13ce4fe0811cdda3fd2676266bef585dee7467df18cf87998c1f9ff2e95ac0cf

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
Size 1.1MB
Sample260727-c7k46avbpg
SHA256 13ce4fe0811cdda3fd2676266bef585dee7467df18cf87998c1f9ff2e95ac0cf
MD5 c3b16a9ddbe4c396a8807955db599bdb
SHA1 7b656f32331c42cb9cec497d7db9852e8121710a
SHA512 f3f047f6df9c26d675a39fc092843fc329223dd35198fc6ee3dea5ecdd30052786428e92110f9e9e158797db19603ec5758617e0e859140203750f2fa3dd9767
SSDEEP 24576:OK+IqF4ptm2kxUlYtEjedEeQ16ywqmpv:Vhp4uYtO2E8ywqev
TLSH
T1B8352A5032F4D926F2F32B743ABDE26148BA7D90AA38C24D2502565D1BF3B40A56CF77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2576	elevation_service.exe
3092	elevation_service.exe
4188	maintenanceservice.exe
992	OSE.EXE
4548	PerceptionSimulationService.exe
4236	perfhost.exe
2360	ReFsDedupSvc.exe
3680	SensorDataService.exe
2720	ssh-agent.exe
1524	AgentService.exe
3408	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\93c9eb3957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\Logs\DXError.log	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002df70ff3711ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085ab02b2711ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c542fb2711ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000545eddb2711ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004719eb2711ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
3092	elevation_service.exe
3092	elevation_service.exe
3092	elevation_service.exe
3092	elevation_service.exe
3092	elevation_service.exe
3092	elevation_service.exe
3092	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4680	2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1524	AgentService.exe
Token: 33	3408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3408	SearchIndexer.exe
Token: SeDebugPrivilege	2576	elevation_service.exe
Token: SeDebugPrivilege	3092	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4884	3408	SearchIndexer.exe	101
PID 3408 wrote to memory of 6336	3408	SearchIndexer.exe	102
PID 3408 wrote to memory of 3288	3408	SearchIndexer.exe	103
PID 3408 wrote to memory of 6848	3408	SearchIndexer.exe	104
PID 3408 wrote to memory of 5528	3408	SearchIndexer.exe	106
PID 3408 wrote to memory of 552	3408	SearchIndexer.exe	107
PID 3408 wrote to memory of 7120	3408	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_c3b16a9ddbe4c396a8807955db599bdb_amadey_elex_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4188

