff
SHA1 47c35928f414db3a175707b7f678ae4cdb86a615
SHA512 6fe9dfc40991a131c5b9a8396ca56ddfdfbb80ac027cfcbf6ca1805a86291c5780920e11d564d31cd7d7902d1e4c6dcb8496f03b5bf9ea8fa27f52045e358395
SSDEEP 12288:+1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:+1atr0zAiX90z/F0jsFB3SQkz
TLSH
T18545230B341F40F3C88317355244984B1AB95FB4B6E3AB86F2957F0FDE382C625259DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 fd6e2073984827d7f89b28e15d7ec78230e171af6cba932c95a4b8eb7c711940
MD5 c2e496a29d59f1a877d641b81a3f23d2
SHA1 945ac283d5c88faed482e6dd5566d4f7063c9202
SHA512 3b75aa16b5bba28129042f8973ee5aaf49bb92cf69bca2c9fc7eaa0ac3739714075bb864d462ac98a718394188a5709dff63980c7ba6d5f889a1f99646026839
SSDEEP 24576:3ZMSzFVSO9atr0zAiX90z/F0jsFB3SQk5:3ZMSzfJaB0zj0yjoB2
TLSH
T12E65019A735008F5DCA3823EC9548906D6B27C6917B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9537932d78d9bd580b7667283b50aca8ccf5543fad3e372c618615fdd61ab6af
MD5 1e1bf47ba46b8e8343b6109ae6b3ba84
SHA1 3c0b4d47afcbfbeae6569addc5094305760e3c5c
SHA512 15b164a922f1117143d5c317fb3463a8335c7477bd980b1292f6f804d6edd61e2ea9117d9174c0fdb554ace28458aa58814ceb31a8825509ed248d90a7de8168
SSDEEP 12288:wGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:wGatr0zAiX90z/F0jsFB3SQk+
TLSH
T11D45230B341F80F3C8C31B355684984B1AB95EB476E3AB85F2963F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a1b5c8422f0bba913bce262e8967a88a90e309fd30015bf6e0170c221e99381f
MD5 eb3ae98d617c0c8f2589b099184cf02f
SHA1 c160c6401e8fa9cf40b9ddc807a6551988b96d36
SHA512 c9b6f5fe211dc0790282c353950b2c975409e643b964ac498ced6d20aeb8035ed4bbf300c2e4e5f94ea5a14245fd1d94dd78a7073479079352a4994f3831a1a9
SSDEEP 12288:6KUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:6Katr0zAiX90z/F0jsFB3SQk+
TLSH
T1F245230B341F40F3C88317355684984B1AB95FB4B6E3AB85F2963F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 105a44d16e91c0ea77aec242b06bb331334014758a81ed8019e17afc86fb24b8
MD5 87478d5f912c6d23c8acb3d02687fc9b
SHA1 7d410852f9f143e16c9f73f3ffb91006e196427d
SHA512 59a5d28a744fd8996b3c8659305a9e9b7aaefdd4d408cb5e4d313d5a84a26fbee99104eb20cfcff3ed47b7644deb551fe09e664424cb614085f7e0c1181cfa5e
SSDEEP 12288:XyPz5L8BUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik86:azyBatr0zAiX90z/F0jsFB3SQkD
TLSH
T1F8551207326620F9C4639238C9911D06F775B83117A19FAF53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 65f656f8242aef3d603d2064aef226da8ee3256dc4fa2950c73a13233abbadb0
MD5 1ad718df4aa37f9aa689c701e1971961
SHA1 bc354f43e38a69bdfe1ebe4b95a4ff0b2ecf391b
SHA512 37a4f14ae49faad6c247d4d4fc0fdec868637e37eb4f25e9e8a985557d2c0e0b9d944c5525a3b13ce6cfba7b661b5adeebf9aa593c5f230f1560fcf0e6cf9605
SSDEEP 12288:wGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:wGatr0zAiX90z/F0jsFB3SQk6
TLSH
T1D845230B341F80F3C8831B355248988B1AB95EB476E3AB85F2963F0FDE382C615655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 febc28595d2418a597819e4f3ebffbb78c3ca4901872e016b32a3aed1e370c8c
MD5 2f06439bc08a6aa8887e36b6486971e6
SHA1 17518c8028e759fc9e20cea5dff2fd83cfcd39ab
SHA512 92f0d05b2ba45b51c911f83a75f604ad019206433d29047da88f3e3bd6cc60f4e7692ce43882d046d3cf1304433f959bc8ae502c3cca9f61aa0282b54201e49e
SSDEEP 12288:nGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:nGatr0zAiX90z/F0jsFB3SQk6