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:992

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4236

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3680

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:7120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7469dae43395e510e56c76f5dbb6273a2abb9f77316ae67cf33667b68407948e
MD5 a79fe09df8273fa84079045f385854b4
SHA1 0ca0bcedede2c6f969f0ca100639f82c8d2d6260
SHA512 26cae381b008e5f7076a09dc2bf345d55a0026fd10a54e673e042cd4adbe46e1a5e45b5fcfd7ab968e60ec24ad4c08adb75947d4f7a0ef0e8510157668de6534
SSDEEP 49152:Kb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnHuYtO2E8ywqev:83q6mjBWuFJ8yHe
TLSH
T1A7D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 cb744297723cbea479f131f56c469cf009ac72458f843c5c91a41b25be80df39
MD5 e10aef403bc70695b3c94745d7aee62b
SHA1 7c4f5fa2181ed5309d1f2b8bb9e2313b427904fe
SHA512 a1e55c4809daae16302da9b5d39f79e19cf50c94d16c3984a476f2d1312d4a8450656b8c9c17b1efebb45e6c091209cd45aedbac40fcf482e677f595ca846261
SSDEEP 24576:4XYfDtczAnm2kxUlYtEjedEeQ16ywqmpv:vtchuYtO2E8ywqev
TLSH
T1F505012977E508F9ED67823CC8A2C512E633789547A4E7CB03E499690F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3373059734159e70ec7206558702c48991ed844fdf05f62c812aac2763dad0ab
MD5 9510ee57f9f751a33ea1199b0d4b8e83
SHA1 e4799bba43707fc94efde7db56003006a6610c98
SHA512 ff9e265eb511670aa1b6f37f072a73be09daa56ed3448b6b8e5f5d08d362c0d1bcab883717120a9fcccf88ff48b53c9350ab1454b53b225816bda456856c55c5
SSDEEP 24576:R0Le5ji0hmxhrM8m2kxUlYtEjedEeQ16ywqmpv:RPji0AzIuYtO2E8ywqev
TLSH
T11535AE16F6748335D073C0B9C5D2A69EE97230861B308ACB4286D77C7E676E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 927ef9c953166b0141a612d4656ef8da6c80e824f431024c011457750a696251
MD5 0895450777ce4e51e2659c85e48c0f09
SHA1 26d35c3935edb39b630b36d360e87b5ce5b0b383
SHA512 cc32efd4c2728c141f1449f10faaa1d039cbebfebb650491ac561c43bb06f1684f64927b5b847cf1a1ebe267c6237a158752f2fab1c3397d46003b7947ab6bb2
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWj6q8wyuOm2kxUlYtEjedEeQ16ywqmpv:T/ezSC6vUzPv+HjyMuYtO2E8ywqev
TLSH
T13F755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cec8494d0df0b0118ab65388fe48d92097f1d0d3c9cfd2e5852136d90272a239
MD5 1a989bf6a754c699a5654d469fa30661
SHA1 6e950021e34170bb4caa8b98ee622b591741fcc2
SHA512 fb4116dde09b670b0264bc9764fb03c9909fb773a0d1ae76eef8745c8622e1164d02e40d87393568e129a63805fee131d4457e4ded836a7651477064a7c9c106
SSDEEP 24576:1VbqPb88hv/l+Bzm2kxUlYtEjedEeQ16ywqmpv:1VO88hXl+ouYtO2E8ywqev
TLSH
T1A2559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 491ee55e529630f4d60c35787eb0f1d00d5e468bed372d56d26de3b9da4d235f
MD5 8f141409246165aae054eaee1b0a94b8
SHA1 cc8c23ab7e7cd372439a1af6c9b16f2669ab5a77
SHA512 ea9517642d900061102a0bcb4116d4c1a309ab4b3299f4867988a50090577abd09e1bd9dd51e0762e1f3148766764ef4428f2f6c0d3f206238062b3b4a52be94
SSDEEP 12288:kG3jcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:kGom2kxUlYtEjedEeQ16ywqmpv
TLSH
T113C423C2A6253588F7655E3434FAE96312564CFA34DCD5DBCBD2B75E80BC023D2EA182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 f70e4f8d0111271eeaa8f94ab0f5ad35461bd42c36861537d7c53beb9fbda872
MD5 67c60697418bd152fa4ae1e1f593f942
SHA1 a67021fcc695ae9e850afb924e6691622e38e620
SHA512 7484408b16c468fad72c04c2d5ad3352017be4ae9a6b31c5c1eb0ab45a2714ee5249421b0599364a87ff3ef7fd78827eb21f708cba5ca6eb5a4904cf0b17e858
SSDEEP 12288:WeBNUbTVO86UmjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzD:WJIULm2kxUlYtEjedEeQ16ywqmpv
TLSH
T15905CF7BEE28FCD2C27A8D785A91C600977278704B61A3CBD165C30EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 894453732d1084193a1ee6660f08d592e35b5ecaaefd4b01d5e77b8eb710c39f
MD5 2b39688d4444a6cc4a4887b643b75d8c
SHA1 7d261e1bf0f18ed3d42d9ecaa014996cf95c4172
SHA512 f25d8bc14e14e6d9601300bbf5f957da1db5a2d51842ee70982729f96ac599839b899508827383da0d73c87fcb6bcd8ae1da22d955a15b5e935d4ae2a233e976
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THG:6QvGAdlCEL8c/WRNw5CBuFJ8yHe
TLSH
T163267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 2af54879083bf573229a8a65ad33c6f4e9a0e660bbb9c199af32fbe872def706
MD5 01f605d0009202d357469f2ffd0869a3
SHA1 fb60d9438cf3221267983cad7d4a981f5e2c67d7
SHA512 c14e6881de2e0cb18da6ecc4275b6f5f448287fd343ce7dd6b839420fa6190f5f14c6d6caeb10ef84b102b5e6891bae7d2bbabade30293d571bcf33d773934c5
SSDEEP 12288:EAwSfxL/2Dc3mDLLmt0LDQewsAjAjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ2:ZfewsAjNm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1C915E031FE74E036D3BB0DB21B36C716142D79604BA11AC3E3E89E9E49742D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5b5bf5dcf5539a805ffa0e2c1de93ff3f099314faaf448175b62b0ebb41f9fd6
MD5 c86a5c197ccd27d2d94d48bcedf10adf
SHA1 9be34ed7bebffbf3555ae42c296fc4643260ee75
SHA512 ffc1a1ad026c93032a65b5cbdf1f81a35b67df6e7c5e9428691e824ac83998901276e2cc9c9d85fbf09b4bf67a824c527180eaef3406b4bc5406ea9d773f6191
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH50y:vUEtQevvqc2W1cpV20I3257
TLSH
T151474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 45c1f5f2eb69a8a532fad7a607de8fe9b52a18b70ac92464f2bc63a3cef3744a
MD5 5b7f7f072933f830a57fed2ae67617c0
SHA1 2b695c66258d08589e4af25f53366267a36e683c
SHA512 db20a709c8562334dc9858ea52b8c624ccfa8ae0c4fd1109df4d9a3e9d2efe2ce6fd8928355ab10d0dd1a480818904d33d5072d3af02636471b657e75735e8d1
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/z4uYtO2E8ywqev:VoqtVjnmVuFJ8yHe
TLSH
T1C2D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cd5975a51289be363089b2032e8379192d0d26baaf995b84cc4a9afc1f54b179
MD5 5893c78124793e5b3b8eb021ca68fa56
SHA1 f5beabc065491acab206c1a691abb2b909e9e499
SHA512 309c143b0f9a03871e9e47b0b1251406357dfb16698831d9c7d4971dd14526ddfd6c0d083af740c778b7cafed28e64fac938bc14ca78cbb1b2f92ef72d42c0f8
SSDEEP 24576:4AhGL6IFoiwtA5l7S53Cm2kxUlYtEjedEeQ16ywqmpv:4AM5Foiq5luYtO2E8ywqev
TLSH
T1AC35AD81E7F915D4F5B3AA7899B69171EA76BCAA5E30C20F2150D21F0E33A50DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c031224c1298eb038d1141a4c41c2eec5d721da6a1e532275ac19cfe02934efe
MD5 ac00d6d658c901d278e003b778aa1a80
SHA1 2267572cf5be32f08387a59764a0f58c40086916
SHA512 4bbedac170847789d014713490b8d1a523eda3358e1cf44bba396fbfa9c521824d0cedb7c772ef2c59e19aff5ce41761d9b1e8c1ca68ae280d8265030d9b22c6
SSDEEP 12288:pmw5HEjsChNEBFgl0WDm+CNjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/ywf:kwuROWBm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1CA05F14676A51CF9F96786388597C132F3F2BC122A64D71F07A0C65B5F37221AE2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 6a83de07c35ca6b4645768d7372387d7ff3074cf5e2f622744f051dd351ab1cf
MD5 169be2bd12b49e0b9780791d949c3795
SHA1 94645df71b2a8e7489c651b37ddaadfd37e0ec8f
SHA512 e9502f075bb3d74305c1a4150f83f86a9a636322d5d26882f2f026e0b581a4b3eb3e94d839f2267d873b0110e51ed038c34c7bd6068cb8c0c4152c39c97997cb
SSDEEP 12288:GyZ1IywjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:/Zu0m2kxUlYtEjedEeQ16ywqmpv
TLSH
T192E4128633A430F9F2A3563C98F59602D37278A7337483CF46A5525E1E776D29E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 879fee7775d993ddcad41d051643941993f243437d83a807dd0a1ee4800367e9
MD5 dc57462fd9cf63ee7fd2e8c420ba50f8
SHA1 cab451d978178981ec967b441ea1b9c72444d551
SHA512 f122debba97448826fd7ce85748979d90816a63c088ed2cda14f87598192e204946035851e13ff832749290caedf4627ba3ce3fab207beb422a505becf2312fa
SSDEEP 98304:sQRQyi36YOcPDLvw2gAf+PN3yuFJ8yHe:zQyiKanX+PNX0y
TLSH
T185667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a5a826938f69ac4d1340d9bfcc486267143539420826d1ebec7b8eb00e1801b0
MD5 596e90fc19e111609734c7a2656a16a9
SHA1 1ea9180eb1fa3970ea7daaa2baa0d52399cbee9b
SHA512 d8b1e039bf0db3077e57c4c2be82e363ed2c9f40069cd49a5652ac717b534e863f5003f5b0c7a75aa31abf3d08e6a72907d5c42ee86333d07614069b8860ed59
SSDEEP 98304:SQRQyi36YOcPDLvw2gAf+PN3yuFJ8yHe:JQyiKanX+PNX0y
TLSH
T185667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8d264121864d58238dd8bc9824eb479864e28264baa95a19f95a2dc66f4fed98
MD5 6baca87ce8b9cd209811ac89e9edad62
SHA1 1ab522a08ab13156e1f21a93a8297ba9b3256bd8
SHA512 eeacd3bfc7c03c7b5fedf0085c3a532262595cdaef67ae48ce31ab90592916acaeecae5b506350d840adde49030dcc82fae24c6483d4b03cc9c49bc4487773b5
SSDEEP 49152:168Qg55nhkeWu7PNU3/IuYtO2E8ywqev:DthTRc/IuFJ8yHe
TLSH
T17DB55A33B2F20099D44DE1769F4A873196D27C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 712d856027ee3b0085adc2d70b9d6a82ddeaa1c8789788e65f9d0286bdc6e673
MD5 35dab2ffe4323cba457b8f02ddc8d4b4
SHA1 e1ab29f2464684760c3ae45f0f479882763c8a8e
SHA512 827d3beaaedb1b6e838a9d6aadc58adf5da469f1c13345d905f1e0586818dfdc35d365d5f70a00ad18816639606964d4a12692686bc670050fbe878712335d61
SSDEEP 98304:Py5112gYy5azzVvU69nLKnhZruFJ8yHe:CLIHRWhY0y
TLSH