TLSH
T1F745230B341F40F3C8831B355648984B1AB95EB476E3AB86F2D63F0FDE382C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 0341d20f599cfb2e65e1eeea94a02948e8b5683fb554624d8a151edc1c47679e
MD5 02c841045827d3ca2498a4b8cb83e85e
SHA1 aed431fd34b856e2f6847cc8388f0c901af432f1
SHA512 aecf28ac30789fad7b5b38f1db5b762fb1a8af115242461c3b60cca1ac511e11554b7f59708d7bb18d8493c2d5abaa57569c7a883f82ff04d557595f46e7f7f2
SSDEEP 12288:2yPz5L8BUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik85:LzyBatr0zAiX90z/F0jsFB3SQkU
TLSH
T1EF551207326620F9C4639238C9911906F775B83117A19FAF53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 627aa325236cfa9eb96dc0e6b07c25382e9dfbbaf999e9437a1c9c19a790eb7d
MD5 84b9b50a09023a7d5f31704ffb19493c
SHA1 81df9cb17092735046cd461aa97c55a51f84f166
SHA512 8538dc7edcb15bb252b5436e27081cce50b70f0575854d2500e099124cf752ed686ab8b2a242d17ab1f49f240e918a3972d1535dab7ee2d34147c3ed6cff2768
SSDEEP 24576:LTHaLl3z0zDnatr0zAiX90z/F0jsFB3SQk0:LT6LljYaB0zj0yjoB2
TLSH
T1B4650199735018F5DCA3823EC9548906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 0c7f5e27962caa2d231fb6c26c41a8cbcc47f356317ee69cbb6ffb7709808a18
MD5 8d9e957f9c5aab9e5340ea2f6e1d2a30
SHA1 3390f5e74a276831743d0fc632f52b868b247f1c
SHA512 78db56a71bd124d953ec88027d44577dfda3244ff7b36278630f51d4dff76de258e753a9477dfa7a5fdeb2fc1e1fe245fc8b6d2caba8357a02a546744d9d9bcd
SSDEEP 24576:037d9CHKy7GZDatr0zAiX90z/F0jsFB3SQkZ:+7d9CHKyaJaB0zj0yjoB2
TLSH
T14975CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ab7213ed7435f429bb94ab30f9bcf85e7623100b7e3c1d5c6f6174a6ecdba99a
MD5 f7f944c41bdfc17191887990c6e02c14
SHA1 010b2045fb8564629773b6a9a5baea64627f71ad
SHA512 7856320513e8b8924fc20d527c2a788fdd89ec00c56f5c0e0596da0ccdef73e0023e8061790e9906d0727a0392c546be0964ff814955386b0a6006bdbf347e45
SSDEEP 12288:h3UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:h3atr0zAiX90z/F0jsFB3SQk6
TLSH
T11045230B341F80F3C8831B355648984B1AB95EB476E36B85F2D53F0FDE382C626656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ada855f84a27227f4a01ac9a0fd11f1f1d46f236c842c1458735970eef38458e
MD5 74b12dc6a635dc1b76a65cb92077c0b1
SHA1 25ee67ada65b6db39bb90a51ff4f306a5ea40c8c
SHA512 b7d503b25d0b0e8cfc31c556e5df980250ee51f7d6af9227cb7cac542e303ed44ceb54645dcff84c9a03492c95f2f268c90afcc2e818d87ad1cf2d2cdc57810d
SSDEEP 12288:chUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8f:chatr0zAiX90z/F0jsFB3SQke
TLSH
T1CF45230B341F80F3C88317755688884B1AB95EB4B2E3AB85F2D23E0F9E3C1C615656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 bf6089b692b99ed93bb035b44e7ae51d0e23ae5145769be0d0b7436fa7280d00
MD5 35bba3c92b98d50ce9448283e86e00f3
SHA1 f214c527169d5df553bc3fb642bdf675b8365d6e
SHA512 474c6f0679328296eaafb95e1a2f26b1460e51ffb676718ae9fe491b20c562a2957eb27813fe0c3dd3382028af9fd6a7619d19e023af08a039788db8662086e1
SSDEEP 12288:gQUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8i:gQatr0zAiX90z/F0jsFB3SQkn
TLSH
T1F045230B341F40F2C8831B355248984B5AB95EB472E3AB86F2963F0FDE3C5C625655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 09a00574f122ae605c85720e1cbdd6fa5e1a89f6334a665a5d637397cea1810a
MD5 8dbe64956213d83ad90949384806a725
SHA1 c5a65e28a13908543201baa92bbbc94ac3040dbb
SHA512 62dd5bd9abc9be6782fd74b2367d2bc8efbaf6f6d790f6bcb8fc7c5fdf5e06c5f121b33838ebf2fc3e4b76d974209e7f01799aac6caa238ace2f63bebd1aad21
SSDEEP 12288:0GUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik85:0Gatr0zAiX90z/F0jsFB3SQk0
TLSH
T12745230B341F40F3C8831B355644984B1AB95EB476E3AB86F2D63F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 52e40f19ba458111af351855812540a628bfc9feacbb4550eb38eb5cc2e1adc1
MD5 246684339048fca8536c0d3193ad5a50
SHA1 44dd131cbfe6c19ec5fbcb3be6f0b58324994a95
SHA512 46813227bfff77ee5269c3521506608c9a5a0cab24b33f5935f07af58842664b1ae4870c83cc7f89a487326cd063a967d382653747100bcff12a036149e493dd
SSDEEP 12288:D3UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:D3atr0zAiX90z/F0jsFB3SQkM
TLSH
T1A145230B341F80F3C8831B355644984B1AB95EB476E36B85F2D63F0FDE382C626656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0eff1c947e7e6c2043a0411bc424169b02a6a703d676fd11296393d60fbb3598
MD5 481920b1f116da7a61b12fd366aa5252
SHA1 8c073dc532e461c2bc54e6e86e8325ab4ae46248
SHA512 ad48eed2d990eb2e4bdc5289ff20515890689a7730686841d6d2fd462480f86b4fe6dd3574e5972fe6bbdb062904b24288b105e436b2244cd17b318af412e6fa
SSDEEP 12288:3eUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8V:3eatr0zAiX90z/F0jsFB3SQkQ
TLSH
T10D45230B381F41F2C8831B755684984B0AB95FB472E3AB85F2963F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7b8f42e31b02f9c658ebb856086cb67f3e4566696651eef64b7054683f2e53ac
MD5 4a8bc12889a3fb9abbe4b8a8822b61e5
SHA1 df04507e21e95774bf85270ecdde32e76b4d44fc
SHA512 d52e4af58fa6856f84147acc6c9fda5de7c2bb4892f4264fdf3cedbb222876bf834ffc827aca28551ca1ff1449e39adf6f2a3695e8f3593a17c6467f1596a16a
SSDEEP 12288:TkUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:Tkatr0zAiX90z/F0jsFB3SQky
TLSH
T1D445230B341F80F3C8831B355684988B1AB95EB476E36B85F2D53F0FDE382C625655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 6860ede0c1c162fa7258ae49fbb2d7058e9d381dcccf68f9b2774b5856b9fada
MD5 d40ba02a311fa6682ebc385120e8c9a4
SHA1 cb973fed48d7196cedfa91685e1fc979fda5627f
SHA512 26bb611e4b116958fdaf492906a9f2b61f7a8072b36ea21ea4860170d35c024786ff6c64ab17af49099d6e23e640f86ea9909deead7c43c4fdc628020d1593a1
SSDEEP 12288:r/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:r/atr0zAiX90z/F0jsFB3SQk2
TLSH
T13745230B381F41F2C8831B755688884B1AB95FB472E3AB85F2923F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 e6050e18b1113dc1f00ab95a1c75ca813ea614dd26f5f76ba70912df95d8331a
MD5 77832c4f3f4ef67227c00d1f32a5302b
SHA1 6905bb0c63a7673218403da1a5cffe1ec9b3a4f1
SHA512 f8138bdf0618dfde4041a2a01b5db7a836b03012573f8a71a6c0bc4ac9cc5282f52e723d16a4c57d04cc60e0ffe44f746517e29e89f3ff3af332d5f0b299a83b
SSDEEP 24576:efwvok9RX6wkyAI6atr0zAiX90z/F0jsFB3SQk2:iMnYI6aB0zj0yjoB2
TLSH
T1DC85D02AEBDC44E1E0B7923C89B7460AF6B178681B71C6CF129A536E0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 49ba509f888aff012285a50bd66cd9aff26cc7a77ba41b2039d1c1371ecc5b4e
MD5 ba007f7d09db0d118826bd224687434d
SHA1 e4d314bf56f0e0d50ff0b290d2e21c61ef28735e
SHA512 9554b1a84773a8866a8a7f33551c76fffd4bfe5484442e09f4e90ddc4f113c1e35caa37d35dcd9e54598559129bf583ca5df6debbda9e0222d7cedb59479760d
SSDEEP 49152:xYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0baB0zj0yjoB2:ZySzPOB2Yyjl