T197167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f7e64d60d9dacc6f7d8720c7b5ef4e3729c8ad131539c8e76904c95a30d64d08
MD5 487e5c739ff34ae48eaa8db4620cab2e
SHA1 057c85f2d34e75fd8929dced06a854aeaa3421b0
SHA512 8b7096ad14b86302bdfff06bdd00dd4386efd1d9980dc612f6d4daa5d8995576661caf3b978b23cf696ad5154134a83d6b855f8e4020d7478e88c8f016fb33e6
SSDEEP 49152:iB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glquYtO2E8ywqev:Qu6JmIxd2dquFJ8yHe
TLSH
T189D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1bb945724c2ba3684d1698302a11dc063817e1e4e2a1c4b8dfc2882db2dba3f5
MD5 a64e3f1131043747277e3244ae6f644e
SHA1 f2d702dcf388ae9463eac3c8ba8a2ed3faf1ca9b
SHA512 f507e24a17344968bdd15f1ac835f94f25082756062b003920bdc2a5deaedf4691448bec1742947bf6d234c1b48122cb4ab4a05ac96995c873668b9e750b957e
SSDEEP 49152:01hpsNoJpF1A67U44CwH7R4x+uYtO2E8ywqev:0mifPqRVuFJ8yHe
TLSH
T16CB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1abecdddf6ab222b9d9a2bd177851bc3bde3de96e937c7b5e57f4eafb5980cef
MD5 ca6968f3329b44f690635d748c099fbc
SHA1 507d9a09fbf9fd7382fba2e67d8e3aafd9a87c01
SHA512 0470c1eebe9a9276a8521a83e5c29bc6c804adafd329f4b466badcd809a476f4fe248cb5889abb4dd87b66f5b14735281d4a9c54bd77530c126a676ea725d38b
SSDEEP 49152:FSuZQIY0Be2KkRVtOnks6NMHqXuYtO2E8ywqev:L5dKqi61XuFJ8yHe
TLSH
T1EEC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 32d7dc0277d5b26a5a29af36faf698c9a6172c4f28bfb3a800afa2402ebe7e9c
MD5 96bf80247a5c3b0e85a079b4894ee05e
SHA1 38d10afe0a185aa83c2b4b9b7403fb833ed30262
SHA512 40709a1bd58107b055089fff15334052fa35099a6f23582897d6ef5fd6df7250963a1772a18ca1502840bfd679b5facfbfd23bf2d7f5774c5791b158ecd5fe9d
SSDEEP 49152:QhtSn8EApI0figjgiDn0AP5w6uYtO2E8ywqev:BX2iWphpuFJ8yHe
TLSH
T19B95BF13F2D901E8D05ED178C7568632EA62BC160B34B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 9f68faf7a75de16d7d8653ca3439725650a166dfbe4a1561769774c24a1b0106
MD5 8b0eb0e63061f9096e9bf94b618c791a
SHA1 17ddf385072b1e93c92b8f8649c1af101e94ee0c
SHA512 f0976fea9770e125b4c6ac1f0ea15a1d72165093fc55190dd54927555e229f87516495fba0aacf7d55ff3a290a4c346dd7a0248d9abaa0b3c67268ffe470df0e
SSDEEP 12288:9PjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:9Am2kxUlYtEjedEeQ16ywqmpv
TLSH
T1E9C423C2A827358DF2119A3454F6E663125A1DFF76D8D1DBDBCAB21E80BD023D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 5aa9bf17a26254bf2830d30e8cc90710b7a0d7499e6cf47ee81a1a2496838b77
MD5 a75e6d246bc1a077a498c1593569446e
SHA1 986a94d7670ed9cfddf273e8430d110df0bf60d1
SHA512 c33a6cd5a43fbb8f75adf79905ce80e76310e23c128be6a134531dddd33b5c33049e5ad377fedb4f3dbb5fe03b4e5cfaf388c4e8f42be531166d3100a6bb7faa
SSDEEP 12288:ykjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:yJm2kxUlYtEjedEeQ16ywqmpv
TLSH
T134C423C2A8273589F2149A3460F6D663125A1DFF75D8C1DBDBCAB11E80BD027D6DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b8b3211e9d5c515560d8c680f6df4a56186ee982c54ccb8cf7baca4ca8daf278
MD5 15bbc6ce2ff4a0b5b3c44231561290c1
SHA1 9af752e23c63e36c3d81d5a263184965260a3ed5
SHA512 0fc1424cbefd3cb5813944287a3ed8b388e6c165a724d7ace86e342909902479fd45942f352f3dadbd567a4db3ce4e89dd837eda1748caf0c9ca09d538f010c7
SSDEEP 12288:I+jcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Ijm2kxUlYtEjedEeQ16ywqmpv
TLSH
T11BC42382A827358DF2149A3460F6D6A3125A0DFF75D8D1DBDBCBB11E80BD027D6EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 2b0575c061db1fb453d02d333f74d479eb920f0ad6ad80e27a165cbfe7eb416e
MD5 f7e62da426fec22dc7f423aca339a765
SHA1 8da2652b3288a2adaa613ee681231dcd35c216be
SHA512 a0b6fe05b5d798905eb3e932558e228b2fa4dce9e541b0ebb8497cd09dac59e5109971b1fd09441c72f923b01ddc498e7c4944d1a9360d6acddd01761584a420
SSDEEP 12288:PVJjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Ym2kxUlYtEjedEeQ16ywqmpv
TLSH
T189D42382762631C9F521D634C4F2D52393B67CFA77B4D2DFCB81660E0CB9252DAB9281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 6b7c8788658a25921f71bbc930d73e54a75185196969e28651827e2236e807c9
MD5 abe4db22ebbdd93bd26369482b2d6b1e
SHA1 a8fd0062a78361f63c566805a88cba13802163e9
SHA512 e59739ea132c4d4648376f22f59cb668cf782165f4e24d3f19d9d440f61c70cfedd8a478cd87f1ae3cf07ee8cff9ccfd2b12092e0f60fe1b5a0aa5d903587dd3
SSDEEP 12288:RxjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:RKm2kxUlYtEjedEeQ16ywqmpv
TLSH
T190C423C2A8273549F2149A3460F6D6A3125A0DFF75D8D1DBDBCBB21E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 63ba13b3dcd654b56ef01464cd32e7a0635e1ea0b5c1179d5b19e9c235f90985