TLSH
T118066C57A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 aab5b130d9cc2208f7f77b62eac41d948d47ef1138e3b5a52e9c87e61d06fb65
MD5 1504fdc5688d81ed48e0ed830b657410
SHA1 8623090ba8cd522090d7f6740c7993465dd8c4cb
SHA512 8a1f853a9052630231b523e4da870f22b66cabda490bfd279be8b575da759f090f43cfbb0ab3a2a1dc037fa9bc4cb394f6fa4ee0f931b47e7f464b5c268435d1
SSDEEP 24576:h47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYtatr0zAiX90z/F0jsFB3SQkf:h47JUQj1irIhCnDHUPfF/LaB0zj0yjos
TLSH
T1C565AE1EA3EC01E5E1BA927885154A1AEA71742D1F32CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1e1898b8ee1a53002ea9ec4ed4ca8bcd1735d9c82d0c69cf50e7d9c07f217d66
MD5 115cfb4ca18a45150747379b6513b393
SHA1 993f06c43f17e22290b7c95694518d5fe34535b3
SHA512 8bc8c27ef4db660c87d04cec498c0dae7e13483bc656dd9804507b55dcfe5714a5bf3c543b39f0a0c6d3d9fc9a43a21a66649805873b750db7fb104a35477985
SSDEEP 12288:LNsfWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Y:IWatr0zAiX90z/F0jsFB3SQkZ
TLSH
T12B55F00AE25801E5C0AE6235C7544A42B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.4MB
SHA256 9b490e8dcff8c5a138a1f2c91247d0f603aef2d70f72aa771495a47eee26e530
MD5 784736ccd92f2101345e3cf0d2268620
SHA1 2a8011ee54937b358b8ee320f8ee6d625a277454
SHA512 34797ae303e1c7633e9e3ae40ca5e54acfe175fbd98194b27ae9d35a597fff6ebd8cf9840eb7836c31e94962ca1002c11ee3e9d639f93659ce0659819ff8f415
SSDEEP 24576:p3/uItSCUVuvPJoXyjSAJmhPxZceTjRJfxQy60:p32GSCUKWXyjSAJmhz7TjRJfxm0
TLSH
T12D654A50762AC75FC6AD40326E32D2CCA7707D06FE446F0773C8873F9576668BAA2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e31c8749b468cb27fa0eb958b95ecb1da7c17824c72722cf1195808d29897ebd
MD5 8747a5500e021b5b3fb31367ae4fed58
SHA1 54c4c0d587e6cc8d244e33008b9162004b2a7460
SHA512 70022395cd58aa0ed56254e6e9f7eff2d46af2d8fd16c06f84b88b36c97866ad08a0ce66911772cdc2d51516775ee8742e6f9390f228fbcd42b4a6dd061bc7d7
SSDEEP 6144:2lLq1yeXyjSAJmzgH10jQH1efDU+LKDexHRsStEi7iLKDexHkcgTm68CS1wnJMrc:2I13XyjSAJmvj/U+gF+cO4kd
TLSH
T1EA65E7816137A39FD1F760320339AA8CE774EC07B7496F26B388453AD46A715B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 34f3a97637176b726a1bcdb0c2a93fbb53d7e355190356178fb6e1e9ffee703d
MD5 6bc1cf845b8b831a32fcea77e895d70a
SHA1 4f86c168e8fe945a35c6d06707d6f9d4f23d7b11
SHA512 ec773de4797c110f1f45a3ce7cb909952e929bf22f0e65c996dca3f1476e30dc476c39d6e980a6e621493012e74e6a30c5cbfdbdff58f7eced1ab9b2622883c9
SSDEEP 12288:zM7uUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:Yuatr0zAiX90z/F0jsFB3SQkb
TLSH
T1A6452307351E80F2D8E32B3416588806267EBA746BD29AC7F1413F4F9D386C65E75ACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3585a704dff6eab43dd4639d000c4749d957906d3d39127113096fc3dee768da
MD5 b40acd80858b90d372bc49a5e9c91c79
SHA1 f9ef822882ec979c2203963a8c8b591b53e98a08
SHA512 2a9538f26b88b32e1a9d493670571472ba11bd665090533cb57af00f5115ec48b29675624d9aa87a8511dc3824624b7736d3875eb7ff64f37b5853f03bf7e0a5
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYYatr0zAiX90z/F0jsFB3SQkZ:bgb4mBIBhGFtaB0zj0yjoB2
TLSH
T17465AE1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 6bec1df68699fb2e74eff8efba6ed9f505a16049e2e6b16a02e02f63a360eb6a
MD5 4dd0984da1eb63a7080b3416bbc08b91
SHA1 d4d629d31997932e96aaa679202ef9e4c3a6900b
SHA512 f385ee538409392374347af02bdc641faa010f4c0a76af1f5360cce06fb2c0abc81bd87136d718aecd2e5c1b4baa9de63a4b9ce06cbb24f78965151a5d954d4d
SSDEEP 24576:FG88u8FpJqH1bzria7/m9atr0zAiX90z/F0jsFB3SQk7:o7ZFPqVea7/waB0zj0yjoB2
TLSH
T12B85016676E101F1D477D1388A864663F6B2B8211360EFDF07A89F561F23AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8f2bf345339663b7a5a36819345b9a5d7ae1dfa05d34522b7ec9eb43e6002740
MD5 5841113ff717ee4076dadb204711d61e
SHA1 1b552f8be4f6b21b1a3cbb9d7357dff9048b1a67
SHA512 0f7fba01b31b2d790fa389eedca9a3a69efb22e526fb3e3ddd57be2b53feeee576c0ca59662727751bd7e2d90b1de618c3a10364ed4727e8d025426110f07d5c
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZaB0zj0yjoB2:WG05lO43bVB2Yyjl
TLSH
T111D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23425033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e1b5012adf9823d043a4f7fdc678ada6316b25bd1d40e6a5ebfeff35ba8dc9f4
MD5 c5559ccb0796772d1b6eece99b90e9b2
SHA1 29cc302a2ee61f71bd50e5054d0b752f24cbf818
SHA512 a652b26dd8d22483a223ad922f7bff7bc612b3747214f2ed31f1e72bebabcd452f387321f89abc9066aa5f78b29629590839917212aa47876193c424973a777a
SSDEEP 24576:Jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnbatr0zAiX90z/F0jsFB3SQkA:Za5POZ3+Jt2pasx2+mhaB0zj0yjoB2
TLSH
T10865BF5EA6FC01D5D5B6D17DC583860AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d410cc5ff0dbcbaf3f0c271c265d7c294acd3a625036c78f47aefd17de3b74e3
MD5 bcb194fe1f6df50122e9f82fd6b75b09
SHA1 deb60d5b503ca2ca366428c0c9201de86abd2c18
SHA512 87c939873ba5726f207799fad04835db338feac06d60cc057c96892b43999f1c38cd8d592c4595f5251a7b90a80adbccd79275828115c4d4d11c86ad9be432f2
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkFatr0zAiX90z/F0jsFB3SQkr:TNc/zEOVHFQaB0zj0yjoB2
TLSH
T1F5858C1623E901E4E5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4ad5f66b637f449c48ea816a15d32ea14d34d45c5ab5a3c8ab176b0a9a781e21
MD5 d43e1ed10e4d3ed3f321f23625fbb57d
SHA1 624b61558a14bb01226e0e20f59c4a6dd8b43cc3
SHA512 7f65b1395dd141c9218f0b7bc03d7deedd7878bd9663ec8f5c9edb0160443c4a7d45f4ffabb0cfc8d0bd6d1402931ff9fe95df2ff6628d2172ce0d41dd2ddbc8
SSDEEP 24576:T8kNvNnaFeYhJNtmZBmYatr0zAiX90z/F0jsFB3SQkl:T8MwBtOmYaB0zj0yjoB2
TLSH
T1C355BF2E7AB846E4D1FAC6B4CD238512EA727461173293CB5390C13F4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 000fb63b285394c206a7d6b7ba6035d8644abb859c9a8daeb7954729f5c95b69
MD5 a3ad1db171d800507446be7a25c418a3
SHA1 e4d51f2813a4d65fdb4657fb8a4cb3921f849fdf
SHA512 cfb7656ce44c1e97e15520508af053597087930a9544340e0c1540d7068e0c5a6822c3f33e87538e8d48f08f96696f7adc5ceef0bad60f62ffee3b9e2a4db606
SSDEEP 12288:FHvUrBFrEjwaQKUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:FPUr+NQKatr0zAiX90z/F0jsFB3SQk1
TLSH
T11865E11F22AD18E5E677A13D85818609E772B8621352E2CF02E0917F4F37AD8BD3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 93f4c2718373129608e88a6582be3a8a6d00be66cc08f5eda8776157c66a5d85
MD5 db3a42171bb4b425c8d1cf614cf64ff6
SHA1 02eb888fccaf33fdfc72cf718b43d487a9e0c9d9
SHA512 7aa47a1cce59d093e603281cabbd9e08bb9ec83b1f6143bcccb7b2abbd0c561f2971b5060d8e0f1a3233e24180eb8a462e056b82793932ed637c4b9503dfda07
SSDEEP 24576:kD3FHshBIYQgACatr0zAiX90z/F0jsFB3SQkO:kDVHeBIAACaB0zj0yjoB2
TLSH
T1C475E13EE65D00E4D47BD2BCD6538906E77138A803626ACB12D091BA5F6BEE43D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-305-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1276-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1276-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1276-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1276-95-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1276-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1792-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1792-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1792-321-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1792-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1792-83-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1792-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2044-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2044-55-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/2044-61-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/2044-287-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3004-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3004-127-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3004-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3004-129-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3268-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3268-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3268-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3268-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4224-6-0x00000000024E0000-0x0000000002547000-memory.dmp

Download

memory/4224-7-0x00000000024E0000-0x0000000002547000-memory.dmp

Download

memory/4224-1-0x00000000024E0000-0x0000000002547000-memory.dmp

Download

memory/4224-66-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/4224-0-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/4492-301-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4492-72-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/4492-77-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/4492-71-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4520-45-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4520-39-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4520-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4520-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4520-46-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4520-50-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4860-13-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4860-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4860-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4860-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5204-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5204-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5204-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5204-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5572-304-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5572-108-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/5572-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5572-114-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/6052-319-0x00000162DD8C0000-0x00000162DDA8A000-memory.dmp

Download