MD5 ccee0a335bcfb9cd7b6de599f33d5845
SHA1 7d93483b1c39a2b5658876c55698dc03e39dc7d3
SHA512 19f69aa48257180a1348ffc8d1bff7f182bf8f167a2d1a6e1d9b9b4e91170cb7e151ec0cf27e470c4074ae90e0feacdf6e679062667c4426d3e08f91bcb8be53
SSDEEP 12288:q4jcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:qFm2kxUlYtEjedEeQ16ywqmpv
TLSH
T15AC423C2A8263589F2159A3464F6E663125A1DFF75D8D1DBDBCAB21E80BC023D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 895ecf84f549cde88ef44b13f8301cb6529365df9ffabbdb4f9ad6cb2e01e394
MD5 f9389c901b4ca02dbb0970bc0d6fb24b
SHA1 03b365da7aa4a41aa2b8738c22ef44927973716c
SHA512 a6ce2c3c3afd2a88fbfa2f939bda76156bc587c19aa164c6859a66bb2376f526ee9adb0f1485cef86cc62535855eecbcb1bc90aa9955295bafad9e4d17d00f3f
SSDEEP 12288:FMjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Fxm2kxUlYtEjedEeQ16ywqmpv
TLSH
T18CC423C2A8273589F3158A3460F6E662025A1DFF75D8C1DBDBCBB21E80BD023D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 09f07495868bdda9bdb2b0b44e228b93c02f3004cd82580bb1db9d73659b1713
MD5 abcd9431416b167df96de8fbea27029e
SHA1 6ba79232dac7262b14094cbda2809a4a41c4c171
SHA512 99fc11d0024485ef9b209391cffb15356c2e2b5083e6de2950baad8773cc568c4d905dd8b0be6a5fdb9a9f13665838a66f525e80b83921ddb8ba4b1485575bcd
SSDEEP 24576:FZM3zFVSOpm2kxUlYtEjedEeQ16ywqmpv:FZM3zfAuYtO2E8ywqev
TLSH
T166050295B35018F8EC63823EC8658916D2B27C6A17B0C65F03E4362B5F373A15D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 2402eff434d14ee428938240188d759018b7f6cb96707fc663e5e1b6386b1604
MD5 aded123df319ec99c0794684d23483e2
SHA1 036cd1a2aa76f33052964fc361832771c5425f35
SHA512 1c851852c8822675201ed826ec55e57b8e68c03998204d555f32622f9a2a512715c3f059e889681adb7ccd2041f1273fe9bdd3e6c05f8e39a6c912116c1429f9
SSDEEP 12288:CbjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:CEm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1BAC423C2A827358DF6149A3460F6D66202590DFF75D8D1DBDBCBB21E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 e55b4020120d512bc313ea1ba0cc766b3fc7099c629b1f5d2a291d62bbfdac99
MD5 edb123645c35642a471b645a6e1daaad
SHA1 445c65c10b6a799df14df1522562df5522f748a2
SHA512 b1d4cb7bfd5c169526dc1acacdad1687935ac915f9925b3fcb0e7c27199745657895dbc25be92ab38713e52d331a9a378ca7ed7c46134fb81ba6ecee15b5c77c
SSDEEP 12288:pnjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:p4m2kxUlYtEjedEeQ16ywqmpv
TLSH
T133C423C2A826358DF6109A3460F6E66202595DFF75D8D1DBDBCBB21E80BC027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 6ecc987f064725b523da558522d56b5ec96c0c93fce216805bcbd8c71650b717
MD5 616a1d18201c23ddc97d60d84e69d62a
SHA1 7d6051fc0db48b7f20ce66a53f691a0a8d12ac67
SHA512 cb2c60b5682141616182cc58823de57cd5aff18b678284e82ffc2f9addf41a79f477e45e3b5f28f0b1fa73dfe1c39074f79b158c46ac5cdc23101acb4c4f95ec
SSDEEP 12288:WyPz5L8wjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:rzydm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1D3F4124773A130FCE1368238C8A25A12F37278761764CAEF57A4477A1E372919E7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e21ca7a496f6231fd945f46693f05de722a4effb955d096d203cf85243df5d6d
MD5 f4689e594a9a766b320abdbf61758b02
SHA1 fbf0a4789da8a49188b525ee3e2a9546d07de7fb
SHA512 819c7cacd0b742930e83b6f63e367c94e157d3e7a574e5d5220b9de2ebe64fcd349284619707a6338a21c6560728f4004985c9d8b7582e375bc23cb8a214c1dd
SSDEEP 12288:vbjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:vEm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1DDC423C2A827358DF6149A3460F6D6A202591DFF75D8D1DBDBCBB21E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 0ffdf770ab0f08796420636e69aeee3fae8b74e93aa52d41c3fa75eff40d1eae
MD5 0d7390776b75d5c205dc66e706d62629
SHA1 ca17c389870457368090c9be04c633586e02cb6d
SHA512 1a4aca142b4ea515fdc15af6d1c988c683e54484151d12620b4c9c1861b1f70512a96d72fcc69dca6dad6124b8e27e092c5884410a619f1c8fe95dfbbc925186
SSDEEP 12288:fbjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:fEm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1E8C423C2A827358DF6145A3460E6D6A302591DFF75D8D1DBDBCBB21E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c25905f5e65a31339a805376f5f1fcaed2e80926cfd9496b7a629c41a6ebe566
MD5 95f1f8898642830d591e41a66151d9c4
SHA1 e1f5451837bcbebb89d376e933963ef1733422b8
SHA512 5b6c4451227d0aedc5268e444a1759d437c1ab629bbedbf6286be3edecdb852f7f91c1d3420dc5ccca66234a5b170a6aa266af617357f401eaf741cafbc32b95
SSDEEP 12288:vyPz5L8wjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Czydm2kxUlYtEjedEeQ16ywqmpv
TLSH
T118F4124773A130FCE1368238C8A25A12F37278761764CAEF57A4477A1E372919E7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 d422eebb8e20e482b214f1ee3394117420221f547c0c69492d08181608f1a262
MD5 7207c5c652521a097fb88199c5d2f4ba
SHA1 dd559a091b00cdd0b400aa94e064370abd08e581
SHA512 132308d6250f3617692da478f964a67d3d46ac495d54a6b99f6b13ef545d6456ec79553a4d6f5dd6f6b50a4b63e58d394d606fd5377f9a24b5e348b9bb766453
SSDEEP 24576:OT8aLl3z0zDTm2kxUlYtEjedEeQ16ywqmpv:OT7LljxuYtO2E8ywqev
TLSH
T156050295B35018F8EC67823EC8658912D2B27C6A17B0C65F03E4366B4F373A15D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 2b930700926ab880a086836a9af321ef6a5669f67a0aa982a5e8dcb534782b9f
MD5 a0cc775be3292b7e663f49f0c41eb5ae
SHA1 5e5787b16d67b832da6483d5979d743c2398f34f
SHA512 614d5e24657357e58ae1a3e0683dd1b5c977be5fd7f29763884cc51977e8ee8b907672a8e46c9a835507a6272e536738ea8b902bcbefc14026d8577355a492e4
SSDEEP 24576:v3rd9CHKy7GZfm2kxUlYtEjedEeQ16ywqmpv:/rd9CHKyaAuYtO2E8ywqev
TLSH
T1C725CF90F3E410E8F1B7DA3588769512DA767C9A1B70DA8F03A4661A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 1a14a988e86a725d7e5f5d1b19174262c06d56c47cb088ec99022de2b7b9d242
MD5 2a08fc01d7bd5fd23a6c358125fc3543
SHA1 fbd00100a4b9409f46034722db9704cb4a51a8ff
SHA512 41d195fbc9930f88f4de4e062d2554c006df5f95fffb619824c36170cfc43e1b013a2c65035a4bcf5d2e65fd08d075ca5176e983c92f227a566932eb20a97cc7
SSDEEP 12288:LejcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:LDm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1B8C423C2A8273589F6149A3460F6E662125A0DFF75D8D1DBDBCBB11E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 dc4d0e1742468b1fb64a3d3df8c2a4a04566ca291a8c2c7e803cd4927afa865c
MD5 3c1154ab8c8f07d6286331a5d32a6ad3
SHA1 951ab4dc0641b04ceb2825731e9a273820169dd4
SHA512 0bfe703e544500fc433d063ee6d40df483a64a7d7c9285d2876adb54f3f00a165386178d3343180b11d0ad635af07a597b901e6d9373e87f97963a60f05b81da
SSDEEP 12288:4QjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:49m2kxUlYtEjedEeQ16ywqmpv
TLSH
T165C423C2A926359DF3149A3460F6E663125A1DFF75D8C1DBDBCBB11E80BD023D2EA085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 2a660315cbe857ba9a4d4aa0a9f4c46966af1a6d93193f485004189bb7a4daef
MD5 872bcf4a20448ca9c3763cb7217bd185
SHA1 9e722595f336dcde4cfc6162ff7b2eda5b612095
SHA512 b8b016fc0e3065917e097fd23cd7d70190ad255bb7ea4f8033e40fd7c7358ffff93b3c028c9b6587e4f969b021497ad9434184751304cdcd5c5be6ede2d96925
SSDEEP 12288:B1jcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:B2m2kxUlYtEjedEeQ16ywqmpv
TLSH
T12CC423C2A827358DF6149A3460F6D6A202591DFF75D8D1DBDBCBB21E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 490a9e6b7d862bd70dfa84b667b9b69c1eaeaf53dacd0ad46ebcd7681f7b6949
MD5 678cd3962846127b1e5d26e23a9c506a
SHA1 1ce6697e004b13ed290e053715316bc0840a6cc0
SHA512 5a8c3086117b2f81486bcceff39bdf96b209f1b8a279df15d63579fc8039bc89571c04c1572be0afbf31ce3744f7f3a8c740fc182065f4315bc7e692b70f7279
SSDEEP 12288:ybjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:yEm2kxUlYtEjedEeQ16ywqmpv
TLSH
T10CC423C2A827358DF6149A3460F6D6A202591DFF75D8D1DBDBCBB21E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d6eef19f6e717dcde0b236cce4401aff40caddb3fd64ba519be854dc671bd044
MD5 24b9d989e4a21d8d612dc061608633a9
SHA1 4cfb5ba9cb49727d972fd44679396339d80fe64b
SHA512 00bd536db7df0455722b5222103eb0f61b0b0edfdc2b7cbd59d6898780d898a9cd4eedb087d3f252751fb98dac24c0e774c5210bc4e543bedb9ed13e4d8aab56
SSDEEP 12288:JejcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:JDm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1D3C423C2A8273589F2149A3464F6D6A2125A0DFF75D8D1DBDBCBB11E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 e1eb5e03fed3fe5c581923748e42cc614196dfd1b09354e27cc00ad03000bc6a
MD5 a1354d66dfabec50231635c2758cd451
SHA1 97a0e16cd2bb0123790bb6145131f3a9c9176e37
SHA512 7e1308e7005e5aa4d3bebf7b34dfd2b7495223d791e4c33edc371ebdd7c543cee895d3a36a2d0f5b28bae50ac70227e67cef2567f771acdad3ecae74246facf5
SSDEEP 12288:HjjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Hsm2kxUlYtEjedEeQ16ywqmpv
TLSH
T199C423C2A827358DF6149A3464F6E663025A1DFF75D8D1DBDBCBB20E80BD027D2DA085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 e1f87650bac41a0f1958668142285e4720cc2d550edee1bb641d08ff4061f1f4
MD5 0e43400c1b929631f5cb08a15b0e3a79
SHA1 d7ef526fbd90e83b84f7f4c007952b6738e6b828
SHA512 24aacf1c71863ad1d95a76b5a8d313d0793e650c6a3e40c0939e103c4c933622fd81feb3c1f6640dd1545d76ffed41e840b4d4018c74793899a65d5212017456
SSDEEP 12288:PxjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:PKm2kxUlYtEjedEeQ16ywqmpv
TLSH
T148C423C2A8273549F2149A3464F6D6A3125A0DFF75D8D1DBDBCBB11E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 a663661462d8ae77531713a2ab949d6e234ae52e10f7c256eb6d09941cf43903
MD5 667abf031e47de1176bc2c503e23e135
SHA1 01d8e6291f56130ffa99482e03b2b07af95d2c9e
SHA512 47d590ff6da68c09e8898b9369e068324a5c0c069354dd10cc4a28988d80a2a614d2701506741969260c9300d1f478b5c7016f8222fa9cb6be2f871a6e2b8681
SSDEEP 12288:YWjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Ybm2kxUlYtEjedEeQ16ywqmpv
TLSH
T155C423C2A827358DF6149A3464F6D663025A0DFF75D8D1DBDBCBB21E80BD027D2DA085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 303e6055d5f321921b5729758b832b7d22f310b10c56931e1fda9a659dce7f6f
MD5 4e6c7307651a1598d188f36287c46981
SHA1 65b733dea1ffa7912a091145d507e8e596547925
SHA512 b7c72a0a6d6d63347142d6bfa34ffd05050136ca68af860d80c66b4d4a1874ca1943bf8ab3af436397423c8623cd72606c1a057837e09cb52bab9b4c31d5e908
SSDEEP 12288:gxjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:gKm2kxUlYtEjedEeQ16ywqmpv
TLSH
T182C423C2A8273549F2149A3464F6D6A3125A0DFF75D8D1DBDBCBB11E80BD027D2EA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 74ade48836507d5710be99c982967b43294880386aa440df0c61834397b5fa22
MD5 26dca5901a55059d54e06bd5c07dab63
SHA1 1ad85d772c0ec853dce422b4d6ed9bc4aab320a5
SHA512 070a1697b3cb7ce9e69508ad99bfcbb0499151de20e1a2d5c3046fa4ae6a4d54f9c34e5633024f59e02b3ad40253497c5575cbf0f14d81792e6f4cede3803ea7
SSDEEP 24576:Cfwvzk9RX6wkyAIIm2kxUlYtEjedEeQ16ywqmpv:pMnYILuYtO2E8ywqev
TLSH
T18635C029EBDC04E5E177923C99B7460AF2B178691B71C2CF029A536D0E37ED49E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f94ec7265954ef7ec362f3933f7d79fdc8e51bec62d47f35ac6a1bd37bf3b1ae
MD5 2151eb96658c20b4d22b6c9f355bf695
SHA1 37692db64d94395681dcb07ef108a6cd715f55ac
SHA512 ed8b08f2a22f466e283e0cadfa075e8ea89fb732de7f5fbaa168b31326f2c21d572cac10deb8206bf2c3d68623fa63bfc2e946d981a4a9511b074035b24b5d88
SSDEEP 49152:+YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0auYtO2E8ywqev:hySzPSuFJ8yHe
TLSH
T17B067C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3788f39f65266a8d045393ab7a6014d6477c5e1cfe1a809bbfe1edacdc1dd2e6
MD5 4bd77f483ed22d1a2d47fcc8a50d0864
SHA1 c2c050b4cb156ca2b027087ec4e0f9f17aaf8351
SHA512 8a71ccfd4a02379cf36d99a2fbf09457e4263d411c38fecd711bc26b2bf507eb24bcec7d1a8786ec6be6550504e3a893d7db6fc085490d12f99eb93fa6144c4f
SSDEEP 24576:D47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY5m2kxUlYtEjedEeQ16ywqmpv:D47JUQjqirIhCnDHUPfF/quYtO2E8ywf
TLSH
T18365AE1EA3EC01D5E1BA927885158A5AEA71742E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 edb7851a5c599b2fee93f60926de1bedd93ad0932ea4cfd8623ff8c17fe0f1e2
MD5 8cc960bcdfe660ed28c7bc24daa0a1ea
SHA1 72d5df14d2bca651aa9ebdaac0aaf9d85d53a0e8
SHA512 7a8221d461ab098a4853e3d345cfc66f04a1d56360e91e37088b2655ec90bd5966f787eb2c6bdf1aa022b49c1b6cdcbb85826da9e7c9ba922019ffab99a3b424
SSDEEP 12288:ypsfrjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:70m2kxUlYtEjedEeQ16ywqmpv
TLSH
T1C2E4014AD25812D8D16E6239C7969A41B3333C6693E0D3CB57C0F53E0F7A2919EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 42fe5cba44c0a602123e091e7c60610013ac25831e22a4d1dd5e16f911b74b2e
MD5 7e163017d6c1cced14f093ba1a558811
SHA1 bb070afce70b5ce34da618f17d2593a16e35f0c5
SHA512 d860aab8c9754403af2dbbf50630ff6596178488e9b2ad831df9de5e42b2dd8fb3a578389570e87289611e0be72835fd81d04d84da94cd883070896aff2c7bce
SSDEEP 12288:ZMB45U3faeIiqgSJ07wk771MEd2JVQrS8Ok7wczKX7r:ZM65UP24J771MVJGrS8B7wew7
TLSH
T1F5352850766BD75FC5A940321E73C1CCAB707D01EE45AB03B2C8972FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 86d4fd0b0ab3c7e6802525e965e82e0c22ce3d82dcb72c43ecac2e4deecf4dee
MD5 86e92037ac58f85e5db4e5a3b30ed76a
SHA1 af2a1f09b4fec43665a06c17822d55ae15705825
SHA512 10324029a131244f3d3bfa3f1f32b551e4647d199d0933d29e45b8a154b9a0428196b8bc3cf8f96505ec02e15c6da9b0ca535754d188265140f939f45bb7cef8
SSDEEP 6144:MqyIAkstttIts31Y5lazIzthFYtFtmtft9PptMxy3vt0txtYt8tJPptMxlnl8gqO:cVjOqmOQqLUllva3KiiF1viv7s
TLSH
T19465E8405537E38FD1F76032076A9B4CAB74EC0777096F26B3C8453AD82AA25A5BC3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXError.log

Path C:\Windows\Logs\DXError.log
Size 250B
SHA256 86949bd83c1657d11d058d0db7c4811500371ffde67138871911b2a4ce4db11f
MD5 f35e4673a92d3c83b438614df3c57fad
SHA1 9109ed1234b096e9749250a0547e2d636bfea739
SHA512 6a59b1469e16eff40f10855b6e7aae52ee0c9086edef2bc19b084d4b6fcf230e64742ae52be25ec0e96503c6477686c5ff7fb0a87bc3ad56533d26b5d70419c6
TLSH
T19BD0971C2ED6007CB873C5446F6F0388CF8664274C200330328906CE1AA082D2BFE4AA
MD5 SHA1 SHA512 TLSH

Submit Download

DXError.log

Path C:\Windows\Logs\DXError.log
Size 1KB
SHA256 1bbc419bcc2c30a3cc8b18fc05e2de5615bec1fb15e21c188d3a431a990c1fa4
MD5 b2b5daad8260f93d10abd080e27ec055
SHA1 2b57c3f05a4c107907efeaa743c0018dac7de8b8
SHA512 55cceb080999b53e24edc0ef7d3b97ec4cb62b0f7688c9feb71c576c2bb1c58bdcb612ce9e204ee2719ef6444e0ffa0d938ad7a141bf1c22c4b1df9715ece456
TLSH
T1FE117B0C1EE7616DB1F7C144BE2B03ACDF9661975C659730328542CD1AA109D7ACF4BA
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 570B
SHA256 042e19cc9612a8f7d21b1ad4cf59ded818debeaab5d931ac59b911c9be240423
MD5 e9e5b88cdcc4820db9b27b2121c7c9f4
SHA1 1eb1ebdf327360dfde4973f7aaf17cb6304fcb3a
SHA512 eddff5dfefeca677eb32dab3245e7415cc1f138ec1b33bf4d11c616f898a552c2200ac1945ba2501c8b393b1107dfaf953ec3e95507fd10a799a8bbed928eff2
TLSH
T17FF09ACC3AFAF2782692C944492B30813B4DF5332271112403F49A2E20A0F8DFB2F46D
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 1KB
SHA256 61e9cdff059a36a5a5162c6009cd0868d6a94124b4ea658b2eefc7e2a9087fa4
MD5 1b3a2f7801b0b4260b727c0929005c01
SHA1 668f78ed2ed0be38654eb45d46a4710eb74f5155
SHA512 cb4bdec22b5618003d97b8569fca8404d4f5e8385a0a2ecf5efcba221b7d75a96a3c2b142f1bb234b8fd0b9b34cf59bde953436e4488dfea1af1e969c3afdf3b
TLSH
T16E21238E3FFBE27921D1C904183B21A83B1DF5731731252102E0866E6094ACCFB1F579
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d51f04d6629a09a7da60e2badf8a8be7b764ab21b6affdc7ccf7d567b86fe666
MD5 97300cde98caa59307fc2a8877b6fa9b
SHA1 4784d7884bcba0b7ae9cca06f38cf50b693d2b0c
SHA512 3ddb67ce73a53780490f302f2b553f8cd491872623e3d5cc469be52f292afa0d0c63897ca25f013d201b6a13e37dc3b70e5ef3a8bfae77b7c77bc604b1929d31
SSDEEP 12288:qM7zjcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Hcm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1F4D42382A65A3949F6755A3410FAD532121E7DFA3BC8C0CBE686B35E407C0D3DEF9146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 59598642f20b52ce25d66c0ec9b02de918cd547316a4e3e6e94c136dc084b77d
MD5 a4f2c330b908fd880b6a35c175cbb29d
SHA1 7f739b6a3107d802218c2a2fc0d806b382308981
SHA512 39caef123857b40d0506a8abf39c953ad43eb89d771bbc6db0a7888235e929d4f9c3f4dc2d88e48216705a403c018077414f5ae58cb8972c0aab563ea12ec9db
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYOm2kxUlYtEjedEeQ16ywqmpv:3gb4mBIBhGFEuYtO2E8ywqev
TLSH
T1F565AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 83e6426db496167ac8345c923387850e7c46a5a5a7d8a8b18976829a3a678ef8
MD5 ebc8938a808e444ea4d5b0bd639fc5e8
SHA1 8e5a1b786ac099b4491917293b75b9b2f07f19fd
SHA512 a5d58e6b081d28297480bbe382b7dc8bf84d67ce5f5cc746edec1604ad6116e938b27d63fc60b8afc64ad3f386480fd0114b2b37550b8353a55d1ef330415c90
SSDEEP 24576:eG88u8FpJqH1vzria7/mpm2kxUlYtEjedEeQ16ywqmpv:17ZFPqVya7/ZuYtO2E8ywqev
TLSH
T16C35016576E101F0E47BD13889824663F2B2B8251364EBDF07A88B551F33AE54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 e3f1c69110761a98adcc18ef27d2d51696c85c9594f85b1f344cd619f6381ef9
MD5 44f326f1a3e8c1bd3f4f6a1ad9e2a44b
SHA1 1129bce616b1ad6a6f513f8ccb111baa1913b593
SHA512 d247733b13e71400159a9cf3cd639a8ef3bda2d0c759307b7807fc14fc8fae2b9a1970578aa91d7acab1ddc83f7a06f311b4bd3a2dad0bece537c998424265e3
SSDEEP 12288:SHvUrBFrEjwaQojcAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZH:SPUr+NQVm2kxUlYtEjedEeQ16ywqmpv
TLSH
T10805E15F22AD18E5F676E17C85828719E372B8621351D2CF02E1817E4E779E8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 81d0928dbad2c445faaa39224226d07e13daca70f7ef38037f8cd5bb5f10dc96
MD5 8c9b49472a5eb8ee37035c75165c4b9e
SHA1 9f5a3867d2d08b13aec64bd4a32f2c17577380e0
SHA512 cb91ed0d4262d88428c3f2637e019855f087a01d89a7faacdcd7818cdef48ab9cb1295254ed0f663bee99c630dd5b675f03bcb9fca6d3b81a2bf701da0f2439f
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwuYtO2E8ywqev:SG05lO43bTuFJ8yHe
TLSH
T1DBD5CF6A62EC11F9D1BBD17CD9C6860BEBB23825033456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 95ef2b4e23077e2b6b9b4ad1778127b6ce9efd45d777d5012e74992ddc3fdcff
MD5 9a277fed632ab0a02b33e093a1943cdf
SHA1 38c776616c252f653a5eb4d09b898f1cee527929
SHA512 669eaad9745093ebb966011fdde03e58b32f355e3894c0ef79ba624fee1a7260c8200abeacc9b9e6eea4400fd6457bd2bedd75f430968f49519737d49cb85f2b
SSDEEP 24576:1fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnHm2kxUlYtEjedEeQ16ywqmpv:Va5POZ3lJt2pasx2+mIuYtO2E8ywqev
TLSH
T1FD65BF5EA6FC01D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 64c871b8237f83af422165d7ebb5f643e045ae1ed889754b22732536bbfcca60
MD5 1d409b3daa89d329b5bcc6202745648c
SHA1 eb3b2ba5b2dc7febb37d6e4633e5900221625956
SHA512 4095934247a5384cc825cb6c2a9cc8915711b47da923a5870ec36c5d8eb3635016e3b5d00c9b8b318ada8aa0b36d83803cc9f82d389fd02763117d43608f1c31
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7Fkhm2kxUlYtEjedEeQ16ywqmpv:GNc/zEOVHF5uYtO2E8ywqev
TLSH
T18B857B5622E901E4F1BBE1BE89779546FAB17869133486CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1573a8d7949c089076267633cd96a863f395f8ed5ead1273a0b53275d3f6f5e5
MD5 4877810225fb187294447ed3ea853f70
SHA1 3746e28c4493a9054200ae9d26e6493c6bc4d5ac
SHA512 f45798a0853a34e13238478889f76aa91d0077c19f2655ad43b42ed9f892cbecdaa571e277645dde9828cb240f78b4251458727bcacfdef4397f6632c5d1d0cf
SSDEEP 24576:IzkNvNnaFeYhJNtmZBmbm2kxUlYtEjedEeQ16ywqmpv:IzMwBtOmuuYtO2E8ywqev
TLSH
T14255AF6EB6B806E4E1FEC6748D238512E6727461173293CB5390C13F0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 5248f2f8e32492bc0106c8efabe40e13ce4bd87dab1cea8243e4d75f84af905f
MD5 19d6d4076cc3f6dc4bd733eac2317ae5
SHA1 8f3bf34f4249f5f94b64678135f742fe5f57a345
SHA512 41ecb6c3398824681f703cb78c697d62356ceb066cb3223942c869c457da4810fb25eb5d75f3dad6432597c443d1e9b5fd2997aa4a65296a6127b400d89fb871
SSDEEP 24576:/D3FHshBIYQgAgm2kxUlYtEjedEeQ16ywqmpv:/DVHeBIAAjuYtO2E8ywqev
TLSH
T11C25E17EE65C04E4E57AD1BCD6A38A06E37138AD032156CB02D4C1BA5F6BEE46D3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/992-117-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/992-111-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/992-335-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/992-110-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1524-195-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1524-182-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1524-181-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1524-188-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1524-192-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2360-424-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2360-153-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2360-437-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2360-439-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2360-144-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2360-150-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2576-78-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2576-35-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2576-34-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2576-77-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2576-175-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2720-177-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2720-169-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2720-425-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2720-176-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3092-83-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3092-91-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3092-90-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3092-198-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3092-84-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3408-206-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3408-426-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3408-200-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3408-199-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3680-416-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3680-157-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3680-423-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3680-156-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3680-163-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4188-102-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4188-95-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4188-106-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4188-108-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4188-96-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/4236-400-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4236-139-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/4236-134-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/4236-133-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4548-121-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4548-129-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4548-123-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4548-350-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4680-7-0x0000000000CF0000-0x0000000000D57000-memory.dmp

Download

memory/4680-369-0x0000000001000000-0x0000000001114000-memory.dmp

Download

memory/4680-143-0x0000000001000000-0x0000000001114000-memory.dmp

Download

memory/4680-0-0x0000000001000000-0x0000000001114000-memory.dmp

Download

memory/4680-6-0x0000000000CF0000-0x0000000000D57000-memory.dmp

Download

memory/4680-1-0x0000000000CF0000-0x0000000000D57000-memory.dmp

Download